Merge pull request #264 from datalad/bf-LICENSE

doc: declare licensing via REUSE + DEP-3 patch headers

Author: yarikoptic

.github/workflows/reuse.yaml

@@ -0,0 +1,27 @@
+# SPDX-FileCopyrightText: 2020-2026 DataLad Team <team@datalad.org>
+# SPDX-License-Identifier: MIT
+name: REUSE Compliance
+
+on:
+  pull_request:
+    paths:
+      - 'REUSE.toml'
+      - 'LICENSES/**'
+      - 'patches/**'
+      - '**/*.py'
+      - '**/*.sh'
+      - '**/*.yaml'
+      - '**/*.yml'
+      - '**/*.md'
+      - '.github/workflows/reuse.yaml'
+  push:
+    branches:
+      - master
+
+jobs:
+  reuse:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: REUSE compliance check
+        uses: fsfe/reuse-action@v5

.gitignore

@@ -2,3 +2,12 @@
 __pycache__/
 venv/
 .npm
+
+# Local build artifacts
+buildenv.sif
+.tox/
+.venv*/
+.cache/
+.mypy_cache/
+.ruff_cache/
+.pytest_cache/

LICENSES/AGPL-3.0-or-later.txt

@@ -0,0 +1,19 @@
+MIT License Copyright (c) <year> <copyright holders>
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is furnished
+to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice (including the next
+paragraph) shall be included in all copies or substantial portions of the
+Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS
+OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
+WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF
+OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

LICENSES/MIT.txt

@@ -63,6 +63,25 @@ It is recommended that patches be given names of the form
 `YYYYMMDD-{commit}-{brief_description}.patch`, where `{commit}` is the short
 hash of the git-annex source code commit against which the patch was made.
 
+New patches should carry a
+[DEP-3](https://dep-team.pages.debian.net/deps/dep3/) header at the top of
+the file (`git apply` ignores the preamble), including SPDX tags so the
+patch remains [REUSE](https://reuse.software/) compliant on its own:
+
+```
+Description: <one-line summary>
+ <if needed - longer explanation: why this patch exists in datalad/git-annex,
+ what it works around, and who benefits>
+Origin: vendor, https://github.com/datalad/git-annex/commit/<sha>
+Author: Your Name <you@example.org>
+Forwarded: not-needed   # or: <URL of upstream submission>
+Last-Update: YYYY-MM-DD
+SPDX-FileCopyrightText: YEAR Your Name <you@example.org>
+SPDX-License-Identifier: AGPL-3.0-or-later
+---
+diff --git a/...
+```
+
 Once a patch PR is merged into `master`, the patch will be applied to all
 git-annex builds on all platforms, including release builds.  Patches in
 `patches/` are applied in lexicographic filename order.  If a patch in
@@ -71,6 +90,27 @@ the file from `patches/`, and the patch will be skipped.  If a patch fails to
 apply, an issue will be automatically created in this repository, and the build
 will fail.
 
+## Licensing
+
+Files in the `master` branch (this branch) are
+[REUSE](https://reuse.software/) compliant — see [`REUSE.toml`](./REUSE.toml)
+and [`LICENSES/`](./LICENSES/) for the authoritative, machine-readable
+copyright and license information.  In short:
+
+- Repository scaffolding (CI workflows, test drivers, docs, README) is
+  licensed **MIT** © DataLad Team.
+- Files under [`patches/`](./patches/) modify upstream
+  [git-annex](https://git-annex.branchable.com) source and are therefore
+  licensed **AGPL-3.0-or-later**.  Each patch carries a
+  [DEP-3](https://dep-team.pages.debian.net/deps/dep3/) header documenting
+  its description, origin, author, and upstream-forwarding status.
+
+The
+[`upstream/master`](https://github.com/datalad/git-annex/tree/upstream/master)
+branch is an unmodified mirror of git-annex upstream and follows the
+licensing of that source tree (`AGPL-3.0-or-later` as a whole, with
+component-level licenses recorded in upstream's own `COPYRIGHT` file).
+
 ## Status
 
 [![Update mirror](https://github.com/datalad/git-annex/actions/workflows/update-mirror.yml/badge.svg)](https://github.com/datalad/git-annex/actions/workflows/update-mirror.yml)

README.md

@@ -0,0 +1,28 @@
+version = 1
+
+# Default: DataLad scaffolding for CI / testing / distribution of git-annex.
+# Covers root files, GitHub workflows, test client drivers, and docs.
+[[annotations]]
+path = [
+  "README.md",
+  "noxfile.py",
+  "setup.cfg",
+  ".gitignore",
+  ".pre-commit-config.yaml",
+  ".github/**",
+  "clients/**",
+  "docs/**",
+]
+precedence = "aggregate"
+SPDX-FileCopyrightText = "2020-2026 DataLad Team <team@datalad.org>"
+SPDX-License-Identifier = "MIT"
+
+# Patches modify git-annex source. As derivative works of git-annex
+# (AGPL-3.0-or-later), the patch files inherit that license. Per-file
+# DEP-3 / SPDX headers inside individual *.patch files override this
+# block (precedence = "closest") to record the actual patch author.
+[[annotations]]
+path = "patches/**"
+precedence = "closest"
+SPDX-FileCopyrightText = "2020-2026 DataLad Team <team@datalad.org>"
+SPDX-License-Identifier = "AGPL-3.0-or-later"

REUSE.toml

@@ -1,3 +1,11 @@
+Description: Exclude datalad/git-annex CI scaffolding from Debian source package
+Origin: vendor, https://github.com/datalad/git-annex/commit/b4a7900e2b
+Author: John T. Wodder II <git@varonathe.org>
+Forwarded: not-needed
+Last-Update: 2024-02-16
+SPDX-FileCopyrightText: 2024 John T. Wodder II <git@varonathe.org>
+SPDX-License-Identifier: AGPL-3.0-or-later
+---
 diff --git a/debian/source/options b/debian/source/options
 new file mode 100644
 index 0000000000..62612d7c71