11

Example

GPL v3 Project, MIT (ExPat) file/directory.

myproject ├── LICENSE (GPL v3) ├── ... ├── gpl_licensed_file ├── mit_licensed_directory │   └── mit_file1 └── mit_licensed_file

So If I were looking at this project, I would have on way to know that mit_licensed_directory and mit_licensed_file were not under the primary License declared in LICENSE.

How do I denote when a file or directory is not using the same license as the rest of the project?

Improve this question
1
  • The clearest way is to note the license in the file header. Commented Mar 30, 2016 at 2:08

2 Answers 2

Reset to default
8

There are no hard-and-fast rules on how to show this information. The bottom line is to make sure recipients can easily figure out which files are under which license. You also need to preserve copyright notices, where required. This is a common requirement of many licenses, but most licenses do not dictate where those notices are kept, only that, again, recipients can easily figure out which files correspond to those copyright notices.

So I'd like to refer to best practices instead. There's a good article provided by the SFLC which covers this, Managing copyright information within a free software project:

Best practices for maintaining license information

License information can also be maintained in individual files, in a central location, or in some combination of both. Most projects use a hybrid approach, placing the primary license in a top-level COPYING or LICENSE file, and also including some license information in each file’s header.

So the two approaches are (and most projects use both):

  • Information in individual files (i.e. Copyright 20XX Jane Hacker under Foobar License at the top of files)
  • In a central location, usually a top-level COPYING or LICENSE file

These are all best practices, not requirements. For example, you do not have to have a top-level COPYING/LICENSE file, the same information could be in the readme. Note that some licenses require that you provide the full text of the license, but again that doesn't have to be named COPYING or LICENSE.

The article does recommend the central location approach though, as it makes it easy to know the full licensing information at one place:

In many situations, a semi-centralized approach will work best. Consider a GPL-licensed project whose codebase contains a number of permissively-licensed libraries with custom modifications. While the license of the resulting program will be GPL, because of GPL’s copyleft provision, the source for the libraries can be maintained under their individual licenses. In this scenario, it makes sense to keep license information for the individual libraries at the top level of the directories they’re kept in, as well as in the license information for the entire project.

That is:

  • Maintain a top-level file describing the licensing of the entire project, i.e. which parts are under which licenses
  • Under each directory that contains a sub-project under a different license, maintain a file there describing the licensing of that sub-project

So your example project might look like this:

myproject ├── LICENSE ├── GPLv3.LICENSE ├── ... ├── gpl_licensed_file ├── mit_licensed_directory │ ├── LICENSE (MIT) │ └── mit_file1 └── mit_licensed_file

Where the top-level LICENSE file contains something like:

myproject is licensed under GPLv3, except for mit_licensed_directory and mit_licensed_file

Improve this answer
2

REUSE provides a standardized way for declaring the license of each file. To use REUSE in your hypothetical project, here’s what you would do:

  1. Create a folder called LICENSES.
  2. Move the LICENSE file into the LICENSES folder. Name it GPL-3.0-only.txt. The name should be an SPDX license identifier.
  3. Put a copy of the MIT license in the LICENSES folder. Name it MIT.txt (See here for caveats).
  4. At the top of each GPL licensed file, put
SPDX-FileCopyrightText: [year] [copyright holder] <[email address]> SPDX-License-Identifier: GPL-3.0-only
  1. At the top of each MIT licensed file, put
SPDX-FileCopyrightText: [year] [copyright holder] <[email address]> SPDX-License-Identifier: MIT
  1. To license an entire directory (without including metadata in each file), use a DEP5 file.
Improve this answer
3
  • 1
    Would you actually release source code with just those two lines as the only licensing statement? I do not see those two lines as meeting the legal requirement that licensing be easily discerned. Or are you using some tool to swap in the text of the licenses? (I find that REUSE website befuddling.) Commented Oct 29 at 3:09
  • 1
    I always include a copying.md file in the source code that says “This repo complies with this specific version of the REUSE Specification.” I also include the output of reuse spdx with binary releases to make sure that all required legal notices are present. AFAIK, the REUSE project doesn’t recommend doing either of those things. They’re just things that I do. I’ve never heard of a legal requirement that licensing be easily discerned, but you may want to point that issue out to the REUSE project here: github.com/fsfe/reuse-website/issues Commented Oct 30 at 10:19
  • Regarding the legal aspect of a license being easily discerned, "Innocent Infringement" is one defense against an allegation of copyright violation. The violator argues they had no reason to believe their actions constituted infringement. While under the Berne Convention copyright is established by default, clearly asserting your copyright claim can avoid problems. See here and here. (Caveat: I am not an attorney.) Having a global licensing statement may be the key. Commented Oct 30 at 21:50

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.