|
| 1 | +# REUSE.software |
| 2 | + |
| 3 | +This document is based on reuse.software, a project launched by FSFE, and redistributed under CC-0 with their kind permission. |
| 4 | + |
| 5 | +--- |
| 6 | +# SPDX-FileCopyrightText: 2019 Free Software Foundation Europe e.V. |
| 7 | +# SPDX-License-Identifier: CC0-1.0 |
| 8 | + |
| 9 | +title: "REUSE Specification – Version 3.0" |
| 10 | +--- |
| 11 | + |
| 12 | +This specification defines a standardized method for declaring copyright and |
| 13 | +licensing for software projects. The goal of the specification is to have |
| 14 | +unambiguous, human- and machine-readable copyright and licensing information for |
| 15 | +each individual file in a project. Ideally this information is embedded into |
| 16 | +every file, so that the information is preserved when the file is copied and |
| 17 | +reused by third parties. |
| 18 | + |
| 19 | +This specification implements [IETF RFC 2119: Key words for use in RFCs to |
| 20 | +Indicate Requirement Levels](https://tools.ietf.org/html/rfc2119). |
| 21 | + |
| 22 | +For the revision history of this specification, please see [the change |
| 23 | +log](https://git.fsfe.org/reuse/docs/src/branch/stable/CHANGELOG.md). |
| 24 | + |
| 25 | +## Definitions |
| 26 | + |
| 27 | +These are the definitions for some of the terms used in this specification: |
| 28 | + |
| 29 | +- REUSE Tool --- helper tool for compliance with this Specification; available |
| 30 | + at <https://github.com/fsfe/reuse-tool>. |
| 31 | + |
| 32 | +- Project --- any unit of content that can be associated with a distribution of |
| 33 | + software. Typically, a Project is composed of one or more files. Also |
| 34 | + sometimes called a package. |
| 35 | + |
| 36 | +- License File --- a file containing the text of a license. |
| 37 | + |
| 38 | +- Copyright and Licensing Information --- the information that lists the |
| 39 | + copyright holders of a file or work, and describes under which licenses the |
| 40 | + file or work is made available. |
| 41 | + |
| 42 | +- Covered File --- any file in a Project, except for |
| 43 | + - The License Files. |
| 44 | + - The files belonging to the Project's version control system (example: |
| 45 | + `.git/`). |
| 46 | + - The files ignored by the version control system (example: files listed in |
| 47 | + `.gitignore`). |
| 48 | + - The files in the `.reuse/` directory in the root of the Project. This |
| 49 | + directory MUST contain only files relevant for the operation of the REUSE |
| 50 | + Tool. |
| 51 | + - Symlinks and files with no data (zero-byte). |
| 52 | + - SPDX documents in their various formats as defined in the [SPDX |
| 53 | + Specification, Clause |
| 54 | + 4.4](https://spdx.github.io/spdx-spec/v2.3/conformance/#44-standard-data-format-requirements) |
| 55 | + (example: `sbom.spdx.json`). |
| 56 | + |
| 57 | +- Commentable File --- a plain text file that can contain comments. |
| 58 | + |
| 59 | +- Uncommentable File --- either a plain text file that cannot contain comments |
| 60 | + or a file that is not a plain text file. |
| 61 | + |
| 62 | +- SPDX Specification --- SPDX specification, version 2.3; as available on |
| 63 | + <https://spdx.org/specifications>. |
| 64 | + |
| 65 | +- SPDX License Identifier --- SPDX short-form identifier, as defined in SPDX |
| 66 | + Specification. See also <https://spdx.org/ids> for a short introduction and |
| 67 | + examples. |
| 68 | + |
| 69 | +- SPDX License Expression --- as defined in SPDX Specification, Annex D, at <https://spdx.github.io/spdx-spec/v2.3/SPDX-license-expressions/>. |
| 70 | + |
| 71 | +- SPDX License List --- a list of commonly found licenses and exceptions; as |
| 72 | + available on <https://spdx.org/licenses/>. |
| 73 | + |
| 74 | +- DEP5 --- [Machine-readable `debian/copyright` file, Version |
| 75 | + 1.0](https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/). |
| 76 | + Where the REUSE Specification and DEP5 state different things, the REUSE |
| 77 | + Specification takes precedence. Specifically in the case of the `Copyright` |
| 78 | + and `License` tags. |
| 79 | + |
| 80 | +## License Files |
| 81 | + |
| 82 | +A Project MUST include a License File for every license under which Covered |
