Can we switch to SPDX-License-Identifiers?

[dprotaso]

ie. instead of the full license we use

// SPDX-License-Identifier: Apache-2.0

/assign @thisisnotapril

[dprotaso]

April said she'll consult the lawyercats

/meow

[knative-prow-robot]

@dprotaso:

In response to this:

April said she'll consult the lawyercats

/meow

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[dprotaso]

wow that's a creepy cat

[thisisnotapril]

lol when did Prow decide to add cat pictures?? this is amazing.

[thisisnotapril]

From legal - we can use SPDX in addition to the standard license template, but can't just use SPDX. There is no real authority backing up the idea that SPDX notifiers are an effective instrument for communicating the licensing of a given file; hence best practice is to use the full license header so nothing is ambiguous.

[rhuss]

@thisisnotapril thanks for clarifying ! As I think the intention was to reduce the noise in source files, we should not add SPDX in addition, right ? (so maybe we can close this issue for now @dprotaso ).

[dprotaso]

Chatted with April - this is still ongoing.

What's notable is that the apache 2 license guidance says using SPDX is fine: http://www.apache.org/foundation/license-faq.html#Apply-My-Software

K8s is figuring out their story: cncf/foundation#143

[thisisnotapril]

Update: best practice is still going to be to use the standard license header. K8s is doing the same; preference is for the full license header. As the SPDX benefit is minor; removing about 8 lines of code; it's better to spell things out fully. Our legal has already seen examples where the top-level license doesn't match up with the SPDX, or copyright bits removed; etc - their stance is it's best to be safe and use the full header so it's fully spelled out.