You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@tooling.apache.org by "potiuk (via GitHub)" <gi...@apache.org> on 2026/07/08 19:21:43 UTC
[I] SPDX licences are not recognized properly by ATR (tooling-trusted-releases)
potiuk opened a new issue, #1379:
URL: https://github.com/apache/tooling-trusted-releases/issues/1379
RAT 0.18.0 already recognizes properly SPDX licence headers - or more generally short version of licences - which are allowed when PMC sees a good reason (for example test files or .md AGENT files that otherwise eat a lot of tokens.
The https://release-test.apache.org/compose/magpie/0.1.0 is properly RAT-verified, but it raises 26 errors in ATR
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@tooling.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] SPDX licences are not recognized properly by ATR (tooling-trusted-releases)
Posted by "potiuk (via GitHub)" <gi...@apache.org>.
potiuk commented on issue #1379:
URL: https://github.com/apache/tooling-trusted-releases/issues/1379#issuecomment-4919255385
> I re-read that thread and you really should learn to pay attention to Roy who write the ALv2.0 - In https://lists.apache.org/thread/0hpgcom5t5wzw999nyprb2qhw0mlyr9d he suggests that a README include the license and each source could refer back to that. Do you understand the difference? Our users are not dependent on however the SPDX people might change their interpretation of the license.
Yes. That's why Roy had no concerns about accompanying SPDX with linking to the URL of full licence (which we actually have) - so I think we are fine with what Roy wrote and RAT is also OK with it.
It's really not a dicussion with me - but likely wiht RAT / Roy / Legal to clarify it. I just opened an issue, but again - I do not need to get it solved- RAT check is perfectly fine for us. It's really the question whether Lightweight check agrees wit RAT.
My problem is solved now.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@tooling.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] SPDX licences are not recognized properly by ATR (tooling-trusted-releases)
Posted by "sbp (via GitHub)" <gi...@apache.org>.
sbp closed issue #1379: SPDX licences are not recognized properly by ATR
URL: https://github.com/apache/tooling-trusted-releases/issues/1379
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@tooling.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] SPDX licences are not recognized properly by ATR (tooling-trusted-releases)
Posted by "dave2wave (via GitHub)" <gi...@apache.org>.
dave2wave commented on issue #1379:
URL: https://github.com/apache/tooling-trusted-releases/issues/1379#issuecomment-4919163761
I re-read that thread and you really should learn to pay attention to Roy who write the ALv2.0 - In https://lists.apache.org/thread/0hpgcom5t5wzw999nyprb2qhw0mlyr9d he suggests that a README include the license and each source could refer back to that. Do you understand the difference? Our users are not dependent on however the SPDX people might change their interpretation of the license.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@tooling.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] SPDX licences are not recognized properly by ATR (tooling-trusted-releases)
Posted by "dave2wave (via GitHub)" <gi...@apache.org>.
dave2wave commented on issue #1379:
URL: https://github.com/apache/tooling-trusted-releases/issues/1379#issuecomment-4918585939
@potiuk Please provide an ASF documentation reference where SPDX license headers by reference were allowed.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@tooling.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] SPDX licences are not recognized properly by ATR (tooling-trusted-releases)
Posted by "potiuk (via GitHub)" <gi...@apache.org>.
potiuk commented on issue #1379:
URL: https://github.com/apache/tooling-trusted-releases/issues/1379#issuecomment-4918963474
There is no **exact** example:
https://www.apache.org/legal/src-headers.html#is-a-short-form-of-the-source-header-available explains that "for example" this form is ok - but it does not show SPDX as allowed.
There is a discussion in legal - https://lists.apache.org/thread/j1tn63r2lf13v3d1tnnqff8fkcl4nx53 where it was proposed to also add SPDX as explicitly specified form - but there was no final confirmation from LEGAL that it is allowed.
However RAT implement SPDX as allowed.
And it's fine - if lightweight check is not going to have it, that's ok, but more and more projects are using it for AGENTS.md and similar - because it saves a lot of tokens. I had several discussions about it when preparing the agentic discovery for scannig our repos. The last one was today with Maven https://github.com/apache/maven-wrapper/pull/429#pullrequestreview-4654044152
The Maven PMC did not yet follow it - their AGENTS.md added and repos submitted today still have the full licence, but I think you need to grasp with reality that our PMCs are more and more aware about the token cost of full licence in all .md files parsed by Agents and they will fall back to shorter version of licence - where SPDX with URL to full licence seems to be a consensus of joining both - brevity and reference to full licence that has more than just SPDX.
