Re: Automated copyright reviews using REUSE/SPDX as alternative to DEP-5
~ Stephan Lachnit [2022-01-26 15:20 +0100]:
>> But already now, a DEP-5 file could be provided to REUSE. One would have
>> to check whether the ones Debian provides would work in the default
>> location for DEP-5 files in REUSE (`.reuse/dep5`). If not, I suspect
>> there would be no large changes needed.
>
> Probably too technical at this stage, but a conversion tool in
> combination with the yaml format could actually be quite useful.
> E.g. one could have a debian/REUSE.yaml sub-file for the copyright
> information of the package build files and a debian/REUSE-source.yaml
> file in case the source does not follow the REUSE spec. If the
> reuse-tool would have an option to specify a different file for the
> root REUSE.yaml, we could actually use it for all packages with
> relatively low migration work on the maintainer side.
Perhaps it's really too early, but hey. The current idea for REUSE.yaml
is that, other than the DEP-5 implementation, you can have multiple of
these files in your project. Each file can describe files relative to
it, but not in parent directories.
Consider you have a sub-directory with binary files you'd like to mark,
e.g. icons you also re-use in other projects. You could create a
REUSE.yaml file in the same directory describing them. Whenever you
copy the directory in another project, the licensing/copyright info is
retained.
This is the reason why it should not describe parent directories.
Therefore, such a file in /debian could only cover files in this
directory. But I understand that in this special scenario it would be
useful. I could think of ways how either Debian or REUSE introduce some
hacks around it, but before we elaborate on this I think there are other
more fundamental decisions Debian would have to make first ;)
Best,
Max
--
Max Mehl - Programme Manager - Free Software Foundation Europe
Contact and information: https://fsfe.org/about/mehl | @mxmehl
Become a supporter of software freedom: https://fsfe.org/join
Reply to: