EPIC: As Project Solda PM I want a tool that use Debian packages as source of truth for licensing.

[LucaMiotto]

Alienmatcher is a tool that tries to find matching packages on Debian and takes license/copyright information from there. OSTC provides us then input to that tool, so we do not need to dig into Yocto file structures. The output is for each source file a license in SPDX format, or a hint that the license could not be derived automatically.

Develop the tool https://git.ostc-eu.org/oss-compliance/toolchain/solda-alienmatcher as a reference implementation

TODOS (all these to dos are about the first MVP / PoC implementation)

• [x] On Yocto's side <-- Array
  • [x] bb.tinfoil <-- Array
  • [x] tinfoil_hat (parse and generate BoM) <-- Array
  • [x] alienpkg_creator <-- Array
• [x] On alienmatcher's side <-- NOI/Array
  • [x] matcher <-- NOI
  • [x] compare: <-- NOI/Array
  • [x] scancode_launcher <-- NOI
  • [x] deltacode <-- Array
  • [x] alien2spdx <-- NOI
  • [x] debian2spdx <-- Array
  • [x] apply debian spdx and deltacode results <-- Array
  • [x] Add scancode results, for non-debian-matching files <-- Array
• [x] alienspdx2fossy
  • [x] uploader to fossology (package, spdx) <-- Array
  • [x] downloader of fossology results <-- Array
• [x] stats: (full license and copyright match | partial match, needs review | no match) <-- NOI
• [x] General utils / to-dos <-- NOI/Array
  • [x] separate modules <-- NOI
  • [x] CLI <-- NOI/Array
  • [x] Machine readable logs/stats <-- NOI/Array
  • [x] Create a single repository with all tools <-- NOI
  • [x] Dashboard to show results to the Audit Team and other stakeholders <-- NOI with ext. contributors / RMB (Deadline April 6th)
  • [x] Provide a first prototype as showcase asap (http://solda.rmb-consulting.tech/) <-- RMB

[Piiit]

Example data for the dashboard drag/drop --> 2021-03-30 manual.meta - martin.json.tar.gz

Unpack it before using