Extend ABOUT files to support products

[pombredanne]

I would like to add a new "is_product" attribute so we can track a ABOUT file in SCIO and SCTK as being for a DejaCode product. With this we will be able to know that a scan in SCIO or SCTK is for a specific product and use this information when uploading to DejaCode

• [ ] Add support for ABOUT file "is_product" in AboutCode toolkit
• [ ] Add support for ABOUT file "is_product" in ScanCode toolkit
• [ ] Add support for ABOUT file "is_product" in ScanCode.io
• [ ] Add support for ABOUT file "is_product" in DejaCode

Here is how a minimal product ABOUT file could look like:

about_resource: .
is_product: yes
name: My Super Product
version: 1.0
description: Short description
homepage_url: https://internal/super-product/home.html

It could contain of course more details, like VCS repos references, author team pointers, etc. The ABOUT spec is at https://github.com/nexB/aboutcode-toolkit/blob/develop/docs/source/specification.rst

The name would map to a product name in DejaCode.

[chinyeungli]

@pombredanne just to verify the is_product attribute is a boolean value, correct? In addition, can you draft a formal description of what is_product is so that the spec can be updated?

[mjherzog]

There are certainly use cases where the is_product field would need to allow multiple values because you use code from a repo in multiple products.

[chinyeungli]

do we really want/need to support is_product field? By "support" mean the value need to be validated. If multiple values can be applied, it's hard to validate. perhaps we don't need to support it as users can always use the is_product in ABOUT files as custom field. Will this be enough?

[pombredanne]

@mjherzog @chinyeungli is_product is a boolean for a single ABOUT file. In the cases where multiple ABOUT files are needed for a product, that's multiple files, each with a is_product boolean not multiple values in that field.

[chinyeungli]

After some discussion, ABOUT file is a file to document the nature or facts of the file/package/component, such as SHA1, license, etc. On the other hand, is_product seems like "external" information. For instance, users can create custom fields such as is_SCIO, is_SCTK, etc., in ABOUT files. As a result, the is_product should be a custom field instead of a supported field.