fsfe / reuse-tool

reuse is a tool for compliance with the REUSE recommendations.
https://reuse.software
382 stars 146 forks source link

Should "reuse spdx" show the "packageVersion" if specified in the header? #935

Closed buhtz closed 5 months ago

buhtz commented 5 months ago

If a markdown file do specify the packageVersion field in its header should the command reuse spdx report about that?

I tried it but the output of reuse spdx don't show the package version for that specific file.

I am asking to be sure if reuse is the correct tool to validate that field and if I make something wrong.

Here is the header of the markdown file where copyright and license is correct reported by reuse spdx.

<!---
# SPDX-FileCopyrightText: © 2023 Christian BUHTZ <c.buhtz@posteo.jp>
# PackageVersion: 1.2.3
# SPDX-PackageVersion: 1.2.3
# SPDX-License-Identifier: GPL-3.0-only
#
# This file is part of the program "Hyperorg" which is released under GNU
# General Public License v3 (GPLv3).
# See folder LICENSES or go to <https://www.gnu.org/licenses/#GPL>.
-->
carmenbianca commented 5 months ago

I don't think REUSE is the correct tool for this. The scope of REUSE is fairly narrow:

Everything else is effectively out of scope, kind of, more or less. reuse spdx is a rudimentary tool that conveys all information found by REUSE in a standard format (SPDX). It's due a little update to support some non-tag-value output formats. But ultimately, if you want an SPDX BOM that contains more than just the copyright and licensing information, REUSE is not the tool with which to produce it.

There exist other tools that generate SPDX files that are probably more fit for purpose. This page documents some of the comparisons.