reuse-tool VS scancode-toolkit

The SPDX header is due to a project called REUSE, which is spearheaded by the FSF Europe. You can read more about the project here. Basically you just have to add the copyright header in the format

I do add my personalized input data into the public repository where I upload my solutions. I add complete reuse-compatible licensing information to my files.

For projects that include vendored libraries under different licenses, it is becoming common to use Debian's copyright file format to describe which licenses apply to which source files. The data is usually placed in a file called /.reuse/dep5 (see the FSFE's Reuse Software project). If you want to enable fine-grained license checks, you can also include a machine-readable SPDX-License-Identifier line in each file.

Check out https://reuse.software

Putting the copyright and licensing information in every file was very common, and FSFEs reuse has some interesting specifications if compliance is an issue (e.g. I do not fully understand what the OpenSSL license included in the app-ios/tutanota/include folder covers, which also includes a APL-licensed files) - but thats a different topic.

No, but it's a good idea to mention the license you're using. You can use REUSE (https://github.com/fsfe/reuse-tool).

Hey, pabs3! Actually this is not using a rolling checksum for detection but rather a combo of language model, checksums, automatons, bitvectors, inverted indexes and multiple sequences alignment (e.g. a specialized diff). I put some docs there to explain the approach at ahttps://github.com/nexB/scancode-toolkit/blob/develop/src/li...

If you're concerned about licensing in your dependencies, use a license scanner like scancode toolkit. Similar scanners are available in products like JFrog Artifactory or GitLab (paid versions)