RFC: REUSE compliance plugin for PkgTemplates.jl — API, docs, and root LICENSE behavior

Tooling Package Management
, ,
10

So something like:

SPDX-License-Identifier: MIT OR LicenseRef-Gov-Public-Domain

is what you are saying? (here we cannot use my simple check)

That seems mechanically checkable once the SPDX expression has been parsed into a normalized expression.

For a first conservative RegistryCI rule, one could evaluate each file’s effective SPDX expression as a Boolean expression:

  • standard SPDX license with isOsiApproved == true → true;
  • non-OSI license or LicenseRef-* → false;
  • OR → Boolean OR;
  • AND → Boolean AND;
  • WITH exceptions could initially be treated as false, or later handled by a separate allow-list / known-SPDX-exception policy.

Then MIT OR LicenseRef-X evaluates to true, while MIT AND LicenseRef-X evaluates to false.

So the rule would not have to be “all mentioned licenses must be OSI-approved”. It could instead be: every distributed file must have at least one complete OSI-approved licensing path.

(The plugin tooling returns SPDX AST for SPDX license expressions…).