Re: spdx2debian

[Matthias Urlichs]

Hello Christian,

I'm afraid you misunderstood what I wrote.

The DFSG team can use an automated SPDX checker, if everything in a
package is SPDX'd, or they can use an LLM

An LLM would be not only waste of resources but also not a reliable "checker". SPDX is well defined.

I know that.

My point was that EITHER the package is SPDX-compliant and -complete [thus no LLM is necessary] OR ( the checking process uses an LLM, AND/OR whoever checks for compliance does the work (semi)manually ).

, or they can do the checking manually

This would be against the intention of SPDX,

see above

Let's be honest here. Checking a package manually for whether every
file has a non-SPDX copyright is brain-numbing busywork.

There is no need to to this checking manually. "reuse" will do this for you and provide a detailed output which files have missing or malformed SPDX data.

To clarify: s/every file/& without a SPDX mark/

Despite all the critics about LLM, it is defiantly not the right tool for such a job.

s/defiantly/definitely/.If you don't, IMHO you have no base whatsoever for complaining about LLM use.

SPDX and LLM are topics that do not belong together.

… which was part of my point.

--
-- mit freundlichen Grüßen
--
-- Matthias Urlichs

OpenPGP_signature.asc
Description: OpenPGP digital signature