I would like to propose adding an optional ‘file’ attribution to the license tag in package.xml.
The motivation here is that some OSS licenses require provision of license text when a user redistribute the software in a binary form, but currently it’s not easy to find it because we have to grep all the source codes. I think adding the file attribution to point the right license text file in a repository will help a user or a tool to do this easier.
I have made a PR to update REP-149 which is the candidate of the next package.xml format. Please review and comment on the PR if you have any concern or better idea.