Set processed declared licenses to NONE instead of empty

[sschuberth]

We should think about whether it ever makes sense to set a declared license to NONE or NOASSERTION instead of just returning nothing / and empty set, because

• NONE seems to be semantically equivalent to "empty",
• for NOASSERTION the first case ("no attempt was made to determine the information") is never true because we always tried, and the second case ("intentionally no information is provided") we probably do not really care about, as we're only interested in whether it's empty, but not why.

@fviernau, @tsteenbe, any thoughts on that?

[tsteenbe]

I would simply set it to NONE

NONE, if the SPDX file creator concludes there is no license available for this package; or

NOASSERTION if:
(i) the SPDX file creator has attempted to but cannot reach a reasonable objective determination;
(ii) the SPDX file creator has made no attempt to determine this field; or
(iii) the SPDX file creator has intentionally provided no information (no meaning should be implied by doing so).

[dgutson]

Hi, I got this NOASSERTION from Conan manifests.

1. Is this NOASSERTION defined in the SPDX standard, or it is an ORT-specific thing?
2. What is the current (not discussed intended) behavior when this is set, at least in C and C++ Conan-based projects?

[sschuberth]

Is this NOASSERTION defined in the SPDX standard, or it is an ORT-specific thing?

The former, see e.g. https://spdx.github.io/spdx-spec/v2.3/file-information/#85-concluded-license-field.

What is the current (not discussed intended) behavior when this is set, at least in C and C++ Conan-based projects?

There is no special meaning in the context of C / C++ or Conan projects, but only the general meaning as defined for packages described via SPDX, see https://spdx.github.io/spdx-spec/v2.3/package-information/#715-declared-license-field.

Note that this issue is not about SPDX's use of NOASSERTION / NONE (which is fixed and defined), but about the use of NOASSERTION / NONE in ORT's own data model.

[sschuberth]

Closed as part of backlog grooming. Feel free to comment if you would like to contribute to this.