Hello Matthias,
as upstream maintainer of "spdx2debian" and SPDX/REUSE advocate please
allow me to add some details.
Am 03.11.2026 09:18 schrieb Matthias Urlichs:
The DFSG team can use an automated SPDX checker, if everything in a
package is SPDX'd, or they can use an LLM
An LLM would be not only waste of resources but also not a reliable
"checker". SPDX is well defined. A linter/parser/checker (don't have the
correct term for that) like "reuse" does the job for you. "spdx2debian"
does use "reuse" in the back.
, or they can do the checking manually
This would be against the intention of SPDX, which is providing machine
readable license and copyright data. If a project is 100% compliant, and
"reuse" will tell you that, you can trust that data (provided by
upstream).
What the team cannot do is require that every maintainer
whose package lacks SPDX identifiers (in some/most/all/? files) sends
a patch that adds them to Upstream.
You mean a DD/DM sends a patch to upstream? Of course not. But Debian
has a weight in the world. If a DD/DM kindly ask an upstream project
about SPDX, provide some links to docu (and if you want to me as an
"SPDX mentor"), upstream might adapt to SPDX and spare the DD/DM a lot
of silly work.
Let's be honest here. Checking a package manually for whether every
file has a non-SPDX copyright is brain-numbing busywork.
There is no need to to this checking manually. "reuse" will do this for
you and provide a detailed output which files have missing or malformed
SPDX data.
You want the
DFSG people to not use an LLM for that?
Despite all the critics about LLM, it is defiantly not the right tool
for such a job. An LLM is not even able to count words in a text or
provide PEP8 Python code. An LLM is not for parsing/linting.
add SPDX markers to your package's files and file an
upstream patch.
Just encourage upstream to do this. Anyway. Not every package will
provide SPDX data. But some does and the number might increase. This
would free some DD/DM resources for more important work.
If you don't, IMHO you have no base whatsoever for complaining about
LLM use.
SPDX and LLM are topics that do not belong together.
Best,
Christian
https://buhtz.codeberg.page/
