dep5: complex license options (and, or) in dep5 are not respected

[janderssonse]

Problem: In my dep5 file I have a file with multiple licenses.

Example:

Files: THEFILE
Copyright: 2020 COPYRIGHTHOLDER <[email protected]>
License: MIT and Apache-2.0

which is valid according to the specification https://dep-team.pages.debian.net/deps/dep5/

However, reuse lint only seems to care about the first license, in the example it would only find MIT

[carmenbianca]

I can't get this bug to trigger. Can you provide an example repository?

I tried to trigger this bug by:

• Editing .reuse/dep5 in this repository to change one line to GPL-3.0-or-later AND 0BSD (and also GPL-3.0-or-later and 0BSD).
• Running reuse lint

It shows me:

* Missing licenses: 0BSD

Also as a subnote: The REUSE Specification overrides the License: field in DEP5:

Where the REUSE Specification and DEP5 state different things, the REUSE Specification takes precedence. Specifically in the case of the Copyright and License tags.

[janderssonse]

Thanks for looking into it. Please try it at https://github.com/SVT/open-source-project-template

[carmenbianca]

Found the issue.

Files: docs/CONTRIBUTING.md
Copyright: 2020 HERE Europe B.V. <[email protected]>
           2020 CFPB Consumer Finanical Protection Bureau. <[email protected]>
           2020 Sveriges Television AB <[email protected]>
License: CC0-1.0 and Apache-2.0

Files: *.md
Copyright: 2020 Sveriges Television AB <[email protected]>
           2020 CFPB Consumer Finanical Protection Bureau. <[email protected]>
License: CC0-1.0

The second paragraph overrides the first. I suspect that this is an upstream bug in python-debian. When you swap the paragraphs around, you get the expected behaviour.

[janderssonse]

Aha, thanks. Will fix in my repo. I did not thought order mattered and thought it was "The more specific overrides the more general". Order importance is ok with me also, but maybe it should be documented. Should I Close this issue?

[carmenbianca]

You're welcome :) And thank you for reporting the issue. Please keep it open, and I will prod upstream about this issue some time next week.

Have a good day :D

[mxmehl]

@carmenbianca does the issue still exist with upstream?