chore: update license info

achrinza · achrinza · commit 813cfc9a64b5 · 2022-03-05T05:51:54.000Z
Signed-off-by: Rifa Achrinza &lt;25147899+achrinza@users.noreply.github.com&gt;
diff --git a/.eslintignore b/.eslintignore
@@ -1 +1,4 @@
-vendors
+# SPDX-FileCopyrightText: LoopBack Contributors
+# SPDX-License-Identifier: MIT
+
+vendors
diff --git a/.eslintrc.js b/.eslintrc.js
@@ -1,6 +1,5 @@
-// Copyright IBM Corp. 2022. All Rights Reserved.
-// This file is licensed under the MIT License.
-// License text available at https://opensource.org/licenses/MIT
+// SPDX-FileCopyrightText: LoopBack Contributors
+// SPDX-License-Identifier: MIT
 
 module.exports = {
   extends: '@loopback/eslint-config',
diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
@@ -1,3 +1,6 @@
+# SPDX-FileCopyrightText: LoopBack Contributors
+# SPDX-License-Identifier: MIT
+
 name: CI
 on:
   push:
@@ -21,10 +24,12 @@ jobs:
           npm run-script --ignore-scripts install
       - name: Build project
         run: npm run --ignore-scripts build
-      - name: Run code lint
+      - name: Code lint check
         run: |
           npm run-script --ignore-scripts prettier:check
           npm run-script --ignore-scripts validate-csaf20
+      - name: REUSE compliance check
+        uses: fsfe/reuse-action@43bd643263f2a557a37e023e538ab9f83dce92a6 #v1.1.1
   commit-lint:
     name: Commit Lint
     if: github.event.pull_request
@@ -36,7 +41,7 @@ jobs:
       - uses: actions/setup-node@v2
         with:
           node-version: 16
-      - name: Install tools
+      - name: Install dependencies
         run: npm ci --ignore-scripts
-      - name: Run commit lint
+      - name: Commit lint check
         run: npx --no-install commitlint --from=origin/main --to=HEAD --verbose
diff --git a/.gitignore b/.gitignore
@@ -1,3 +1,6 @@
+# SPDX-FileCopyrightText: LoopBack Contributors
+# SPDX-License-Identifier: MIT
+
 # Logs
 logs
 *.log
diff --git a/.gitmodules b/.gitmodules
@@ -1,3 +1,6 @@
+# SPDX-FileCopyrightText: LoopBack Contributors
+# SPDX-License-Identifier: MIT
+
 [submodule "vendors/secvisogram"]
 	path = vendors/secvisogram
 	url = git@github.com:BSI-Bund/secvisogram.git
diff --git a/.husky/commit-msg b/.husky/commit-msg
@@ -1,4 +1,7 @@
 #!/bin/sh
+# SPDX-FileCopyrightText: LoopBack Contributors
+# SPDX-License-Identifier: MIT
+
 . "$(dirname "$0")/_/husky.sh"
 
 npx --no-install commitlint --edit "$1"
diff --git a/.husky/pre-commit b/.husky/pre-commit
@@ -1,4 +1,7 @@
 #!/bin/sh
+# SPDX-FileCopyrightText: LoopBack Contributors
+# SPDX-License-Identifier: MIT
+
 . "$(dirname "$0")/_/husky.sh"
 
