【开源许可与版权工程】开源许可证实操手册：从选型到发布

# Apache-2.0
curl -o LICENSE https://www.apache.org/licenses/LICENSE-2.0.txt

# GPL-3.0
curl -o LICENSE https://www.gnu.org/licenses/gpl-3.0.txt

# LGPL-3.0
curl -o COPYING.LESSER https://www.gnu.org/licenses/lgpl-3.0.txt

# MIT（SPDX 托管版本）
curl -o LICENSE https://spdx.org/licenses/MIT.txt

# MulanPSL-2.0
curl -o LICENSE https://license.coscl.org.cn/MulanPSL2/license.txt

// SPDX-License-Identifier: Apache-2.0
// SPDX-FileCopyrightText: Copyright (c) 2024-2026 Example Corp.
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//     http://www.apache.org/licenses/LICENSE-2.0

# SPDX-License-Identifier: Apache-2.0
# SPDX-FileCopyrightText: Copyright (c) 2024-2026 Example Corp.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0

#!/usr/bin/env bash
# SPDX-License-Identifier: Apache-2.0
# SPDX-FileCopyrightText: Copyright (c) 2024-2026 Example Corp.

# SPDX-License-Identifier: Apache-2.0
# SPDX-FileCopyrightText: Copyright (c) 2024-2026 Example Corp.
---
apiVersion: apps/v1
kind: Deployment

<!--
SPDX-License-Identifier: Apache-2.0
SPDX-FileCopyrightText: Copyright (c) 2024-2026 Example Corp.
-->

<!--
SPDX-License-Identifier: Apache-2.0
SPDX-FileCopyrightText: Copyright (c) 2024-2026 Example Corp.
-->

# SPDX-License-Identifier: Apache-2.0
# SPDX-FileCopyrightText: Copyright (c) 2024-2026 Example Corp.
FROM ubuntu:24.04

// SPDX-License-Identifier: Apache-2.0
// SPDX-FileCopyrightText: Copyright (c) 2024-2026 Example Corp.
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//     http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

package example

// SPDX-License-Identifier: MIT OR Apache-2.0
// SPDX-FileCopyrightText: Copyright (c) 2024-2026 Example Corp.

//! 模块文档注释放在 SPDX 头之后。

# 安装
pip install reuse

# 检查仓库合规性
reuse lint

# 为某个文件批量添加 SPDX 头（--force-dot-license 跳过二进制）
reuse annotate --license Apache-2.0 --copyright "Copyright (c) 2026 Example Corp." \
    src/**/*.go

# 生成 REUSE SPDX SBOM
reuse spdx -o sbom.spdx

# 使用 addlicense 批量更新年份（-y 不指定则使用当前年份）
go install github.com/google/addlicense@latest
addlicense -c "Example Corp." -l apache -y 2020-2026 ./...

git log --format='%aN <%aE>' | sort -u > CONTRIBUTORS

# 安装 go-licenses
go install github.com/google/go-licenses@latest

# 生成 CSV 报告
go-licenses report ./... > third_party_licenses.csv

# 直接保存所有依赖 LICENSE 文本
go-licenses save ./... --save_path=./third_party/

# 检查是否有禁止的协议（如 GPL）
go-licenses check ./... --allowed_licenses=MIT,Apache-2.0,BSD-2-Clause,BSD-3-Clause,ISC

# 安装
npm install -g license-checker

# 生成 JSON 报告
license-checker --production --json > licenses.json

# 生成 Markdown 格式的第三方声明
license-checker --production --markdownTable > THIRD_PARTY_NOTICES.md

# 只允许指定协议（CI 检查用）
license-checker --production \
  --onlyAllow "MIT;Apache-2.0;BSD-2-Clause;BSD-3-Clause;ISC;0BSD;CC0-1.0;CC-BY-3.0;CC-BY-4.0"

pip install pip-licenses

# 生成 Markdown 格式
pip-licenses --format=markdown --with-urls --with-description \
  --output-file=THIRD_PARTY_NOTICES.md

# 仅列出非 MIT/Apache 协议（用于审查）
pip-licenses --fail-on="GPL;LGPL;AGPL" --format=plain-vertical

# 安装 cargo-about
cargo install cargo-about

# 初始化配置
cargo about init

# 生成 HTML 报告
cargo about generate about.hbs > THIRD_PARTY_NOTICES.html

# 生成 JSON
cargo about generate --format json > licenses.json

[accepted]
licenses = [
    "MIT",
    "Apache-2.0",
    "BSD-2-Clause",
    "BSD-3-Clause",
    "ISC",
    "Unicode-DFS-2016",
    "CC0-1.0",
]