| 83 | +Files are licensed. |
| 84 | + |
| 85 | +Each License File MUST be placed in the `LICENSES/` directory in the root of |
| 86 | +the Project. The name of the License File MUST be the SPDX License Identifier of the |
| 87 | +license followed by an appropriate file extension (example: |
| 88 | +`LICENSES/GPL-3.0-or-later.txt`). The License File MUST be in plain text format. |
| 89 | + |
| 90 | +If a license does not exist in the SPDX License List, its SPDX License Identifier |
| 91 | +MUST be `LicenseRef-[idstring]` as defined by the SPDX Specification, Clause 10 available at <https://spdx.github.io/spdx-spec/v2.3/other-licensing-information-detected/>. |
| 92 | + |
| 93 | +A Project MUST NOT include License Files for licenses under which none of the |
| 94 | +files in the Project are licensed. |
| 95 | + |
| 96 | +Everything that applies to licenses in this section also applies to license |
| 97 | +exceptions, with the exception that it is NOT possible to have a license |
| 98 | +exception that does not exist in the SPDX License List. |
| 99 | + |
| 100 | +For avoidance of doubt, in practice this means that for every license and exception |
| 101 | +that is part of any SPDX License Expression in any Copyright and Licensing Information |
| 102 | +associated with any Covered File, there MUST exist a License File as defined in this section. |
| 103 | + |
| 104 | +## Copyright and Licensing Information |
| 105 | + |
| 106 | +Each Covered File MUST have Copyright and Licensing Information associated with |
| 107 | +it. There are two ways to associate Copyright and Licensing Information with a |
| 108 | +file. In addition, there is a way to associate Copyright and Licensing |
| 109 | +Information with a snippet. |
| 110 | + |
| 111 | +### Comment headers |
| 112 | + |
| 113 | +To implement this method, each Commentable File SHOULD |
| 114 | +contain comments at the top of the file (comment header) that declare that |
| 115 | +file's Copyright and Licensing Information. |
| 116 | + |
| 117 | +For Uncommentable Files, the comment header that declares the file's Copyright |
| 118 | +and Licensing Information SHOULD be in an adjacent file of the same name with |
| 119 | +the additional extension `.license` (example: `cat.jpg.license` if the original |
| 120 | +file is `cat.jpg`). |
| 121 | + |
| 122 | +`.license` files MAY be used with Commentable Files, but it is still RECOMMENDED |
| 123 | +that comment headers be put inside Commentable Files. |
| 124 | + |
| 125 | +The comment header MUST contain one or more `SPDX-FileCopyrightText` tags, and one or |
| 126 | +more `SPDX-License-Identifier` tags. A tag is followed by a colon, followed by |
| 127 | +a text value, and terminated by a newline. |
| 128 | + |
| 129 | +The `SPDX-FileCopyrightText` tag MUST be followed by a copyright notice. |
| 130 | + |
| 131 | +Instead of the `SPDX-FileCopyrightText` tag, the symbol `©`, or the word `Copyright` MAY |
| 132 | +be used, in which case a colon is not needed. |
| 133 | + |
| 134 | +The `SPDX-License-Identifier` tag MUST be followed by a valid SPDX License |
| 135 | +Expression describing the licensing of the file (example: |
| 136 | +`SPDX-License-Identifier: GPL-3.0-or-later OR Apache-2.0`). If separate sections |
| 137 | +of the file are licensed differently, a different `SPDX-License-Identifier` tag |
| 138 | +MUST be included for each section. |
| 139 | + |
| 140 | +An example of a comment header: |
| 141 | + |
| 142 | +``` |
| 143 | +# SPDX-FileCopyrightText: 2016, 2018-2019 Jane Doe <[email protected]> |
| 144 | +# SPDX-FileCopyrightText: 2019 Example Company |
| 145 | +# |
| 146 | +# SPDX-License-Identifier: GPL-3.0-or-later |
| 147 | +``` |
| 148 | + |
| 149 | +If these tags are additionally used in the file without describing the file's |
| 150 | +actual license or copyright but for example as part of an output command or |
| 151 | +documentation, these occurrences MAY be put between two comments: |
| 152 | +`REUSE-IgnoreStart` and `REUSE-IgnoreEnd`. The REUSE Tool then ignores all tags |
| 153 | +within. This technique MUST NOT be used to ignore valid tags for licensing or |
| 154 | +copyright. |
| 155 | + |
| 156 | +An example for an ignored block: |
