Repository navigation
Introduce REUSE compliance, with honest markers for borrowed material - #32
Merged
Merged
Conversation
The repository has always declared CC-BY-SA-4.0, but that only ever
covered what we authored. Slides quote the world -- screenshots of web
pages and papers, figures, cartoons, funder logos -- and none of that is
ours to relicense. Make the distinction machine-readable per REUSE.
- LICENSES/: CC-BY-SA-4.0 and CC-BY-4.0 (canonical creativecommons.org
legalcode.txt), MIT (via `reuse download`, for the pre-existing in-file
SPDX headers under 2026-nih-bids2.0/).
- LICENSES/LicenseRef-ThirdPartyMixed.txt and
LICENSES/LicenseRef-ThirdPartyLogo.txt: two markers, NOT license
grants, for the cases the skill of provenance-archaeology cannot
reach. Their SPDX-FileCopyrightText is NOASSERTION, which asserts
ignorance rather than ownership. SPDX-License-Identifier =
"NOASSERTION" was tried first and is not viable: `reuse lint` reports
it as a missing license and fails.
- REUSE.toml: a catch-all block with precedence = "closest" (so the
existing in-file MIT headers keep winning), then the third-party
markers, then narrowing blocks for provenance we do know:
* YODA artwork <- github.com/myyoda/poster, (C) 2018 Michael Hanke and
Kyle Meyer, CC-BY-4.0 (per that repo's own REUSE.toml);
* carrot and ReproNim-containers artwork <- Michael Hanke's "Carrots!
Not sticks!", CC-BY per the author (confirmed over Matrix, 2026-10);
the adaptations deliberately stay on the upstream CC-BY-4.0 rather
than being pulled into share-alike;
* pics/datalad-handbook-yoda.png <- the DataLad handbook, itself
CC-BY-SA-4.0;
* 2026-bbqs-stamped* <- co-authored with Cody Baker.
- README.md: a "Not everything here is ours" section explaining the
markers, plus the caveat below. SOUL.md and CLAUDE.md gain pointers so
future deck-authoring annotates new borrowed assets instead of quietly
sweeping them under the repo license.
- .pre-commit-config.yaml: the reuse hook.
Caveat worth knowing: REUSE spec 3.3 excludes symlinks from "Covered
Files", so `reuse lint` skips all 282 git-annex symlinks here and checks
only 300 of 587 tracked files. Its cheerful "300 / 300" is therefore
half the story; the annotations still describe the annexed files, they
are just not machine-verified. Upstream is aware --
https://codeberg.org/fsfe/reuse-tool/issues/627 and the open PR #764,
blocked on a spec change rather than on code.
The root LICENSE is left untouched (GitHub license detection, and it is a
governance artifact); LICENSES/CC-BY-SA-4.0.txt carries the canonical
upstream text alongside it.
Co-Authored-By: Claude Code 2.1.296 / Claude Opus 5 (1M context) <noreply@anthropic.com>
The pics/borrowed/ convention was applied inconsistently over the years,
and not every borrowed file has "webshot" in its name, so a glob cannot
find them -- they have to be listed by hand. Annotated in place rather
than moved, since the decks reference them by path.
Three new groups under LicenseRef-ThirdPartyMixed:
(a) figures, tables and headers from third-party publications --
the Clunie DICOM figures, the NIfTI-1 HBM 2004 header, w3cprov,
HPW+21_fig1, datalad-decentralized (a deGruyter figure);
(b) screenshots and screen recordings of third-party sites and apps --
NEMAR, Neurosift, NWB GUIDE, OpenNeuro, nipoppy, Princeton, Google;
(c) stock imagery, clipart, cartoons and photographs of people --
several of which carry their own origin in the filename
(big-bug-svgrepo-com.svg, kattekrab_Sitting_Buddha_Silhouette.svg),
and one of which the deck itself already captioned "Unknown
artist/origin, borrowed from ..." (god-is-at-the-computer.jpg).
