potiuk commented on issue #1379: URL: https://github.com/apache/tooling-trusted-releases/issues/1379#issuecomment-4918963474
There is no **exact** example: https://www.apache.org/legal/src-headers.html#is-a-short-form-of-the-source-header-available explains that "for example" this form is ok - but it does not show SPDX as allowed. There is a discussion in legal - https://lists.apache.org/thread/j1tn63r2lf13v3d1tnnqff8fkcl4nx53 where it was proposed to also add SPDX as explicitly specified form - but there was no final confirmation from LEGAL that it is allowed. However RAT implement SPDX as allowed. And it's fine - if lightweight check is not going to have it, that's ok, but more and more projects are using it for AGENTS.md and similar - because it saves a lot of tokens. I had several discussions about it when preparing the agentic discovery for scannig our repos. The last one was today with Maven https://github.com/apache/maven-wrapper/pull/429#pullrequestreview-4654044152 The Maven PMC did not yet follow it - their AGENTS.md added and repos submitted today still have the full licence, but I think you need to grasp with reality that our PMCs are more and more aware about the token cost of full licence in all .md files parsed by Agents and they will fall back to shorter version of licence - where SPDX with URL to full licence seems to be a consensus of joining both - brevity and reference to full licence that has more than just SPDX. I workarounded it by just disabling lightweight check, but it's not obvious that this is a way to fix it, so I think pragmatically speaking you will lkikely have to deal with more similar cases when ATR will be adoopted, so I guess it's in best interest of ATR to solve it before more projects adopt it and have simlar questions - especially when it's not clear how to dismiss concerns https://github.com/apache/tooling-releases-client/issues/31 That's pretty much all information I have now - I do not need to have this one fixed (I workarounded it) - so it's really up to you what you want to do with it, having all the information. For me it's just something I observed as a friction that ATR currently has. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
