diff --git a/LICENSE b/LICENSE new file mode 120000 index 0000000..b1972c6 --- /dev/null +++ b/LICENSE @@ -0,0 +1 @@ +LICENSES/CC-BY-SA-4.0.txt \ No newline at end of file diff --git a/The_Steelbore_Standard.md b/The_Steelbore_Standard.md index 4504447..f02e658 100644 --- a/The_Steelbore_Standard.md +++ b/The_Steelbore_Standard.md @@ -23,6 +23,21 @@ concerns. ## Changelog +- **v1.36 (2026-07-26):** **§4.3:** the root `LICENSE` file is now + **required** and MUST be a **symbolic link** to the project’s primary + license text in `LICENSES/` (e.g. + `ln -s LICENSES/GPL-3.0-or-later.txt LICENSE`) — upgrading the former + "a root `LICENSE` MAY remain as a GitHub-detection pointer" allowance. + GitHub follows the symlink for license detection while REUSE keeps the + verbatim texts in `LICENSES/`, giving both one source of truth; a + duplicated regular-file `LICENSE` is non-compliant because the two + copies drift. Link target follows the §4.1.1 artifact class + (`GPL-3.0-or-later` / `AGPL-3.0-or-later` for software-primary repos, + `CC-BY-SA-4.0` for document-primary repos). **§5.2:** `LICENSE` added + as a required posture file in its own right. **§16:** + compliance-checklist §4.3 bullet extended with the symlink + requirement. + - **v1.35 (2026-07-25):** **§11 becomes a palette family.** The single canonical palette is replaced by a registry of six: the Steelbore 2 palette of v1.34 is now named **Steelbore Modern** and remains the @@ -676,8 +691,26 @@ machine-readable license and copyright metadata. Every project MUST be - **`LICENSES/` directory:** the verbatim text of every license used in the repo lives in `LICENSES/.txt` (e.g., `LICENSES/GPL-3.0-or-later.txt`, `LICENSES/AGPL-3.0-or-later.txt`, - plus any upstream licenses per §4.2). A root `LICENSE` file MAY remain - as a pointer for GitHub’s license detection. + plus any upstream licenses per §4.2). + +- **Root `LICENSE` is a symbolic link.** GitHub reads a repository’s + license from a root `LICENSE` file; REUSE requires the verbatim texts + under `LICENSES/`. Both are satisfied with a single source of truth: + the root `LICENSE` MUST be a symbolic link to the project’s primary + license text inside `LICENSES/` — never a second, duplicated copy of + the text. + + ln -s LICENSES/GPL-3.0-or-later.txt LICENSE + git add LICENSE + + Git stores the result as a symlink (mode `120000`), GitHub follows it + for license detection, and `reuse lint` stays clean. The link target + is the repository’s **primary** license per §4.1.1 — + `GPL-3.0-or-later` (or `AGPL-3.0-or-later` when network-facing) for a + software-primary repo, `CC-BY-SA-4.0` for a document-primary repo. A + duplicated regular-file `LICENSE` is **non-compliant**: the two copies + drift, and a stale root `LICENSE` misreports the project’s license to + every GitHub visitor. - **CI gate:** `reuse lint` MUST pass before shipping. @@ -721,7 +754,8 @@ templates: | `README.md` | Includes a "Project Posture" section linking to the two below | | `NOTICE.md` | Full no-warranty / no-liability statement; defers to the project’s GPL/AGPL license (§4.1) for binding terms | | `CONTRIBUTING.md` | Contribution scope, PR-acceptance discretion, sign-off, security reporting, license-of-contributions | -| `LICENSES/` | REUSE license directory (§4.3): verbatim text of every license used (`GPL-3.0-or-later` or `AGPL-3.0-or-later`, plus any upstream licenses per §4.2). A root `LICENSE` MAY remain as a GitHub-detection pointer. | +| `LICENSES/` | REUSE license directory (§4.3): verbatim text of every license used (`GPL-3.0-or-later` or `AGPL-3.0-or-later`, plus any upstream licenses per §4.2) | +| `LICENSE` | Symbolic link to the primary license text in `LICENSES/` (§4.3) — e.g. `ln -s LICENSES/GPL-3.0-or-later.txt LICENSE`. Not a duplicated copy of the text. | Customize only the project name, scope, and any project-specific carve-outs. @@ -2023,7 +2057,8 @@ Before finalising **any** Spacecraft Software artifact, mentally verify: - [ ] **§4.3** REUSE-compliant: two-tag SPDX header (`SPDX-FileCopyrightText` + `SPDX-License-Identifier`) on every file (or `.license` sidecar / `REUSE.toml` entry); `LICENSES/` directory - present; `reuse lint` passes + present; root `LICENSE` is a symbolic link into `LICENSES/` (never a + duplicated copy); `reuse lint` passes - [ ] **§5** Project Posture: README/NOTICE/CONTRIBUTING present; default personal-hobby stance applied; general-use carve-outs