On Tue, 03 Nov 2026 at 18:33:22 +0100, Enrico Zini wrote:
[REUSE] automatically maintains the information in a standard and machine
readable way, solving a burdensome hassle elegantly, and having tried it
and adopted it myself, it's definitely something I think it's worth
advertising to other upstreams.
This is certainly great for new projects where you can enforce fully
consistent copyright/licensing tagging from the beginning, and I
recommend it for that use-case (and use it in my own new upstream
projects).
However, Debian does also need to be able to ship projects with a 20+
year history. Things that are now considered best-practice were not
always something that anyone thought about at all, so the larger the
project and the longer its history is, the more likely it is to contain
files for which nobody knows for sure who the copyright holders are, the
original authors are no longer involved or reachable and might not even
be alive any more, and the only thing that is known about the license is
"there's no evidence that it isn't under the license of the overall
project". (For example, the READMEs, changelogs and build systems of
many projects don't explicitly declare a license or a copyright holder,
and in practice we usually assume that they're under the project's
license unless there's evidence that they aren't.)
Obviously this is not ideal, but in many cases it's what we have, so it
isn't practical to demand that large projects with a long history can
declare licenses and copyright holders for every file at a per-file
granularity. The best information we are going to get without a time
machine consists of informed guesses, and I don't think it's necessarily
appropriate to be encouraging upstreams to commit those informed guesses
to their VCS in a way that makes them appear just as authoritative as
the explicit copyright/license markers of more-recently-added files.
(I think we should certainly not be *demanding* that upstreams do that.)
smcv
