[ANN] ReusePkgTemplates.jl and ReuseLicensing.jl: REUSE-compliant packages with explicit package-level licensing

Package Announcements
, ,
1

Prelude

A typical conversation in conventional Julia package land …

A: Have a look at my new package.

B: Nice. What’s the license?

A: MIT. Easy to use, easy to reuse.

B: MIT for what?

A: The package.

B: All of it? The code, the documentation, the documentation assets, the data …?

A: Yes.

B: That is a lot to cover for just three letters.

… meanwhile in well-intentioned compliance-tooling land

R: Look at my new package. I got you covered for reusing everything now. Every file in my repo carries a license and copyright tag. Have at it!

S: Wow, that’s impressive! I see a list of license expressions here: MIT, CC0-1.0, CC-BY-4.0, MPL-2.0 OR EUPL-1.2, GPL-3.0-only, LicenseRef-Something … So, what’s the package-level license?

R: The list is right there.

S: Sure. But the recipe is not the cake, is it?

Sound familiar?

We kind of “overload” a single LICENSE file in conventional Julia package land, while the file-level licensing done in a REUSE-compliant repository may leave the package licensing implicit or ambiguous.

ReuseLicensing.jl and ReusePkgTemplates.jl address that gap: they combine file-level copyright and licensing metadata in accordance with the REUSE framework, an explicit package-level license declaration in LICENSE, and additional machine-readable package licensing metadata in Project.toml.

Easily generate REUSE-compliant packages

ReusePkgTemplates.jl provides a small convenience layer on top of PkgTemplates.jl for generating Julia packages with REUSE/SPDX licensing metadata. Generated packages include file-level copyright and licensing metadata, together with a package-level license declaration in the root LICENSE file.

For example:

julia> using ReusePkgTemplates

julia> plugins = with_reuse(
    [   
        # your favorite PkgTemplates-plugins go here
        Git(; manifest = true, ssh = true),
        GitHubActions(; x86 = true),
        Codecov()
    ];
    package_license = "EUPL-1.2+",
    docs_license = "CC-BY-4.0",
    infrastructure_license = "0BSD",
    readme_licensing_section = true
)

julia> t = Template(; plugins)

julia> t("MyPackage")

This may be all that is needed to set up a package that’s REUSE-compliant from the first commit with:

  • a LICENSE file that contains
    • the package-level copyright notice,
    • a package license expression,
    • explanatory text,
    • the license text (or texts) referenced by the license expression,
  • file-level license texts in LICENSES/,
  • REUSE annotations in REUSE.toml to bulk-assign licenses and copyright,
  • Project.toml licensing metadata,
  • a README licensing section,
  • a REUSE lint workflow when GitHubActions() is used.

See the documentation for more information.

Change package license expressions or package copyright notices coherently

ReuseLicensing.jl provides the core licensing machinery used by ReusePkgTemplates.jl. It parses SPDX license expressions, works with checked-in SPDX License List data, consumes reuse lint output, and validates package-level licensing metadata for Julia packages.

It can also update package-level license expressions or copyright notices coherently, so that LICENSE and Project.toml metadata stay aligned.

To check SPDX license expressions, you could for example do:

julia> using ReuseLicensing

julia> parsed = parse_spdx_expression("MIT OR Apache-2.0");

julia> has_approved_license_path(parsed, OSIApproved())
true

julia> has_approved_license_path("MIT AND LicenseRef-Internal", ValidSPDX())
true

See the documentation for more information.

Comments, criticism, and issue reports are warmly appreciated.

A personal remark on licensing policy

Nothing requires you to use a copyleft license like the European Union Public Licence (EUPL-1.2): in the example above, package_license = "MIT" works just as well, if that’s what you want for your package. (The 0BSD license used in the example is even more permissive than MIT.)

At the same time, permissive licensing should not be mistaken for being automatically “in everybody’s best interest.” For publicly funded software or for infrastructure software, copyleft licensing can be a rational policy choice: it helps preserve the public value of a work and it avoids turning public investment into a subsidy for incumbent market players. The gains from permissive licensing are not necessarily evenly distributed.

See the essay by Lawrence Lessig (2002) on “Open Source Baselines: Compared to What?”