3 ms·
Some of the steps look like they'd be hard to do that for. Like for example the one about making sure the license is correct, and the one about testing parts th
by tbrownaw 7y ago
Some of the steps look like they'd be hard to do that for. Like for example the one about making sure the license is correct, and the one about testing parts that apparently don't have good automated tests / interact with the real world.
- enriquto 7y ago> Some of the steps look like they'd be hard to do that for. Then those steps must be removed. I thought the mantra "deploy is ONE step" was a more or less universally acknowledged truth.
- antoinevg 7y agoIt looks like you're new here. Please repeat after me: In software engineering there are no more or less universally acknowledged truths.
- yjftsjthsd-h 7y agoUnfortunately, not everyone acknowledges this truth;)
- antoinevg 7y ago…or has a sense of humour about it! ;-)
- creatornator 7y agoI mean unless a computer can check that all dependencies have compatible licenses, that is unrealistic. It's a necessary step for publicly released software to avoid legal issues
- cyphar 7y agoLinux distributions (though I can only speak to openSUSE's process) have automated scripts (which I believe are written by our lawyers) which check whether the license of a package matches the license of the files inside the package. It's how most package legal review gets done (and if the script can't figure it out, it gets escalated to our actual lawyers too review. You cannot submit a package to any one of the distributions we ship without the legal review being approved. So it is clearly possible to do -- and there are all sorts of tools which figure out what SPDX license entries apply for every dependency (or vendored dependency) of a given project.
- udkyo 7y agoI took the parent posts to mean that step involved checking the project license, not its dependencies. For the latter though, Fossology, Scancode etc. can help.