diff --git a/contributing/reuse.rst b/contributing/reuse.rst index eed4d63ad8cb07206cdbdae9a80805b3c8e83a2e..f100ef8843b85b864cf221f6d5d66af28a24228e 100644 --- a/contributing/reuse.rst +++ b/contributing/reuse.rst @@ -18,6 +18,7 @@ compliant. REUSE requires SPDX information for each file, rules for which are as follows: * for files copyrighted by projects contributors (**"First Party Files"**): + * any new file MUST have a SPDX header (copyright and license); * for files that don't support headers (for example binaries, patches etc.) an associated ``.license`` file MUST be included with the relevant SPDX information; * do not add Copyright Year as part of the SPDX header information; @@ -26,8 +27,10 @@ as follows: * you MUST NOT alter copyright statements made by others, but only add your own; * for files copyrighted by third parties and just added to the project by contributors, eg. files copied from other projects or back-ported patches (**"Third Party Files"**): + * if upstream files already have SPDX headers, they MUST be left unchanged; * if upstream files do *not* have SPDX headers: + * the exact upstream provenance (repo, revision, path) MUST be identified; * you MUST NOT add SPDX headers to Third Party Files; * copyright and license information, as well as upstream provenance information (in the "Comment" section), MUST be stored in `.reuse/dep5` following `Debian dep5 specification <https://dep-team.pages.debian.net/deps/dep5/>`_ (see examples below);