| 157 | + |
| 158 | +``` |
| 159 | +# SPDX-FileCopyrightText: 2021 Jane Doe |
| 160 | +# |
| 161 | +# SPDX-License-Identifier: GPL-3.0-or-later |
| 162 | +
|
| 163 | +# REUSE-IgnoreStart |
| 164 | +echo "SPDX-FileCopyrightText: $(date +'%Y') John Doe" > file.txt |
| 165 | +echo "SPDX-License-Identifier: MIT" > file.txt |
| 166 | +# REUSE-IgnoreEnd |
| 167 | +``` |
| 168 | + |
| 169 | +### In-line snippet comments |
| 170 | + |
| 171 | +If a copyright and/or licensing info is to apply only to a certain snippet |
| 172 | +instead of the whole file, SPDX snippet tags SHOULD be used (as defined in [SPDX |
| 173 | +Specification, Annex H](https://spdx.github.io/spdx-spec/v2.3/file-tags/#h3-snippet-tags-format)). |
| 174 | + |
| 175 | +Such an annotated snippet block MUST start with `SPDX-SnippetBegin` to mark its |
| 176 | +beginning and end with `SPDX-SnippetEnd` to mark the snippet's end. |
| 177 | + |
| 178 | +Do note that SPDX snippet tags MUST start with `SPDX-Snippet`, meaning that the |
| 179 | +correct copyright notice in a snippet is `SPDX-SnippetCopyrightText`. |
| 180 | + |
| 181 | +Example: |
| 182 | + |
| 183 | +``` |
| 184 | +# SPDX-SnippetBegin |
| 185 | +# SPDX-License-Identifier: MIT |
| 186 | +# SPDX-SnippetCopyrightText: 2022 Jane Doe <[email protected]> |
| 187 | +
|
| 188 | +{$snippet_code_goes_here} |
| 189 | +
|
| 190 | +# SPDX-SnippetEnd |
| 191 | +``` |
| 192 | + |
| 193 | +Snippets may nest, and this is denoted by having |
| 194 | +`SPDX-SnippetBegin`/`SPDX-SnippetEnd` pairs within other pairs, in the same way |
| 195 | +that parentheses nest in mathematical expressions. In the case of nested |
| 196 | +snippets, the SPDX file tags are considered to apply to the inner-most snippet. |
| 197 | + |
| 198 | +### DEP5 |
| 199 | + |
| 200 | +Alternatively, Copyright and Licensing Information MAY be associated with a |
| 201 | +file through a DEP5 file. The intended use case of this method is large |
| 202 | +directories where including a comment header in each file (or in `.license` |
| 203 | +companion files) is impossible or undesirable. |
| 204 | + |
| 205 | +The DEP5 file MUST be named `dep5` and stored in the `.reuse/` directory in the |
| 206 | +root of the Project (i.e. `.reuse/dep5`). |
| 207 | + |
| 208 | +The `License` tag MUST be followed by a valid SPDX License Expression describing |
| 209 | +the licensing of the associated files. |
| 210 | + |
| 211 | +The `Copyright` tag MUST be followed by a copyright notice. |
| 212 | + |
| 213 | +An example of a DEP5 file: |
| 214 | + |
| 215 | +``` |
| 216 | +Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/ |
| 217 | +Upstream-Name: Project |
| 218 | +Upstream-Contact: Jane Doe <[email protected]> |
| 219 | +Source: https://example.com/jane/project |
| 220 | +
|
| 221 | +Files: po/* |
| 222 | +Copyright: 2019 Translation Company |
| 223 | +License: GPL-3.0-or-later |
| 224 | +``` |
| 225 | + |
| 226 | +## Format of copyright notices |
| 227 | + |
| 228 | +A copyright notice MUST be prefixed by a tag, symbol or word denoting a |
| 229 | +copyright notice as described in this specification. |
| 230 | + |
| 231 | +The copyright notice MUST contain the name of the copyright holder. The |
| 232 | +copyright notice SHOULD contain the year of publication and the contact address |
| 233 | +of the copyright holder. The order of these items SHOULD be: year, name, contact |
| 234 | +address. |
| 235 | + |
| 236 | +The year of publication MAY be a single year, multiple years, or a span of |
| 237 | +years. |
| 238 | + |
| 239 | +The copyright holder MAY be an individual, list of individuals, group, legal |
| 240 | +entity, or any other descriptor by which one can easily identify the |
| 241 | +copyright holder(s). |
| 242 | + |
| 243 | +Any contact address SHOULD be in between angle brackets. |
| 244 | + |
| 245 | +Examples of valid copyright notices: |
| 246 | + |
| 247 | +``` |
| 248 | +SPDX-FileCopyrightText: 2019 Jane Doe <[email protected]> |
| 249 | +SPDX-FileCopyrightText: © 2019 John Doe <[email protected]> |
| 250 | +© Example Corporation <https://corp.example.com> |
| 251 | +Copyright 2016, 2018-2019 Joe Anybody |
| 252 | +Copyright (c) Alice |
| 253 | +``` |
0 commit comments