licensing

licensing

Make what a repository says about its license true, consistent and complete. This is engineering hygiene, not legal advice: when money, a contract, a company policy or a dispute is involved, say so and tell the user to ask a lawyer.

Ground rules

• Never change a license or a copyright holder without asking. Relicensing is the author's decision, and code from other contributors may need their consent.
• Never remove or edit someone else's copyright or license notice. Add to notices; do not rewrite them.
• Never edit the license text itself. Tools detect licenses by matching the exact text. Fill in only the copyright line ([year] [fullname] in MIT).
• Do not push, publish or open pull requests unless the user asked for that exact action.
• Report what you did not check. A clean manifest scan says nothing about dependency licenses.

1. Find what the repository declares

A license is declared in three places, and they must agree:

ls LICENSE* COPYING* NOTICE* 2>/dev/null
grep -iE '^\s*copyright' LICENSE*
grep -niE '^#+ *licen[cs]e' -A3 README.md
grep -rnE --include=package.json '"license"\s*:' . | grep -v node_modules
grep -rnE --include=pyproject.toml '^license\s*=' .
grep -rnE --include=Cargo.toml '^license\s*=' .

For a GitHub org, check every repo that is not a fork:

gh repo list <org> --source --limit 200 --json name --jq '.[].name' |
  while read -r r; do
    echo "$r $(gh api repos/<org>/$r/license --jq .license.spdx_id 2>/dev/null || echo NONE)"
  done

Skip forks: they carry their upstream's license and are not the user's to relicense.

Flag each of these:

• No license file. Public code without a license is "all rights reserved": others may view and fork it on GitHub, but may not copy, change or reuse it.
• The three places disagree (README says MIT, LICENSE is Apache-2.0, manifest is empty).
• A copyright line naming someone else, often left over from copying another project's file.
• A manifest with no license field. Private packages too: scanners read the manifest, not the README.
• A non-SPDX value such as "MIT License" or "Apache 2". Use MIT, Apache-2.0, BSD-3-Clause, GPL-3.0-only, GPL-3.0-or-later, MPL-2.0, ISC.
• npm's default "ISC" left in a project that is actually MIT.

2. Choose a license (new projects only)

Ask the user if they have not said. Offer this default:

Get the canonical text instead of typing it:

gh api licenses/mit --jq .body > LICENSE        # then fill in [year] [fullname]
gh api licenses/apache-2.0 --jq .body > LICENSE

3. Declare it everywhere

1. LICENSE at the repository root, canonical text, copyright line filled in.

2. README, as the last section:

   ## License
   
   [MIT](LICENSE) © 2026 Your Name

3. Every manifest:

   # pyproject.toml (PEP 639: needs hatchling >= 1.27 or setuptools >= 77)
   [project]
   license = "MIT"

   // package.json, even when "private": true
   "license": "MIT"

   Use "UNLICENSED" in package.json only for code that is genuinely not licensed to anyone.

4. Keep the line endings and formatting the files already use, so the diff is only the license.

4. Copying code from another project

Before copying, read the source project's license. Then:

Record each copy in a NOTICE file or docs/third-party-notices.md: what was copied, from where (repository URL and commit), under which license, and what you changed. See references/compatibility.md for which licenses can be combined.

5. Fonts, icons and logos

Assets have licenses too, and names and logos are also trademarks, which no software license grants.

• Fonts: most open fonts use the SIL Open Font License. Ship its license file next to the font files (for example fonts/OFL-Inter.txt). Modified versions may not use the font's reserved name.
• Icon sets: check the set's license (Lucide is ISC, Heroicons is MIT, Simple Icons is CC0) and keep it in your third-party notices.
• Logos of other products: use them only to identify that product. Say who owns the mark, that the project is not official or endorsed, and where the file came from. If the source repository has no license, use the logo only for identification and offer to remove it on request.

A good NOTICE entry for a logo:

app/public/logos/ contains the logos of Example DB and Example Cloud. They are
trademarks of their owners, used only to identify the systems this project
works with. This project is not official and is not endorsed by either.

6. Dependencies

Dependencies stay under their own licenses. You must comply when you distribute them, which includes Docker images, bundled frontends and vendored code.

npx --yes license-checker-rseidelsohn --summary          # Node
uvx pip-licenses --from=mixed --order=license             # Python (run inside the project's venv)
go-licenses report ./...                                  # Go
cargo deny check licenses                                 # Rust (needs a deny.toml)

Flag for the user, with the package name and version:

• GPL-*, AGPL-*, LGPL-* in anything you ship.
• AGPL in a hosted service: if you modify an AGPL program and let users reach it over a network, you must offer them its source. Running an unmodified AGPL server next to your app does not put your app under AGPL.
• SSPL-1.0, BUSL-1.1, Elastic-2.0, "Commons Clause": source-available, not open source, with limits on commercial or hosted use.
• UNKNOWN, UNLICENSED, or no license at all.

7. Report

Licensing: <repo or org>

Declared:   <license> in LICENSE · README · <n> manifests   (or what disagrees)
Fixed:      <file>: <change>
Needs you:  <decision> - <why it is the user's call>
Not checked: <what was out of scope, e.g. dependency licenses>