I workarounded it by just disabling lightweight check, but it's not obvious that this is a way to fix it, so I think pragmatically speaking you will lkikely have to deal with more similar cases when ATR will be adoopted, so I guess it's in best interest of ATR to solve it before more projects adopt it and have simlar questions - especially when it's not clear how to dismiss concerns https://github.com/apache/tooling-releases-client/issues/31
That's pretty much all information I have now - I do not need to have this one fixed (I workarounded it) - so it's really up to you what you want to do with it, having all the information.
For me it's just something I observed as a friction that ATR currently has.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@tooling.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] SPDX licences are not recognized properly by ATR (tooling-trusted-releases)
Posted by "dave2wave (via GitHub)" <gi...@apache.org>.
dave2wave commented on issue #1379:
URL: https://github.com/apache/tooling-trusted-releases/issues/1379#issuecomment-4919260568
I've opened https://issues.apache.org/jira/browse/LEGAL-733
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@tooling.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] SPDX licences are not recognized properly by ATR (tooling-trusted-releases)
Posted by "sbp (via GitHub)" <gi...@apache.org>.
sbp commented on issue #1379:
URL: https://github.com/apache/tooling-trusted-releases/issues/1379#issuecomment-5637559016
Resolved by f58acb75c4fb92cab3786a24b2c16cd34bcea1b4.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@tooling.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] SPDX licences are not recognized properly by ATR (tooling-trusted-releases)
Posted by "dave2wave (via GitHub)" <gi...@apache.org>.
dave2wave commented on issue #1379:
URL: https://github.com/apache/tooling-trusted-releases/issues/1379#issuecomment-4919117117
I asked for the state of the policy discussion. I did not ask if it was a good idea. I think you read way too much that I was saying "no".
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@tooling.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] SPDX licences are not recognized properly by ATR (tooling-trusted-releases)
Posted by "potiuk (via GitHub)" <gi...@apache.org>.
potiuk commented on issue #1379:
URL: https://github.com/apache/tooling-trusted-releases/issues/1379#issuecomment-4919285708
Good. Let's see.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@tooling.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] SPDX licences are not recognized properly by ATR (tooling-trusted-releases)
Posted by "dave2wave (via GitHub)" <gi...@apache.org>.
dave2wave commented on issue #1379:
URL: https://github.com/apache/tooling-trusted-releases/issues/1379#issuecomment-5181917423
Let's allow the following format as a valid license header:
```
# SPDX-License-Identifier: Apache-2.0
# SPDX-FileCopyrightText: See the NOTICE file distributed with this work for additional information regarding copyright ownership
# SPDX-FileContributor: Licensed to the Apache Software Foundation (ASF) under one or more contributor license agreements
```
Other licenses possible.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@tooling.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] SPDX licences are not recognized properly by ATR (tooling-trusted-releases)
Posted by "sbp (via GitHub)" <gi...@apache.org>.
sbp commented on issue #1379:
URL: https://github.com/apache/tooling-trusted-releases/issues/1379#issuecomment-4926782098
The lightweight checks and the RAT checks are unlikely ever to be _exactly_ the same, because otherwise we would be reimplementing the subset of RAT that we use, which is quite substantial. The lightweight checks are there for projects that don't have advanced license checking needs, so the question is whether SPDX headers, if confirmed permitted by Legal, would qualify as not being advanced.
I have been using SPDX license headers for many years, since before token costs were a consideration, and have always considered them superior to any longer form statements. I would therefore support this feature being part of the lightweight checks, pending the outcome of the Legal thread.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@tooling.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] SPDX licences are not recognized properly by ATR (tooling-trusted-releases)
Posted by "potiuk (via GitHub)" <gi...@apache.org>.
potiuk commented on issue #1379:
URL: https://github.com/apache/tooling-trusted-releases/issues/1379#issuecomment-5645610643
Nice! thanks!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@tooling.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] SPDX licences are not recognized properly by ATR (tooling-trusted-releases)
Posted by "dave2wave (via GitHub)" <gi...@apache.org>.
dave2wave commented on issue #1379:
URL: https://github.com/apache/tooling-trusted-releases/issues/1379#issuecomment-5197684795
FYI - Justin as VP, Legal Affairs has approved.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@tooling.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org