Lesson 7 · attribution

Attribution survives the build

Associate each file with its actual holder and grant.

An SPDX-License-Identifier declares an expression. SPDX-FileCopyrightText records the holder and publication information. Neither tag replaces the need for the applicable license text or permits you to name a holder who did not contribute.

REUSE 3.3 supports file headers, adjacent .license files and REUSE.toml annotations. Sidecars help for formats that cannot carry comments. Annotation precedence matters when declarations overlap.

The drill focuses on the header and sidecar subset. Declare the actual MIT grant and the supplied copyright holder, then keep the associated license text with the release. A syntactically valid but false GPL header is not a correct repair.

Attribution etiquette includes retaining useful provenance even when a specific artifact has no additional legal attribution condition. Keep that practice distinct from the license obligations the engine grades.

Read the primary terms and guidance ↗

Try it: A file without its history

Repair the REUSE declaration on src/library.ts. Preserve the actual holder and SPDX MIT identifier; the required license text is already present.

Before inspecting the result

What does this supplied release need before its modeled requirements are met?

Already meets the requirementsA concrete repairAdditional evidence or a license choice

Project boundary

2 components

Dependency relationships
From → to	Connection	Semantics
app → library	bundle	intimate

Supplied facts

Distribution: binary
Network interaction: No
Intended use: internal
Evaluation date: 2026-10-24
Policy: learning

These facts define the simulation. Evidence declarations stand in for actual corresponding source, relinkable objects and release materials.

Components

Inspect component

Declared license: LicenseRef-Proprietary
Modified files: None
Artifact: code

Third-party grants remain fixed unless this scenario supplies authority to change them.

Project artifacts

Format library 1.0.0

MIT License

Permission is hereby granted, free of charge, to any person obtaining a copy of this software and
associated documentation files (the "Software"), to deal in the Software without restriction, including
without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the
following conditions:

The above copyright notice and this permission notice shall be included in all copies or substantial
portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT
LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO
EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
USE OR OTHER DEALINGS IN THE SOFTWARE.

Evidence artifact format

Source offers contain “component: id” and “source: https://…” on separate lines. Covered-file offers also list the covered paths. Relinking declarations contain “replace-compatible-library” for dynamic linking or “relink-object-files” for static linking, and “reverse-engineering-permitted”. These declarations model supplied release artifacts.

License reference

permissions: commercial-use, modifications, distribution, private-use
conditions: include-copyright, include-license
limitations: liability, warranty

Read authoritative terms ↗

Expression builder

SPDX expression

Each row is one selectable alternative. AND retains every term in a row.
Alternative	Required licenses
1	MIT AND LGPL-3.0-only
2	Apache-2.0 AND LGPL-3.0-only

Results appear after submission.