Hi,
Am 11.01.24 um 14:29 schrieb Carmen Bianca BAKKER:
For projects that vendor 3rd-party code, for which REUSE isn't incredibly well-suited, that may or may not be the case. Specifically, REUSE doesn't convey some of the metadata contained within that file, chiefly the name of the component.
While I am looking forward to the upcoming features you are working on, I would not underestimate the already existing value of REUSE here because of the "Comment:" key. We decided to use REUSE for our projects also because of this as a side effect.
As you can add additional stanzas when using multiple licenses and/or third-party components in the same project, this is good enough for nearly all of our projects by pointing to the dep5, especially in combination with highlighting top contributions/third parties for the sake of politeness.
A THIRDPARTY.md is no better and the effort to maintain it in parallel not worth the effort (IMHO).
SAP's OpenUI5 .reuse/dep5 file[1] is a good real-world example of how to do so with many third-party libraries and good usage of "Comment:" (even though they generate it with additional tooling).
[1] https://github.com/SAP/openui5/blob/26f313e55bc88229623d8437f2a85855f9aadd65/.reuse/dep5#L297-L300