Also moved the third-party project marks that ended up in pics/ root
(BIDS, NeuroConv, Neurosift, NWB GUIDE, OpenNeuro, Mastodon, Twitter)
under LicenseRef-ThirdPartyLogo. Our own projects' marks -- DataLad,
DANDI, NeuroDebian, CON -- deliberately stay under the catch-all.
Two near-misses worth recording, both settled by reading the decks:
pics/joey-email.png is an email *written by* Yarik and stays ours, while
pics/arjlover-get.png is his own terminal, not the arjlover site.
Corrections to the repronim-containers block: it is mixed-copyright
throughout rather than a Hanke original with our layer bolted on.
Michael created the YODA figure without containers; the containers and
STAMPED layers, the svgtune recipe and the *_tuned/ variants it produces
are built atop it here, with no clean seam to split at. Both copyrights
apply across the whole set, svgtune recipe included.
The DataLad handbook block grew from one file to the six that are
actually handbook-derived. README has always said this repository's
content is "based on the DataLad handbook"; now it records which files
that refers to. The handbook is CC-BY-SA-4.0, same as here.
SOUL.md: tie licensing to the value it actually expresses -- the same
instinct as the acknowledgements slides (§2) and the citation blocks
(§5) -- and drop the how-to that was duplicating README and CLAUDE.md.
Its §4 asset lists are now explicitly a findability index rather than a
provenance record, and no longer imply pics/borrowed/ is exhaustive.
Every path in REUSE.toml was checked to match at least one tracked file.
Co-Authored-By: Claude Code 2.1.296 / Claude Opus 5 (1M context) <noreply@anthropic.com>
The first cut of this had the exact failure mode it was written to
prevent -- claiming copyright over other people's work -- in several
places. Every item below was verified independently before being
applied.
Claiming other people's work:
- package.json, package-lock.json and gulpfile.js at the repo root are
reveal.js 4.3.1 upstream ("license": "MIT", author Hakim El Hattab).
The catch-all resolved them to our copyright under CC-BY-SA-4.0, and
gulpfile.js worst of all: it KEPT Hakim's copyright line while flipping
his MIT code to ShareAlike. reuse does not read package.json's own
"license" field, so nothing flagged it. Now an explicit MIT block.
- The reveal.js and reveal.js-mermaid-plugin submodules (both MIT) are
matched by the catch-all glob. reuse skips submodules so lint never
noticed, but REUSE.toml is read by humans and read as a claim.
- pics/datalad_process.* and its 20 _tuned/ variants are Michael Hanke's
drawing -- every one carries inkscape:export-filename under /home/mih/,
and the path data appears verbatim in myyoda/poster's ohbm2018.svg.
- pics/stamped-yoda.svg shares 15 of 15 long path elements with
pics/yoda.svg but had been left out of the YODA block, dropping the
2018 Hanke/Meyer attribution and flipping their CC-BY to BY-SA.
- pics/data-repository-submissions.png is a PLOS Biology figure; three
decks link the original. pics/uniform_analysis.svg is a 2009 Frontiers
figure. Both to the publication-figure marker.
- The DataLad "D" and wordmark are Alex Waite's (/home/aqw/...); the
NeuroDebian mark is Hanke's (/home/michael/...). Ours as projects, not
as drawings.
- 2025-sfn-poster-data-standards.* is Zenodo 10.5281/zenodo.18333008 --
34 authors led by Oliver Ruebel, CC-BY-4.0, not ours alone.
Disclaiming work whose provenance we actually knew:
- Eight files are byte-identical (md5, checked against upstream) to
datalad-handbook/artwork or datalad-course, both CC-BY-SA-4.0:
openscience.gif, shareresearch2.gif, datalad-animated.gif,
containers-run.svg, decentral_RDM_overview.png, virtual_dirtree.png,
openneuro2.gif, borrowed/versioncontrol.svg. Marking them "unknown"
was wrong; two of them were on the uncertain list.
- Five screenshots of our own sites sit in pics/borrowed/ and were being
marked NOASSERTION, sending reusers to hunt a rights holder that is us
-- while their equivalents in pics/ root stayed under the catch-all.
