Bug#885698: Bug#1135097: Bug#885698: What licenses should be included in /usr/share/common-licenses?

Simon Josefsson <[email protected]> Wed, 29 Apr 2026 12:14:57 +0200

Newsgroups	gmane.linux.debian.devel.policy
Message-ID	<87qznyrs2m.fsf__47109.4315334753$1777457848$gmane$org@josefsson.org>

Bill Allombert <[email protected]> writes:

> On Wed, Apr 29, 2026 at 11:38:49AM +0200, Simon Josefsson wrote:
>> Is there objections to using SPDX abbreviations for the file names of
>> licenses in base-files?
>> 
>> I didn't double-check if that's in the proposal, but I think that's how
>> it should be done.
>> 
>> If we already deviate from SPDX names, then maybe moving existing files
>> to SPDX-names, and recommending use of those names, and set up a symlink
>> would be an improvement.  Or grandfather in them as exceptions, to avoid
>> unnecessary debian/copyright churn.
>> 
>> It would be nice if SPDX names was mentioned in debian-policy or
>> base-files/debian/README.source, so we don't forget about this aspect in
>> the future.  We can always change that policy later on if it turns out
>> to be a bad idea for some reason (if someone registers FOO`rm -rf /` as
>> a SPDX license name, perhaps).
>
> More generally we could have two packages:
> base-files with /usr/share/common-licenses/
> and a new package
> spdx-license with /usr/share/spdx-licenses/ with all SPDX license used
> by Debian.
> and have a tool that build debian/copyright from spdx-license at build time, so
> spdx-license would only be needed when building packages.

I think that is orthogonal -- but I also think the suggestion is good.

Doesn't 'spdx-licenses' provide this, though?  Maybe not the "tool that
build debian/copyright" part though, but that could be done separately.

https://tracker.debian.org/pkg/spdx-licenses

/Simon

signature.asc (application/pgp-signature, 1.2 KB)