# How to get a license report of SailfishOS components?

The developer documentation of SailfishOS is referencing the Git repository of the Mer Project with a bunch of sub projects. Does someone know a way to get a report of the used licenses? Maybe this report is already regularly published on a build server? I think, that also Jolla needs this information for leagal compliance reasons.

When we build the software in our company, we did include a automized report about the licenses of the referenced open source libraries. There are several options to do that, for example specific Maven scripts.

In other public Git repository I can find the license or at least the license reference at the top level of a project, usually in an explicit file, sometimes in the readme file. But I can't find the licenses in the Mer Project. I only have the high level information, that the Mer Project contains libraries under LGPL, GPL, BSD and Apache. Lipstick for example is under LGPL license. It's mentioned in the readme file. I haven't found a specific SFOS license, yet.

edit retag close delete

Sort by » oldest newest most voted

Edit: Attached the output that the command I mentioned below gives on my Sony Xperia with SailfishOS (official). I removed all packages that I had installed from harbour. The column "Distribution" might give you some insight concerning your other question about the relation between Mer project (including nemo) and SailfishOS:

sailfishX.csv.txt

(I'm sorry I had to add ".txt" to the filename; I couldn't have uploaded it here otherwise.)

There is no specific SailfishOS license. Any distribution consists of software from different projects with different licenses.

I'm not aware of a public list of SFOS components including their licenses. I checked it once on my terminal using this

rpm -qa --queryformat \
'%{name};%{distribution};%{license}\n' \
>> packages.csv

I used the 'distribution'-column to filter out 3rd party software that I had installed from other sources like harbour or openrepos. That was 2015 but it should still work. ;)

more

Sounds good. It seems to be exactly the command I’m looking for.

Are you executing the command on a Sailfish device or do check you each project in the repository an execute the command on the root level of the projects’ directory?

It could be time consuming to check out each project separately. Is it possible to check them out at once? But I think you are using a packages CSV file. Where does the file comes from?

Indeed, most complex software contains many libraries with many different licenses. It’s a challenge in b2b markets, because you need transparency for compliance reasons.

( 2017-11-25 12:29:36 +0200 )edit

You'd have to execute this command directly on your Sailfish device. Your question makes me assume you don't own one. That's why I attached the output from my device to the original answer. Please note that with most consumer oriented operating systems (including SailfishOS), it's not quite easy to draw the line between the operating system itself and the user application level. (Like: Is the browser part of the OS? Is the Media Player app part of the OS? On a desktop system, you'd probably answer no. Most users, though, consider the stock applications by Jolla part of SailfishOS). On a Sailfish device, that's particularly hard as some components are 100% optional. You'll find Myriads Alien dalvik in my list ("feature-alien" AFAIK) as well as xt9 text prediction ("feature-xt9" probably), both of which aren't really an essential part of the OS and might not be installed everywhere. On the other hand, there's no Exchange support because I have no use for that.

The reason why I'm going into this is because if you're interested in "the licenses used by packages on a Sailfish device", you need to define for yourself what you mean by "Sailfish". Is it the bare minimum that someone can live with if he, say, wants to use as little proprietary components as possible? Is it the typical Sailfish installation out there in the wild which will certainly include Notes, Calculator, Weather and so on, most probably include XT9 and Alien Dalvik, maybe even Exchange?

( 2017-11-25 14:11:07 +0200 )edit

Great. That’s was, what I’m looking for. I’m using an Intex Aqua Fish and I love this phone and user experience. So I could connect via ssh and execute the command on the root directory, I think.

I’m trying to figure out, how many components rely on Jolla’s (or others) intellectual property. This is important for the valuation of Jolla’s service and license offering as well for the partner contract negotiation. Further more it’s important for the estimation of legal risks for any business model or enterprise use cases of SailfishOS.

Your information will help me to find an answer for my questions. I would like figure out, wether SailfishOS is mainly a distribution of a mobile open source linux like (open) CentOS and (commercial) Red Hat Enterprise Linux or significantly more. Both are based on open source. I was also wondering, whether SailfishOS relates to the Mer Project like the FOSS Android and the Android with Google Services and Apps. It seems to me something in between.

( 2017-11-25 17:52:04 +0200 )edit