REUSE.toml

version = 1
SPDX-PackageName = "trinity"
SPDX-PackageSupplier = "Sudo Apt Holdings LLC"
SPDX-PackageDownloadLocation = "https://github.com/ScriptKittyOS/Trinity"

# Files that carry their own SPDX header are not listed here. This file covers only what
# cannot hold a comment, or what is vendored and must keep its upstream licence.
#
# ADR-0012 decision 1 requires SPDX headers, REUSE and DCO from commit 1. Commit 1 carried
# LICENSE, NOTICE and DCO but neither headers nor this file; slice 000 closes that gap, and
# the gap is recorded rather than glossed.

[[annotations]]
path = ["mix.lock", "src-tauri/Cargo.lock", "**/*.md", "**/*.json", "**/*.tsv", "**/*.cff", "**/*.toml", ".tool-versions", ".gitignore", ".sobelow-skips", ".sobelow-skips.reasons", "priv/name_digests.txt", ".formatter.exs", "test/support/*.txt"]
precedence = "aggregate"
SPDX-FileCopyrightText = "Sudo Apt Holdings LLC"
SPDX-License-Identifier = "Apache-2.0"

[[annotations]]
path = ["assets/vendor/**", "priv/static/**"]
precedence = "override"
SPDX-FileCopyrightText = "Upstream authors; vendored unmodified"
SPDX-License-Identifier = "MIT"

# Slice 120. Files that cannot carry a comment, or that came from somewhere else. Each block says
# whose the files are; the second one is the reason this slice existed.

[[annotations]]
path = [".dockerignore", ".githooks/commit-msg", "src-tauri/.gitignore", "priv/gettext/**", "docs/assets/**", "docs/fips-leg/**", "test/support/mcp/*.txt", "NOTICE"]
precedence = "aggregate"
SPDX-FileCopyrightText = "Sudo Apt Holdings LLC"
SPDX-License-Identifier = "Apache-2.0"

# **Not ours.** `src-tauri/icons/*` is the output of `mix ex_tauri.install`, which copies Tauri's
# template icons; the commit that added them says so ("the generator's output, nothing else",
# 2026-09-06). Claiming them for Sudo Apt Holdings would have been a false copyright notice in a
# file whose whole purpose is to state copyright accurately, and a REUSE audit that assigned every
# uncovered file to this project would have produced exactly that. Tauri is dual licensed, so the
# expression is the one its own sources carry.
[[annotations]]
path = ["src-tauri/icons/**"]
precedence = "override"
SPDX-FileCopyrightText = "Tauri Programme within The Commons Conservancy"
SPDX-License-Identifier = "MIT OR Apache-2.0"

# `root.html.heex`. The heex formatter joins the last comment on the line onto `<!DOCTYPE html>`,
# so a tag there is parsed as `Apache-2.0 --%> <!DOCTYPE html>`, which is not a licence expression.
# Measured: putting the doctype on its own line, with or without a blank line, is undone by
# `mix format` every time; the sibling `consent.html.heex` has the identical header and passes only
# because nothing follows it. The file's own tags are wrapped in `REUSE-IgnoreStart`/`IgnoreEnd`
# there, so the tool does not read them, and the annotation below is what it reads instead. The
# tags stay in the file because a reader opening it should still see them, and the marker that now
# takes the doctype's company carries no meaning to break.
[[annotations]]
path = ["lib/trinity_web/components/layouts/root.html.heex"]
precedence = "aggregate"
SPDX-FileCopyrightText = "Sudo Apt Holdings LLC"
SPDX-License-Identifier = "Apache-2.0"

# Slice 132. **Not ours either.** The identifier lists the control mapping is checked against are
# derived from NIST's OSCAL catalogues (`usnistgov/oscal-content`), which that repository dedicates
# to the public domain under CC0 1.0; each file's header names the commit and the SHA-256 of the
# catalogue it came from, and `scripts/nist_catalogues.exs` re-derives them. The `**/*.tsv` line
# above would otherwise assign them to this project.
[[annotations]]
path = ["test/support/fixtures/nist/**"]
precedence = "override"
SPDX-FileCopyrightText = "National Institute of Standards and Technology"
SPDX-License-Identifier = "CC0-1.0"

# Slice 137. **Not ours.** The ML-DSA-87 known-answer vectors the boot preflight checks against.
# `priv/kat/acvp/` is one case from NIST's ACVP-Server (`usnistgov/ACVP-Server`), a work of the US
# Government, annotated CC0-1.0 as the NIST catalogues above are. `priv/kat/wycheproof/` is three
# cases from C2SP's Wycheproof, Apache-2.0. Each file names its source commit and the SHA-256 of the
# file it was cut from. The `**/*.json` line above would otherwise assign them to this project.
[[annotations]]
path = ["priv/kat/acvp/**"]
precedence = "override"
SPDX-FileCopyrightText = "National Institute of Standards and Technology"
SPDX-License-Identifier = "CC0-1.0"

[[annotations]]
path = ["priv/kat/wycheproof/**"]
precedence = "override"
SPDX-FileCopyrightText = "Google LLC and the C2SP Wycheproof contributors"
SPDX-License-Identifier = "Apache-2.0"

# Slice 138. The N6 vectors `scripts/n6_vectors.exs` writes: CBOR, diagnostic notation and expected
# outcomes, none of which can carry a comment. The RFC 8949 Appendix A encodings among them are
# credited in each vector's description. The thumbprint vector's public key is NIST's, the ACVP
# case under `priv/kat/acvp/` above, and is annotated as that file is.
[[annotations]]
path = ["test/fixtures/n6/**"]
precedence = "aggregate"
SPDX-FileCopyrightText = "Sudo Apt Holdings LLC"
SPDX-License-Identifier = "Apache-2.0"

[[annotations]]
path = ["test/fixtures/n6/thumbprint/*.pub"]
precedence = "override"
SPDX-FileCopyrightText = "National Institute of Standards and Technology"
SPDX-License-Identifier = "CC0-1.0"