reuse cannot parse SPDX information when part of a template

[Luni-4]

Hello everyone and thanks for your fantastic project! :)

I'm trying to parse this file https://github.com/sifis-home/sifis-generate/blob/try/templates/meson/header but I get the following error https://github.com/sifis-home/sifis-generate/actions/runs/4114599472/jobs/7102178559#step:4:10

Thanks in advance for your help!

[nicorikken]

Well, the error makes sense in that {{ license.id }} is not a valid SPDX-identifier. What was your expectation?

We have an reuse ignore tag

reuse-tool/tests/test_util.py

Line 42 in d9c0d27

# REUSE-IgnoreStart

but that would probably leave residue in you template result, right?

[Luni-4]

but that would probably leave residue in you template result, right?

Exactly, that's the main issue. I would like to completely ignore the file using the reuse-tool. Is there an option to do that?

[nicorikken]

So far no, because our goal is standards compliance, not passing the linter. Other tools reading the codebase should at least be able to reach the same conclusion, so it should not be specific to reuse-tool. So I can think of some approaches to address this case:

• Be clever and try to detect templating syntax as SPDX header and ignore that ({{ }}, {% %}, ${ } or whatever), perhaps trigger a warning, and document in the standard.
• Add the ability to ignore files in the upcoming reuse.yaml Define syntax and format of REUSE.yaml reuse-docs#81
• Simply ignore SPDX tags in files if they are part of the glob in the DEP5-file or reuse.yaml

We have to discuss the options and work in a way forward.

A workaround for now is to also template part of the SPDX tag, so there is no full match. Like SPDX-{{ "License" }}-Identifier: {{ license.id }} We used to do similar workarounds in our test before having the reuse-ignore keywords.

We could state that this template workaround is our recommendations but I don't think that is user-friendly.

[carmenbianca]

The correct workaround here is probably to create[filename].license, and put the licensing information in there.

[Luni-4]

For my personal project I created a .reuse/dep5 file as workaround and it works. @carmenbianca solution would be more cumbersome to implement in my case. Though I was thinking that ignoring some files would leave them in an ambiguous state because they wouldn't have a license. Perhaps a possible solution could be that if there is a .reuse/dep5 file in the project, notify the user about the incorrect SPDX license with a warning, otherwise the tool must raise an error and abort

[nicorikken]

@Luni-4 the recommendations by Carmen is to provide a license, just not in the file itself. So it is not a matter of ignoring. The filename.license method is the most specific one. If that would also leave residue in the rendered template, please consider providing a license using the dep5 file.

I think this method is better than adding an additional ignore syntax because it ensures the repo is actually properly licened.

Does that work for you?

[Luni-4]

Yes, it works for me, thank you for the help @carmenbianca and @nicorikken!