Draft: Upgrade to reuse 4.0.3

[jonathanpallant]

• Updated requirements file
• Ran reuse convert-dep5 to switch to new file format

No further changes were made to the new REUSE.toml file - I suspect some clean-ups will be required.

I verified that COPYRIGHT.md continues to build, but it has different contents.

[pietroalbini]

Looks good, but we should evaluate whether to change precedence = "aggregate", since that is most likely wrong.

[jonathanpallant]

I'll read up on precedence, and make the TOML look nice.

[jonathanpallant]

Precedence:

• closest, the default value when precedence is not defined. This is an instruction to associate the Licensing Information inside of the Covered Files (or its adjacent .license file), if available. If no such Licensing Information is found, then the Licensing Information inside the table of the closest REUSE.toml that covers the File is associated. This algorithm is applied separately for copyright and for licensing. If a table for the same File in a closer REUSE.toml file has the override precedence, then that precedence is applied, and closest is ignored. This is effectively a fallback.
• aggregate. This is an instruction to always associate the Licensing Information defined in the table with the table’s Covered Files. Subsequently, the closest logic is also applied.
• override. This is an instruction to associate the Licensing Information defined in the table with the table’s Covered Files, and to ignore any other Licensing Information that is closer to the Files. The table in the REUSE.toml that is the closest to the root of the Project is authoritative.

Previously we used reuse-tool 1.1.0 in CI, which implemented REUSE 3.0. That did not feature a precedence option. Also, that version wouldn't actually work and we got an error saying:

Note that Rust requires some REUSE features that might not be present in the
release you're using. Make sure your REUSE release includes these PRs:

 - https://github.com/fsfe/reuse-tool/pull/623

If you use reuse-tool 2.0, you get errors like:

Copyright and licensing information for 'src/llvm-project/mlir/lib/Analysis/Liveness.cpp' have been found in 'src/llvm-project/mlir/lib/Analysis/Liveness.cpp' and the DEP5 file located at '.reuse/dep5'. The information in the DEP5 file has been overridden. Please ensure that this is correct.

I assume therefore that the original plan was to have the DEP5 file override the contents of the file, and so override seems like the correct answer here - although that requires we maintain the REUSE.toml file carefully. Perhaps only the LLVM sub-tree should be override?

As a test, I set everything to override and the COPYRIGHT.md file was unchanged.

Edit: I do actually have to re-install reuse 4.0 :)

[jonathanpallant]

OK, aggregate is a bad choice, because reuse-tool doesn't really understand source code.

> > > **`peek-poke-derive`**  
> > > License: `Apache-2.0 OR MIT`  
> > > Copyright: The Rust Project Developers (see https://thanks.rust-lang.org)
> > > 
> > > *Exceptions:*
> > > 
> > > > **`LICENSE-APACHE`**  
> > > > License: `Apache-2.0 OR MIT`  
> > > > Copyright: License. Subject to the terms and conditions of  
> > > > Copyright: The Rust Project Developers (see https://thanks.rust-lang.org)

I'll set it to override.

[jonathanpallant]

Opened rust-lang#127923