- The two SfN poster crops in pics/borrowed/ were marked unknown while
the full poster at the repo root was marked ours: the same work,
annotated two contradictory ways.
Mechanism fixes:
- precedence = "override" on the six marker blocks discarded any
copyright header carried inside a borrowed file. That is backwards for
blocks whose entire purpose is admitting we do not know who owns
something -- the header is the one place the answer might be. All six
are now "aggregate".
- Only the LAST matching block is ever consulted; precedence governs
TOML-vs-in-file, not block arbitration. The header comment and
LicenseRef-ThirdPartyMixed.txt both said "narrower block wins", which
would silently fail for a narrow block added in the wrong position.
- pics/digits*.svg layer the kattekrab Buddha and svgrepo bug that this
same file marks third-party; yarik-goal.svg and con-ack-*.svg embed
borrowed rasters. Composition ours, embedded pieces not.
Docs:
- The "587 tracked files" figure was stale on arrival (593 at branch
tip) and did not add up: 587 - 282 = 305, not 300, the gap being
submodules and a zero-byte file. Reworded to drop the arithmetic.
- "the Licensing section of README.md" pointed at a heading that does
not exist.
- PR #764 upstream is a WIP draft, and the spec change is not its only
blocker; softened accordingly.
- Noted that `reuse spdx` emits NOASSERTION wrapped rather than as the
bare SPDX sentinel, so SBOM consumers may read it as a literal string.
- Pinned the README lint command to reuse==6.2.0 to match pre-commit.
- CLAUDE.md's new table row contradicted its own prose three lines down.
- Tables aligned.
One review finding was rejected on checking:
pics/con-ccn-dartmouth-letterhead.svg was reported as a Dartmouth
institutional asset, but its inkscape:export-filename points at
/home/yoh/ -- our own composition incorporating the CCN mark. Left
under the catch-all.
Still open, deliberately not actioned: the Hanke grant is recorded as
"CC-BY" without a version; pics/yoda.svg is byte-identical to the
handbook's CC-BY-SA-4.0 copy as well as deriving from the CC-BY-4.0
poster; and tools/ and .github/ remain under CC-BY-SA-4.0, which
Creative Commons advises against for software. All three are
maintainer calls, flagged in the PR test plan.
Co-Authored-By: Claude Code 2.1.296 / Claude Opus 5 (1M context) <noreply@anthropic.com>
Two maintainer decisions: - tools/ and .github/ are code, and Creative Commons advises against CC licenses for software. They move to Apache-2.0, with precedence = "closest" so the existing MIT headers under 2026-nih-bids2.0/ still win. LICENSES/Apache-2.0.txt fetched from apache.org. - The SfN poster is attributed to Oliver Ruebel, Yaroslav O. Halchenko and the Neuro* standards Community rather than enumerating all 34 authors. "CC-BY" with no version is read as the current version at the time of use, i.e. 4.0 -- which Zenodo independently records for this poster. The same reading is now written down for Michael Hanke's "CC-BY" grant, which was the open question there. From the verification review: - NOASSERTION is a whole-field SPDX sentinel, not a list element. Using it as the second entry of a copyright array produced a field that both names a holder and asserts that no assertion is made, so scanners that string-match it would classify seven files with a known holder as unknown. Replaced with prose: "... (composition)" and "Undetermined third-party rights holders (embedded elements)". - LICENSES/LicenseRef-ThirdPartyMixed.txt flatly denied that we hold any copyright in marked files, which stopped being true once our own composites started pointing at it. Now documents that exception. - pics/datalad_process_tuned_00.png sits beside the _tuned/ directory rather than inside it, so the glob missed it and it fell to the catch-all as ours -- it is a render of Hanke's drawing. - pics/con-ack-bmbf.png is a render of con-ack-bmbf.svg and carries the same embedded third-party rasters, but resolved differently from it. - The logo block's comment still claimed DataLad / DANDI / NeuroDebian marks stay under the catch-all; three of those four moved in the previous commit. Only CON does. - The submodule block matched the two gitlink entries but not the trees its own comment described. Added the /** globs: no behaviour change today, correct if either tree is ever vendored. - The handbook block now records which upstream file each addition matched, and notes what byte-identity does and does not establish -- it shows where our copy came from, not who drew it. For the three circulating open-science animations the handbook may itself have borrowed them. Also switched to "aggregate", since it now holds a file pulled out of borrowed/ whose own metadata is worth keeping. README gains a line about the code license. Co-Authored-By: Claude Code 2.1.296 / Claude Opus 5 (1M context) <noreply@anthropic.com>
Member
|
ok, this is not perfect but it is a start, and given lots of history etc, we better start annotated later than never!!! Let's see how it goes with pre-commit etc |
|
Preview removed. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The repository has always declared CC-BY-SA-4.0, but that only ever covered what we authored. Slides quote the world — screenshots of web pages and papers, figures, cartoons, funder logos — and none of that is ours to relicense. This makes the distinction machine-readable per the REUSE specification, without relicensing anything.
