Licensing of ROS Packages:
Changes to package.xml and new tool support
Christian Henkel, Ralph Lange (Bosch Research)
ROSCon 2023

License Documentation in ROS
Motivation

SBOM
Open-sourcecomponents

SoftwareBill OfMaterialVersionnumbers

Clear documentation of dependencies and licenses is essential for security and legal reasons
Christian Henkel, Ralph Lange | 2023-10-19© Robert Bosch GmbH 2023. All rights reserved, also regarding any disposal, exploitation, reproduction, editing, distribution, as well as in the event of applications for industrial property rights.

License Documentation in ROS
Example 1: OpenCV3 Packages in ROS 1

3

Christian Henkel, Ralph Lange | 2023-10-19© Robert Bosch GmbH 2023. All rights reserved, also regarding any disposal, exploitation, reproduction, editing, distribution, as well as in the event of applications for industrial property rights.

License Documentation in ROS
Example 2: orocos_kinematics_dynamics (used with tf2)

Inconsistent license specification
Discovered by scanner and fixed in 06/2021

4

Christian Henkel, Ralph Lange | 2023-10-19© Robert Bosch GmbH 2023. All rights reserved, also regarding any disposal, exploitation, reproduction, editing, distribution, as well as in the event of applications for industrial property rights.

License Documentation in ROS
Copyright files in Debian Packages
Format: Bloom subset of https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: rclcpp
Files: See file headers in repository for details
Copyright: See package copyright in source code for details
License: Apache License 2.0
See repository for full license text

/usr/share/doc/ros-iron-rclcpp/copyright

Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Source: ftp://ftp.example.com/pub/games
Upstream-Name: X Solitaire
Files:*
Copyright: 1998 John Doe <jdoe@example.com>
1998 Jane Smith <jsmith@example.net>
License: GPL-2+
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 2 of the License, or(at your option) any later version. […]debian.org/doc/packaging-manuals/copyright-format/1.0/

Current copyright files do not meet the Machine-readable debian/copyright file format
5Christian Henkel, Ralph Lange | 2023-10-19© Robert Bosch GmbH 2023. All rights reserved, also regarding any disposal, exploitation, reproduction, editing, distribution, as well as in the event of applications for industrial property rights.

License Documentation in ROS
REP-149 on license tag in package.xml

Lack of machine readability – packages with license mixes are not properly supported
6

Christian Henkel, Ralph Lange | 2023-10-19© Robert Bosch GmbH 2023. All rights reserved, also regarding any disposal, exploitation, reproduction, editing, distribution, as well as in the event of applications for industrial property rights.

License Documentation in ROSAgenda

 Additions to package.xml format (Ralph) ROS package license linting (Christian) Copyright file generation (Christian)7

Christian Henkel, Ralph Lange | 2023-10-19© Robert Bosch GmbH 2023. All rights reserved, also regarding any disposal, exploitation, reproduction, editing, distribution, as well as in the event of applications for industrial property rights.

Additions to package.xml format

License Documentation in ROS
What has been added?
package.xml

Machine-readable debian/copyright file format

Two new attributes according to ros-infrastructure/rep
PR347 (accepted by ROS 2 TSC)
<package format="2">
package.xml<name>fancy_package</name><version>1.2.3</version><maintainer email="...">John Doe</maintainer>...
<license file="LICENSE" type="spdx">
Apache-2.0</license><license source-files="3rd-party_math/*">BSD-3-Clause</license></package>...
Files:*
Copyright: 2022-2023 John Doe
License: Apache-2.0
Files:
3rd-party_math/*Copyright: 2020 Jane Smith
License: BSD-3-Clause

Minimal additions – not reinventing the wheel
9Christian Henkel, Ralph Lange | 2023-10-19© Robert Bosch GmbH 2023. All rights reserved, also regarding any disposal, exploitation, reproduction, editing, distribution, as well as in the event of applications for industrial property rights.

copyright

License Documentation in ROS
The source-files attribute Optional One default case allowed For mixed licenses in one package Glob format according to Machine-readable
debian/copyright file format...
<license file="LICENSE" type="spdx">
Apache-2.0</license><license source-files="3rd-party_math/*">BSD-3-Clause</license>...
10

Given a source file, lastmatching tag applies

Christian Henkel, Ralph Lange | 2023-10-19© Robert Bosch GmbH 2023. All rights reserved, also regarding any disposal, exploitation, reproduction, editing, distribution, as well as in the event of applications for industrial property rights.

License Documentation in ROS
The type attribute Optional Possible values− spdx− freeform (default)

 spdx is highly encouraged...
<license file="LICENSE" type="spdx">
Apache-2.0</license><license source-files="lib/*" type="freeform">
BSD</license>...
11

Christian Henkel, Ralph Lange | 2023-10-19© Robert Bosch GmbH 2023. All rights reserved, also regarding any disposal, exploitation, reproduction, editing, distribution, as well as in the event of applications for industrial property rights.

https://spdx.org/licenses/

ROS package license linting

License Documentation in ROS
ros_license_toolkit
Scan code forlicenses

package.xml

compareChecks Is any license defined in package.xml?
 Has at most one license tag without a source-files declaration?
 Do all license tags follow the SPDX standard? (warning) Are license texts available and correctly referenced for all declared licenses?
 Does the code contain licenses not declared in the license tags?
13Christian Henkel, Ralph Lange | 2023-10-19© Robert Bosch GmbH 2023. All rights reserved, also regarding any disposal, exploitation, reproduction, editing, distribution, as well as in the event of applications for industrial property rights.

github.com/boschresearch/ros_license_toolkit

License Documentation in ROS
ros_license_toolkit – Sample Output

14

Christian Henkel, Ralph Lange | 2023-10-19© Robert Bosch GmbH 2023. All rights reserved, also regarding any disposal, exploitation, reproduction, editing, distribution, as well as in the event of applications for industrial property rights.

github.com/boschresearch/ros_license_toolkit

License Documentation in ROS
ros_license_toolkit – Details

github.com/boschresearch/ros_license_toolkit

 Available open source Contributions are welcome
 Thanks to Felix Mauch (fmauch) for contributing agithub action− boschresearch/ros_license_toolkit PR 23

 Now on pypi:

15

Christian Henkel, Ralph Lange | 2023-10-19© Robert Bosch GmbH 2023. All rights reserved, also regarding any disposal, exploitation, reproduction, editing, distribution, as well as in the event of applications for industrial property rights.

Copyright file generation

License Documentation in ROS
Generation of Copyright Files
Currently experimental feature athttps://github.com/boschresearch/ros_license_toolkit/
tree/add/copyright_generation_demo
Uses information from package.xml
 copyright declarations in source files
 license texts

Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Source: tbd
Upstream-Name: rclcpp
Files:**
Copyright: 2014 Open Source Robotics Foundation, Inc.
2014-2020 Open Source Robotics Foundation, Inc.
2015 Open Source Robotics Foundation, Inc.
2015-2020 Open Source Robotics Foundation, Inc.
2016 Open Source Robotics Foundation, Inc.
2016-2017 Open Source Robotics Foundation, Inc.
2017 Open Source Robotics Foundation, Inc.
2018 Open Source Robotics Foundation, Inc.
2018, Bosch Software Innovations GmbH.
2019 Intel Corporation
2019 Nobleo Technology
2019 Open Source Robotics Foundation, Inc.
2019-2020 Open Source Robotics Foundation, Inc.
2020 Amazon.com, Inc. or its affiliates2020 Ericsson AB
2020 Open Source Robotics Foundation, Inc.
2020, Apex.AI Inc.
2021 Open Source Robotics Foundation, Inc.
2021, Apex.AI Inc.
2022 Open Source Robotics Foundation, Inc.
2023 Open Source Robotics Foundation, Inc.
2023 Sony Group Corporation
2023 iRobot Corporation
License: Apache-2.0… to generate a copyright file according to the
Machine-readable debian/copyright file format

Apache License
Version 2.0, January 2004
http://www.apache.org/licenses/
TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
1. Definitions.
"License" shall mean the terms and conditions for use, reproduction,

17

Christian Henkel, Ralph Lange | 2023-10-19© Robert Bosch GmbH 2023. All rights reserved, also regarding any disposal, exploitation, reproduction, editing, distribution, as well as in the event of applications for industrial property rights.

License Documentation in ROS
Help Wanted
 I am looking for co-maintainers!
 Contributions are very welcome− Integration in ament− … and in bloom

 Please test your package with thelicense linter and report the results if
you are not agreeing with them18Christian Henkel, Ralph Lange | 2023-10-19© Robert Bosch GmbH 2023. All rights reserved, also regarding any disposal, exploitation, reproduction, editing, distribution, as well as in the event of applications for industrial property rights.

Summary

Minimal additions to package.xml format• source-files and type attributes• Use SPDX license identifiers• github.com/ros-infrastructure/rep → PR 347
ros_license_toolkit• Binary: pypi.org/project/ros-license-toolkit/• Source: github.com/boschresearch/ros_license_toolkit
Generation of copyright files• … according to Machine-readable debian/copyright file format• Integration in Bloom in progress – help welcome!
• github.com/ros-infrastructure/bloom/pull/709

Christian Henkel
christian.henkel2@de.bosch.com | github.com/ct2034
Ralph Langeralph.lange@de.bosch.com | github.com/ralph-lange