Part of: #3511
User Story
As a Fedora packager and as a downstream consumer of the OpenShell RPM, I want the package's License: tag to accurately reflect every license actually shipped in the binary, so the package is legally accurate and passes Fedora's licensing review.
Problem Statement
openshell.spec currently sets License: Apache-2.0 — OpenShell's own license — but the binaries statically bundle ~600 vendored Rust crates under a mix of licenses (MIT, BSD variants, MPL-2.0, Unicode-3.0, ISC, etc.). %cargo_license/%{cargo_license_summary} already generate a LICENSE.dependencies report, but nothing reconciles that report into the spec's License: field.
Impact / Why This Matters
Fedora's Licensing Guidelines require the License: tag to be an SPDX expression covering every license present in the binary package, not just the top-level project's own license. An inaccurate License: tag is a hard blocker in Fedora package review, and any crate license not on Fedora's allowed-license list needs a separate Fedora Legal conversation before the package can be accepted.
Proposed Design
Consume %cargo_license's per-crate license output and reduce it to a deduplicated SPDX expression as part of the source-generation script, so the aggregated license expression is computed at the same time the vendor tarball is produced, rather than hand-maintained.
Acceptance Criteria
Alternatives Considered
- One-time manual audit, hand-patch the
License: tag — rejected as a long-term approach; it will drift out of sync silently as dependencies change across releases.
- Leave
License: as just Apache-2.0 — rejected outright; this is a licensing-accuracy problem independent of Fedora, not just a Fedora-review nicety.
Part of: #3511
User Story
As a Fedora packager and as a downstream consumer of the OpenShell RPM, I want the package's
License:tag to accurately reflect every license actually shipped in the binary, so the package is legally accurate and passes Fedora's licensing review.Problem Statement
openshell.speccurrently setsLicense: Apache-2.0— OpenShell's own license — but the binaries statically bundle ~600 vendored Rust crates under a mix of licenses (MIT, BSD variants, MPL-2.0, Unicode-3.0, ISC, etc.).%cargo_license/%{cargo_license_summary}already generate aLICENSE.dependenciesreport, but nothing reconciles that report into the spec'sLicense:field.Impact / Why This Matters
Fedora's Licensing Guidelines require the
License:tag to be an SPDX expression covering every license present in the binary package, not just the top-level project's own license. An inaccurateLicense:tag is a hard blocker in Fedora package review, and any crate license not on Fedora's allowed-license list needs a separate Fedora Legal conversation before the package can be accepted.Proposed Design
Consume
%cargo_license's per-crate license output and reduce it to a deduplicated SPDX expression as part of the source-generation script, so the aggregated license expression is computed at the same time the vendor tarball is produced, rather than hand-maintained.Acceptance Criteria
License:tag (per subpackage as needed) is a correct SPDX expression representing the union of all shipped licensesCargo.lockchanges, so this doesn't silently go staleAlternatives Considered
License:tag — rejected as a long-term approach; it will drift out of sync silently as dependencies change across releases.License:as justApache-2.0— rejected outright; this is a licensing-accuracy problem independent of Fedora, not just a Fedora-review nicety.