The interesting part is not the compliant-badge; it is how to be honest about the large pile of material whose provenance can no longer be reconstructed.
Code is not under the slide license.
tools/and.github/are Apache-2.0 — Creative Commons licenses are not meant for software, and the repo already set that precedent with MIT headers under2026-nih-bids2.0/.Two markers, not license grants.
LicenseRef-ThirdPartyMixedandLicenseRef-ThirdPartyLogocarrySPDX-FileCopyrightText = "NOASSERTION"— asserting ignorance rather than ownership.SPDX-License-Identifier = "NOASSERTION"was tried first and is not viable:reuse lintreports it as a missing license and fails.Provenance is recorded where we have it. YODA artwork ← myyoda/poster, © 2018 Michael Hanke and Kyle Meyer, CC-BY-4.0 (taken from that repo's own
REUSE.toml). Carrot and ReproNim-containers artwork ← Michael Hanke's "Carrots! Not sticks!", CC-BY per the author. Six figures ← the DataLad handbook, itself CC-BY-SA-4.0.2026-bbqs-stamped*← co-authored with Cody Baker.Important
reuse lint's cheerful300 / 300is half the story. REUSE spec 3.3 excludes symlinks and zero-byte files from Covered Files, so all 282 git-annex symlinks here are skipped; with submodules and the license files, 300 files out of roughly 590 tracked are actually checked. The annotations still describe the annexed files; they are just not machine-verified. Upstream is aware: reuse-tool#627 (open since 2022, explicitly about git-annex/DataLad) and the long-stalled draft PR #764, which needs a specification change before it can land. This is called out inREADME.mdand at the top ofREUSE.tomlso nobody reads the badge as more than it says.How REUSE.toml is structured
Only the last matching block is consulted for a given file.
precedencedoes not arbitrate between blocks — it decides how a block combines with copyright/licensing found inside the file:path = "**"→ © 2022-2026 Yaroslav O. Halchenko, CC-BY-SA-4.0,precedence = "closest"so pre-existing in-file SPDX headers under2026-nih-bids2.0/keep winning (verified: thatMakefilestill resolves to MIT).pics/borrowed/**,3rd-party/**,pics/con-whoweare/**(portraits of other people), and an explicit list of borrowed material inpics/root. These useaggregate, notoverride: if a borrowed file does carry a header, that is the one place its provenance might be recorded, and discarding it is backwards for a block that exists to say "we don't know who owns this".The
pics/borrowed/convention was applied inconsistently over the years, and not every borrowed file haswebshotin its name, so a glob cannot find them — they are listed by hand, in three groups: third-party publication figures; screenshots of third-party sites and apps; stock imagery, clipart, cartoons and photographs of people. Annotated in place rather than moved, since the decks reference them by path.Our own projects' marks — DataLad, DANDI, NeuroDebian, CON — deliberately stay under the catch-all rather than going under the logo marker.
Near-misses, settled by reading the decks
pics/joey-email.pngis an email written by Yarik to Joey Hess — ours, stays under the catch-all. The filename suggests otherwise.pics/arjlover-get.pngis his own terminal; the actual arjlover website shot is a separate file.pics/god-is-at-the-computer.jpgis captioned "Unknown artist/origin, borrowed from ..." in2022-nih-compcore.html— the mixed marker's case exactly.What three rounds of review changed (the interesting part)
The first draft of this change had the failure mode it was written to prevent. Review caught it; all of the below was verified independently before being applied.