 npm run-script prettier:check
diff --git a/.prettierignore b/.prettierignore
@@ -1 +1,5 @@
+# SPDX-FileCopyrightText: LoopBack Contributors
+# SPDX-License-Identifier: MIT
+
 vendors
+!vendors/README.md
diff --git a/.prettierrc b/.prettierrc
diff --git a/.prettierrc.yaml b/.prettierrc.yaml
@@ -0,0 +1,13 @@
+# SPDX-FileCopyrightText: LoopBack Contributors
+# SPDX-License-Identifier: MIT
+
+bracketSpacing: false
+singleQuote: true
+printWidth: 80
+trailingComma: all
+arrowParens: avoid
+overrides:
+  - files: '**/*.md'
+    options:
+      parser: markdown
+      proseWrap: always
diff --git a/.reuse/dep5 b/.reuse/dep5
@@ -0,0 +1,5 @@
+Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
+Upstream-Name: LoopBack Security Repository
+Source: https://github.com/loopbackio/security
+License: MIT
+Copyright: LoopBack Contributors
diff --git a/.vscode/extensions.json b/.vscode/extensions.json
@@ -1,7 +1,10 @@
+// SPDX-FileCopyrightText: LoopBack Contributors
+// SPDX-License-Identifier: MIT
+
 {
     "recommendations": [
         "redhat.vscode-yaml",
         "dbaeumer.vscode-eslint",
         "esbenp.prettier-vscode"
     ]
-}
+}
diff --git a/.vscode/settings.json b/.vscode/settings.json
@@ -1,3 +1,6 @@
+// SPDX-FileCopyrightText: LoopBack Contributors
+// SPDX-License-Identifier: MIT
+
 {
     "json.schemas": [
         {
diff --git a/AUTHORS b/AUTHORS
@@ -0,0 +1,4 @@
+# SPDX-FileCopyrightText: LoopBack Contributors
+# SPDX-License-Identifier: MIT
+
+Rifa Achrinza <rifa@achrinza.com> (https://github.com/achrinza)
diff --git a/LICENSE b/LICENSE
@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2022 LoopBack
+Copyright (c) <year> <copyright holders>
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
diff --git a/LICENSES/MIT.txt b/LICENSES/MIT.txt
@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) <year> <copyright holders>
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
diff --git a/README.md b/README.md
@@ -1,3 +1,8 @@
+<!--
+  SPDX-FileCopyrightText: LoopBack Contributors
+  SPDX-License-Identifier: MIT
+-->
+
 # LoopBack Security Repository
 
