-
-
Notifications
You must be signed in to change notification settings - Fork 167
Description
Hi! 👋
I'm a long-term user of reuse
in many of my projects and I really like it! 🥳
With our recent switch to reuse for our package sources on Arch Linux, I ran into an edge case around deprecated license identifiers though, which is blocking our use of the tool in certain scenarios.
The backstory/example is:
I'm maintaining the libnitrokey package for Arch Linux.
The upstream to this day still uses the deprecated LGPL-3.0
license expression (Nitrokey/libnitrokey#189).
As we gather patches for the sources, we sometimes also apply close to the deprecated SPDX license identifiers they use in their files (see https://gitlab.archlinux.org/archlinux/packaging/packages/libnitrokey/-/blob/3abf396304313ea47e36f5b87262747aa8b2bd60/libnitrokey-3.8-catch2_3.patch#L49).
This makes reuse detect the patch file as LGPL-3.0
, even if I would set it specifically to LGPL-3.0-only
in our central REUSE.toml for the package sources.
Subsequently, reuse lint
fails if it detects the deprecated identifier, and we can currently not prevent that:
# DEPRECATED LICENSES
The following licenses are deprecated by SPDX:
* LGPL-3.0
As distribution, we have no power over how upstreams annotate their source code and therefore also not over what ends up in the diffs around our changes in patch files we create or get from upstream.
Therefore, it would be great if reuse lint
did not fail on deprecated licenses identifiers, e.g. by providing a flag such as --allow-deprecated
.