Licensing guidelines

[MarkoSagadin]

Context

Currently we lack some resources on the topic of software licenses.

Such resources could help developers to avoid some easy mistakes and provide enough knowledge to recognize problematic licensing situations and seek help.

Further more, some general company-wide guidelines would be beneficial.

Possible steps/topics to tackle

• Research existing best practices related to the software licenses.
• What are some common software licenses?
• How to include the licensing information in our own projects? Can this be done once on the project basis or it needs to be included in every file?
• Which software licenses are cleared to be used in public/private projects?
• What should be avoided/done so that we don't violate copyright law?
• Simple (as reasonably possible)) how-to guide of handling licenses in our own code.

Definition of Done

Section in guidelines is written and reviewed.

[TjazVracko]

We should probably mandate SPDX headers in all of our files, then we can use tools to generate SBOM and check for all licenses from there -> which can include CI checks for "forbidden licenses"

For looking up what a specific license allows you to do, use something like https://www.tldrlegal.com/

[vid553]

These guidelines should include information how to handle licenses from 3rd party libraries, drivers, etc. when bringing them into the project. It should provide some examples as well.

Here is another page listing all open source licenses: https://opensource.org/licenses

[SloMusti]

We should use the same Apache 2 license as Zephyr for thins we write. The rest we need to obey the licenses we get. All parts should be SPDX compatible

[TjazVracko]

@SloMusti But the things we write are mostly proprietary, no? Why would we use Apache?