Claiming other people's work.
package.json,package-lock.jsonandgulpfile.jsat the repo root are reveal.js 4.3.1 upstream ("license": "MIT", author Hakim El Hattab). The catch-all resolved them to © Halchenko / CC-BY-SA-4.0 — andgulpfile.jsworst of all: it kept Hakim's copyright line while flipping his MIT code to ShareAlike.reusedoes not readpackage.json'slicensefield, so nothing flagged it. Now an explicit MIT block, plus a carve-out naming thereveal.js/reveal.js-mermaid-pluginsubmodules (both MIT).Michael Hanke's work under our copyright.
pics/datalad_process.*and its 20_tuned/variants all carryinkscape:export-filename="/home/mih/psycho/talks/...", and the path data appears verbatim inmyyoda/poster.pics/stamped-yoda.svgshares 15 of 15 long path elements withpics/yoda.svgbut had been left out of the YODA block. Both now carry the dual attribution.Eight files byte-identical to upstream.
openscience.gif,shareresearch2.gif,datalad-animated.gif,containers-run.svg,decentral_RDM_overview.png,virtual_dirtree.png,openneuro2.gifandborrowed/versioncontrol.svgmd5-matchdatalad-handbook/artworkordatalad-course(CC-BY-SA-4.0). Their provenance was known all along, so marking them unknown was wrong.The SfN poster is not ours alone. Zenodo 10.5281/zenodo.18333008 — 34 authors led by Oliver Rübel, CC-BY-4.0. The repo-root copies were under our catch-all; the two crops in
pics/borrowed/were marked unknown. Both wrong, in opposite directions.Marks drawn by other people. The DataLad "D" and wordmark are Alex Waite's (
/home/aqw/...); the NeuroDebian mark is Hanke's (/home/michael/...). Ours as projects, not as drawings.Our own work marked "not ours". Five screenshots of our own sites sitting in
pics/borrowed/were sending reusers to hunt for a rights holder that is us.Compositions over borrowed pieces.
digits*.svglayer the kattekrab Buddha and the svgrepo bug — both already marked third-party — under our own elements.yarik-goal.svgand thecon-ack-*figures embed borrowed rasters. Now carry both our copyright andNOASSERTION.One reviewer finding was rejected on checking:
con-ccn-dartmouth-letterhead.svgwas reported as a Dartmouth institutional asset, but itsinkscape:export-filenamepoints at/home/yoh/— Yarik's own composition incorporating the CCN mark. Left under the catch-all.Docs, and where each thing lives
README.mdCLAUDE.mdREUSE.toml, and when it does notSOUL.mdThe root
LICENSEis left untouched (GitHub license detection, and it is a governance artifact);LICENSES/CC-BY-SA-4.0.txtcarries the canonical creativecommons.org text alongside it.Test plan
uvx --from reuse reuse lint→ compliant with REUSE 3.3,300 / 300, no unused/missing licensesREUSE.tomlverified to match at least one tracked file (a typo would silently annotate nothing)reuse spdx— overrides land, andprecedence = "closest"lets the existing in-file MIT headers winLICENSES/*.txtandREUSE.tomlconfirmed to land in git, not annex (.gitattributesannexes binary only)tools/**and.github/**moved to Apache-2.0 (maintainer decision)pics/yoda.svgis byte-identical to the handbook's CC-BY-SA-4.0 copy as well as deriving from the CC-BY-4.0 poster. Currently CC-BY-4.0, following the original grant — worth a second opinion.pics/bids-yoda.pngcould not be checked (annex content absent); it name-matches the YODA family but is under the catch-all. Verify with content present, or confirm it is not derived.pics/rerun.{svg,png,pdf},survive5+-whatisyour1.png,bep028-example1.pngreusepre-commit hook is wanted; it runs on every commit and is trivially droppable if not🤖 Generated with Claude Code