Ignore missing/bad licenses from testdata files

fsfe / reuse-tool

reuse is a tool for compliance with the REUSE recommendations.

https://reuse.software

380 stars 144 forks source link

Ignore missing/bad licenses from testdata files #556

Open rohitpandey49 opened 2 years ago

rohitpandey49 commented 2 years ago

During the implementation of the REUSE.software standard, I added the licensing and copyright information to testdata files through dep5. However, reuse tool still shows missing/bad licensing information from testdata files. Is there any method to ignore or any plan in the future?

carmenbianca commented 2 years ago

We should probably improve documentation on ignoring files.

In as few words as possible: ignoring files is generally undesirable, except when it isn't. It's undesirable because REUSE requires full coverage for compliance. It becomes a problem in situations like the one you've described.

There are two solutions on the top of my head:

Put a .license file next to your testdata files. The contents of the testdata files will be ignored, and the contents of the .license file will be used instead.
Put REUSE-IgnoreStart and REUSE-IgnoreEnd in your testdata files. Documentation: https://reuse.readthedocs.io/en/stable/usage.html#ignoring-parts-of-a-file

There may be more solutions, or more solutions in the future, but I have a meeting in one minute :sweat_smile:

mxmehl commented 2 years ago

Please also see this FAQ item: https://reuse.software/faq/#exclude-file

@rohitpandey49 does that answer your question?

ghost91- commented 2 years ago

I'm a bit confused: The author mentions that they added license information for the testdata files via a dep5 file. If that is indeed the case, reuse should not complain at all. So my guess is that there is something wrong with the definitions in the dep5 file, and ignoring files is not actually needed (or desired) in this particular case.

mxmehl commented 2 years ago

The two complaints I can see are:

Bad licenses: license identifiers that are not valid, e.g. deprecated or not valid SPDX. These should either be fixed or made custom licenses (see FAQ)
Missing license texts: for the files there are License-Identifiers found (either in file, .license or dep5) but the actual license is not found in the LICENSES directory.

Regarding 2, I think the author wanted to fully ignore these. If they would also be copyright holder for the testdata files, they could just slap a license of their wish on them.