 > Note: This is a work-in-progress and may be incomplete.
@@ -18,3 +23,7 @@ To clone this Git repository:
 git clone git@github.com:loopbackio/security.git
 git submodule update --recursive
 ```
+
+## License
+
+[MIT](./LICENSE)
diff --git a/advisories/README.md b/advisories/README.md
@@ -1,3 +1,8 @@
+<!--
+  SPDX-FileCopyrightText: LoopBack Contributors
+  SPDX-License-Identifier: MIT
+-->
+
 # LoopBack Security Advisories (LBSA)
 
 > Note: This is a work-in-progress and may be incomplete. Please see
diff --git a/advisories/lbsa-20201130.csaf.json.license b/advisories/lbsa-20201130.csaf.json.license
@@ -0,0 +1,2 @@
+SPDX-FileCopyrightText: LoopBack Contributors
+SPDX-License-Identifier: MIT
diff --git a/commitlint.config.js b/commitlint.config.js
@@ -1,16 +1,11 @@
-// Copyright IBM Corp. 2017,2018. All Rights Reserved.
-// This file is licensed under the MIT License.
-// License text available at https://opensource.org/licenses/MIT
+// SPDX-FileCopyrightText: LoopBack Contributors
+// SPDX-License-Identifier: MIT
 
-const isCI = process.env.CI;
 module.exports = {
   extends: ['@commitlint/config-conventional'],
   rules: {
     'header-max-length': [2, 'always', 100],
     'body-leading-blank': [2, 'always'],
     'footer-leading-blank': [0, 'always'],
-    // Only enforce the rule if CI flag is not set. This is useful for release
-    // commits to skip DCO
-    'signed-off-by': [isCI ? 0 : 2, 'always', 'Signed-off-by:'],
   },
 };
diff --git a/keys/COMMON_TASKS.md b/keys/COMMON_TASKS.md
@@ -1,3 +1,8 @@
+<!--
+  SPDX-FileCopyrightText: LoopBack Contributors
+  SPDX-License-Identifier: MIT
+-->
+
 # Common Tasks
 
 ## References
diff --git a/keys/README.md b/keys/README.md
@@ -1,3 +1,8 @@
+<!--
+  SPDX-FileCopyrightText: LoopBack Contributors
+  SPDX-License-Identifier: MIT
+-->
+
 # LoopBack PGP Keys
 
 > Note: This is a work-in-progress and may be incomplete.
@@ -33,29 +38,29 @@ Identity Attestation of the LoopBack Project's Core Maintainers are done by:
 
 1. Signing of Mantainer's Key against Main Key
 2. Publishing of the Maintainer's Key to the `main` branch of this Git
-    repository
+   repository
 
 Before the LoopBack Project can attest to the identity of a maintainer, a secure
 mechanism of exchanging the Maintainer's Key must be done while satisfying the
 following requirements:
 
 1. The Maintainer's Key is shared over at least 2 trusted channels where the
-    core maintainer has already established the authenticity of their account.
-    This can be: e-mail, Slack, and GitHub Teams
+   core maintainer has already established the authenticity of their account.
+   This can be: e-mail, Slack, and GitHub Teams
 2. The process, artifacts (e.g. screenshots, e-mail source code), and
-    justification for the pre-established trust of the account are documented
-    and stored in an encrypted medium.
+   justification for the pre-established trust of the account are documented
+   and stored in an encrypted medium.
 
 #### Private Key Exposure
 
 - All potential private key exposure MUST be communicated with the Security
   Team over e-mail or Slack.
 - A Revocation Certificate MUST be generated and published to all key sharing
-    systems that's well known, and where the key has been publised as soon as
-    feasible by the party in possession of the compromised Private Key.
+  systems that's well known, and where the key has been publised as soon as
+  feasible by the party in possession of the compromised Private Key.
 - A Revocation Certificate MUST be generated and published to all key sharing
-    systems that's well known, and where the key has been published within 24
-    hours of notification by the party responsible for maintaining the Main Key.
+  systems that's well known, and where the key has been published within 24
+  hours of notification by the party responsible for maintaining the Main Key.
 
 ##### Well-known key sharing systems
 
@@ -80,10 +85,10 @@ The Core Maintainers' Key are held by each participating Core Maintianer for
 signing of Git commits.
 
 - Each Core Maintainer is responsible for keeping their maintainers' key safe
-- This key MUST only be possessed by the 
+- This key MUST only be possessed by the
 - This key MUST be used for signing Git commits
 - This key SHOULD NOT be used except for signing Git commits
   - For avoidance of doubt, this key SHOULD NOT be used for Git
-      authentication. Consider using a dedicated SSH key instead.
+    authentication. Consider using a dedicated SSH key instead.
 - This key SHOULD NOT be used except for signing Git commits for the LoopBack
-    Project 
+  Project
diff --git a/package-lock.json.license b/package-lock.json.license
diff --git a/package.json b/package.json
@@ -14,7 +14,7 @@
     "lint:fix": "npm run eslint:fix && npm run prettier:fix",
     "eslint": "lb-eslint --report-unused-disable-directives .",
     "eslint:fix": "npm run eslint -- --fix",
-    "prettier:cli": "lb-prettier '**/*.ts' '**/*.js' 'advisories/lbsa*.csaf.json'",
+    "prettier:cli": "lb-prettier '**/*.ts' '**/*.js' 'advisories/lbsa*.csaf.json' '**/*.md'",
     "prettier:check": "npm run prettier:cli -- -l",
     "prettier:fix": "npm run prettier:cli -- --write",
     "validate-csaf20": "ts-node --project=scripts/tsconfig.json scripts/advisories/validate-csaf20.ts"
@@ -27,7 +27,7 @@
     "node": "12 || 14 || 16 || 17",
     "npm": ">=7"
   },
-  "author": "",
+  "author": "LoopBack Contributors",
   "license": "MIT",
   "bugs": {
     "url": "https://github.com/loopbackio/security/issues"
diff --git a/package.json.license b/package.json.license
@@ -0,0 +1,2 @@
+SPDX-FileCopyrightText: LoopBack Contributors
+SPDX-License-Identifier: MIT
diff --git a/scripts/README.md b/scripts/README.md
@@ -1,3 +1,8 @@
+<!--
+  SPDX-FileCopyrightText: LoopBack Contributors
+  SPDX-License-Identifier: MIT
+-->
+
 # Scripts
 
 This section of the Git repository contains executable scripts that are used
diff --git a/scripts/advisories/validate-csaf20.ts b/scripts/advisories/validate-csaf20.ts
@@ -1,3 +1,6 @@
+// SPDX-FileCopyrightText: LoopBack Contributors
+// SPDX-License-Identifier: MIT
+
 import path from 'path';
 import glob from 'glob';
 import createCore from 'secvisogram/dist/shared/Core';
diff --git a/scripts/tsconfig.json b/scripts/tsconfig.json
@@ -1,3 +1,6 @@
+// SPDX-FileCopyrightText: LoopBack Contributors
+// SPDX-License-Identifier: MIT
+
 {
     "compilerOptions": {
         "esModuleInterop": true,
diff --git a/vendors/README.md b/vendors/README.md
@@ -1,3 +1,8 @@
+<!--
+  SPDX-FileCopyrightText: LoopBack Contributors
+  SPDX-License-Identifier: MIT
+-->
+
 # Vendors
 
 This directory contains Git submodules that are depended upon by this Git

-Original file line number
+Diff line change
@@ @@ -1 +1,4 @@ @@
 -vendors
 +# SPDX-FileCopyrightText: LoopBack Contributors
 +# SPDX-License-Identifier: MIT
++
 +vendors