feat(license): §4.3 v1.38 LICENSE layout — canonical text at root, LICENSES/ links to it - #6
Conversation
…CENSES/ links to it Both a root LICENSE and LICENSES/GPL-3.0-or-later.txt existed as independent regular files — two copies of the same license text, which is the drift risk §4.3 forbids. The root now carries the canonical FSF GPL-3.0 text and LICENSES/GPL-3.0-or-later.txt is a symlink to it, so the text exists exactly once. Standard §4.3 (v1.38): the root LICENSE is a regular file holding the verbatim canonical license text; LICENSES/<SPDX-id>.txt for that license symlinks back to it. GitHub's detector reads git blobs, so a symlinked root LICENSE reports NOASSERTION; reuse reads the filesystem and follows the link. The text exists exactly once. Only LICENSE and LICENSES/ are touched. Secondary licenses in LICENSES/ stay regular files. reuse lint: pass -> pass. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: b86887fb61
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| the library. If this is what you want to do, use the GNU Lesser General | ||
| Public License instead of this License. But first, please read | ||
| <https://www.gnu.org/licenses/why-not-lgpl.html>. No newline at end of file | ||
| GNU GENERAL PUBLIC LICENSE |
There was a problem hiding this comment.
The reviewed commit contains no gpgsig header, and git verify-commit 9f3a5d696fc439dc6d23203796f084b05bde20be exits with status 1, despite the commit message claiming that it is signed. Recreate this commit with a valid signature before landing it so the repository's signed-and-Verified pre-commit requirement is satisfied.
AGENTS.md reference: AGENTS.md:L74-L76
Useful? React with 👍 / 👎.
1 participant
Brings this repo into compliance with The Steelbore Standard §4.3 as amended in v1.38.
Audit finding
Both a root LICENSE and LICENSES/GPL-3.0-or-later.txt existed as independent regular files — two copies of the same license text, which is the drift risk §4.3 forbids. The root now carries the canonical FSF GPL-3.0 text and LICENSES/GPL-3.0-or-later.txt is a symlink to it, so the text exists exactly once.
Change
LICENSE: regular file (mode100644) holding the canonical, unmodifiedGPL-3.0-or-latertext.LICENSES/GPL-3.0-or-later.txt: symlink to../LICENSE(mode120000).LICENSES/is untouched — secondary licenses (§4.2 upstream texts, other artifact classes per §4.1.1) stay regular files.Why this direction
GitHub's license detector reads git blobs, and a symlink's blob is the target path, not the license text — a symlinked root
LICENSEis reported asNOASSERTION.reusereads the working tree through the filesystem, so it follows the link inLICENSES/and lints clean. The text exists exactly once, with no drift.Verification
reuse lint:pass→passGPL-3.0(expectedGPL-3.0after merge)LICENSE/LICENSES/paths changed🤖 Generated with Claude Code