[ignored.crates]
# 忽略只在 dev 环境用的 crate
criterion = "*"

<!-- pom.xml 中添加 license-maven-plugin -->
<plugin>
    <groupId>org.codehaus.mojo</groupId>
    <artifactId>license-maven-plugin</artifactId>
    <version>2.3.0</version>
    <configuration>
        <outputDirectory>${project.build.directory}</outputDirectory>
        <thirdPartyFilename>THIRD_PARTY_NOTICES.txt</thirdPartyFilename>
        <failIfWarning>true</failIfWarning>
        <includedLicenses>
            <includedLicense>Apache-2.0</includedLicense>
            <includedLicense>MIT</includedLicense>
            <includedLicense>BSD-2-Clause</includedLicense>
            <includedLicense>BSD-3-Clause</includedLicense>
        </includedLicenses>
    </configuration>
    <executions>
        <execution>
            <id>aggregate-add-third-party</id>
            <goals>
                <goal>aggregate-add-third-party</goal>
            </goals>
            <phase>generate-resources</phase>
        </execution>
    </executions>
</plugin>

# 使用 syft 扫描镜像并生成 SBOM
syft myimage:latest -o spdx-json > sbom.spdx.json

# 使用 ort（OSS Review Toolkit）分析整个项目
ort analyze -i . -o ort-results/
ort report -i ort-results/analyzer-result.yml \
  -o ort-reports/ -f PlainTextTemplate

# libcurl

- **来源**：https://curl.se/libcurl/
- **版本**：8.6.0（commit: a8e5f3b）
- **许可证**：curl License（MIT 风格），见 LICENSE 文件
- **修改内容**：
  - 移除了 FTP 协议支持（`lib/ftp.c` 已删除）
  - 在 `lib/url.c` 中增加了对 IPv6 zone ID 的处理（见 patch/ipv6-zoneid.patch）
- **上游状态**：修改未提交上游

> 根据 curl License，修改内容须保留原始 Copyright 声明和免责声明。

// SPDX-License-Identifier: Apache-2.0
// SPDX-FileCopyrightText: Copyright (c) 2024-2026 Example Corp.
//
// This file has been modified from the original source.
// Original source: https://github.com/original/repo
// Modifications:
//   - 2025-03-01: Added IPv6 zone ID support (Author: Bob Chen)
//   - 2026-01-15: Removed FTP protocol (Author: Alice Wang)

# 生成 THIRD_PARTY_NOTICES.txt
go-licenses report ./... --template=third_party_notices.tpl \
  > THIRD_PARTY_NOTICES.txt

# 自定义模板 third_party_notices.tpl（Go text/template 语法）
# {{range .}}
# ================================================================
# {{.Name}} {{.Version}}
# License: {{.LicenseID}}
# URL: {{.LicenseURL}}
# {{end}}

# 生成 LICENSES.txt（包含完整 LICENSE 文本）
license-checker --production --csv > licenses.csv
license-checker --production --out THIRD_PARTY_NOTICES.txt \
  --customFormat '{"name":"","version":"","licenses":"","copyright":"","licenseText":""}'

# 生成 about.html（包含每个 crate 的 LICENSE 全文）
cargo about generate about.hbs

# 简洁 text 格式（需自定义模板 about.hbs）

mvn license:aggregate-add-third-party
# 输出文件位置：target/generated-sources/license/THIRD-PARTY.txt

pip-licenses --format=plain-vertical \
  --with-license-file \
  --output-file=THIRD_PARTY_NOTICES.txt

# syft 扫描并生成 SPDX SBOM
docker pull myimage:latest
syft myimage:latest -o spdx-json=sbom.spdx.json

# 从 SBOM 提取协议信息
cat sbom.spdx.json | jq '[.packages[] | {name:.name, version:.versionInfo, license:.licenseConcluded}]'

# .github/workflows/license-check.yml
name: License Check

on:
  pull_request:
    paths:
      - 'go.mod'
      - 'go.sum'
      - '**/*.go'

jobs:
  license-check:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Set up Go
        uses: actions/setup-go@v5
        with:
          go-version: '1.22'