declared diff --git a/The_Steelbore_Standard.texi b/The_Steelbore_Standard.texi index a60324d..44db09e 100644 --- a/The_Steelbore_Standard.texi +++ b/The_Steelbore_Standard.texi @@ -5,11 +5,11 @@ @setfilename The_Steelbore_Standard.info @documentencoding UTF-8 @documentlanguage en -@settitle The Steelbore Standard 1.35 +@settitle The Steelbore Standard 1.36 @c %**end of header -@set VERSION 1.35 -@set UPDATED 2026-07-25 +@set VERSION 1.36 +@set UPDATED 2026-07-26 @set SUBDOMAIN https://Standard.SpacecraftSoftware.org/ @copying @@ -108,6 +108,21 @@ are separate concerns. @section Changelog @itemize @item +@strong{v1.36 (2026-07-26):} @strong{§4.3:} the root @code{LICENSE} file +is now @strong{required} and MUST be a @strong{symbolic link} to the +project's primary license text in @code{LICENSES/} (e.g. @code{ln -s +LICENSES/GPL-3.0-or-later.txt LICENSE}) --- upgrading the former "a root +@code{LICENSE} MAY remain as a GitHub-detection pointer" allowance. +GitHub follows the symlink for license detection while REUSE keeps the +verbatim texts in @code{LICENSES/}, giving both one source of truth; a +duplicated regular-file @code{LICENSE} is non-compliant because the two +copies drift. Link target follows the §4.1.1 artifact class +(@code{GPL-3.0-or-later} / @code{AGPL-3.0-or-later} for software-primary +repos, @code{CC-BY-SA-4.0} for document-primary repos). @strong{§5.2:} +@code{LICENSE} added as a required posture file in its own right. +@strong{§16:} compliance-checklist §4.3 bullet extended with the symlink +requirement. +@item @strong{v1.35 (2026-07-25):} @strong{§11 becomes a palette family.} The single canonical palette is replaced by a registry of six: the Steelbore 2 palette of v1.34 is now named @strong{Steelbore Modern} and @@ -948,8 +963,28 @@ entry in the repo-root @code{REUSE.toml}. No file is left uncovered used in the repo lives in @code{LICENSES/.txt} (e.g., @code{LICENSES/GPL-3.0-or-later.txt}, @code{LICENSES/AGPL-3.0-or-later.txt}, plus any upstream licenses per -§4.2). A root @code{LICENSE} file MAY remain as a pointer for GitHub's -license detection. +§4.2). +@item +@strong{Root @code{LICENSE} is a symbolic link.} GitHub reads a +repository's license from a root @code{LICENSE} file; REUSE requires the +verbatim texts under @code{LICENSES/}. Both are satisfied with a single +source of truth: the root @code{LICENSE} MUST be a symbolic link to the +project's primary license text inside @code{LICENSES/} --- never a +second, duplicated copy of the text. + +@verbatim +ln -s LICENSES/GPL-3.0-or-later.txt LICENSE +git add LICENSE +@end verbatim + +Git stores the result as a symlink (mode @code{120000}), GitHub follows +it for license detection, and @code{reuse lint} stays clean. The link +target is the repository's @strong{primary} license per §4.1.1 --- +@code{GPL-3.0-or-later} (or @code{AGPL-3.0-or-later} when +network-facing) for a software-primary repo, @code{CC-BY-SA-4.0} for a +document-primary repo. A duplicated regular-file @code{LICENSE} is +@strong{non-compliant}: the two copies drift, and a stale root +@code{LICENSE} misreports the project's license to every GitHub visitor. @item @strong{CI gate:} @code{reuse lint} MUST pass before shipping. @end itemize @@ -1039,8 +1074,12 @@ reporting, license-of-contributions @code{LICENSES/} @tab REUSE license directory (§4.3): verbatim text of every license used (@code{GPL-3.0-or-later} or @code{AGPL-3.0-or-later}, plus any -upstream licenses per §4.2). A root @code{LICENSE} MAY remain as a -GitHub-detection pointer. +upstream licenses per §4.2) +@item +@code{LICENSE} + @tab Symbolic link to the primary license text in @code{LICENSES/} +(§4.3) --- e.g. @code{ln -s LICENSES/GPL-3.0-or-later.txt LICENSE}. Not +a duplicated copy of the text. @end multitable Customize only the project name, scope, and any project-specific @@ -3380,7 +3419,9 @@ shipped in @code{LICENSES/} ☐ @strong{§4.3} REUSE-compliant: two-tag SPDX header (@code{SPDX-FileCopyrightText} + @code{SPDX-License-Identifier}) on every file (or @code{.license} sidecar / @code{REUSE.toml} entry); -@code{LICENSES/} directory present; @code{reuse lint} passes +@code{LICENSES/} directory present; root @code{LICENSE} is a symbolic +link into @code{LICENSES/} (never a duplicated copy); @code{reuse lint} +passes @item ☐ @strong{§5} Project Posture: README/NOTICE/CONTRIBUTING present; default personal-hobby stance applied; general-use carve-outs declared