      - name: Install go-licenses
        run: go install github.com/google/go-licenses@latest

      - name: Check allowed licenses
        run: |
          go-licenses check ./... \
            --allowed_licenses=MIT,Apache-2.0,BSD-2-Clause,BSD-3-Clause,ISC,0BSD,\
          MPL-2.0,CC0-1.0,Unlicense,BlueOak-1.0.0

      - name: Generate THIRD_PARTY_NOTICES
        run: |
          go-licenses report ./... > THIRD_PARTY_NOTICES.txt
          git diff --exit-code THIRD_PARTY_NOTICES.txt || \
            (echo "THIRD_PARTY_NOTICES.txt is outdated, run: go-licenses report ./... > THIRD_PARTY_NOTICES.txt" && exit 1)

# .github/workflows/license-check.yml
name: License Check

on:
  pull_request:
    paths:
      - 'package.json'
      - 'package-lock.json'

jobs:
  license-check:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Set up Node
        uses: actions/setup-node@v4
        with:
          node-version: '20'

      - run: npm ci

      - name: Check licenses
        run: |
          npx license-checker --production \
            --onlyAllow "MIT;Apache-2.0;BSD-2-Clause;BSD-3-Clause;ISC;0BSD;\
          CC0-1.0;CC-BY-3.0;CC-BY-4.0;BlueOak-1.0.0;Python-2.0" \
            --excludePrivatePackages \
            --excludePackages "my-private-package"

      - name: Generate THIRD_PARTY_NOTICES
        run: |
          npx license-checker --production --markdownTable \
            > THIRD_PARTY_NOTICES.md
          git diff --exit-code THIRD_PARTY_NOTICES.md || \
            (echo "THIRD_PARTY_NOTICES.md outdated" && exit 1)

# .github/workflows/license-check.yml
name: License Check

on:
  pull_request:
    paths:
      - 'Cargo.toml'
      - 'Cargo.lock'

jobs:
  license-check:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Install cargo-deny
        uses: taiki-e/install-action@cargo-deny

      - name: Check licenses with cargo-deny
        run: cargo deny check licenses

      - name: Install cargo-about
        run: cargo install cargo-about

      - name: Generate notices
        run: |
          cargo about generate about.hbs > THIRD_PARTY_NOTICES.html
          git diff --exit-code THIRD_PARTY_NOTICES.html || \
            (echo "THIRD_PARTY_NOTICES.html outdated" && exit 1)

[licenses]
allow = [
    "MIT",
    "Apache-2.0",
    "Apache-2.0 WITH LLVM-exception",
    "BSD-2-Clause",
    "BSD-3-Clause",
    "ISC",
    "Unicode-DFS-2016",
    "CC0-1.0",
    "0BSD",
]
deny = [
    "GPL-2.0",
    "GPL-3.0",
    "AGPL-3.0",
    "LGPL-2.0",
    "LGPL-2.1",
    "LGPL-3.0",
]
copyleft = "warn"
private = { ignore = true }

# .gitlab-ci.yml 片段
license-check:
  stage: test
  image: python:3.12-slim
  script:
    - pip install pip-licenses
    - pip install -r requirements.txt
    - pip-licenses --fail-on="GPL;LGPL;AGPL" \
        --allow-only="MIT;Apache-2.0;BSD-2-Clause;BSD-3-Clause;ISC;
        Python-2.0;Public Domain;CC0-1.0;Unlicense" \
        --format=plain-vertical
  only:
    changes:
      - requirements.txt
      - requirements*.txt
      - setup.py
      - pyproject.toml

# 打 tarball 时确保 LICENSE 和 NOTICE 在根目录
tar czf myproject-1.0.0.tar.gz \
  --exclude='.git' \
  --exclude='node_modules' \
  --exclude='.venv' \
  myproject-1.0.0/

# 验证 LICENSE 文件已包含
tar tzf myproject-1.0.0.tar.gz | grep -E "LICENSE|NOTICE|COPYING"

# SPDX-License-Identifier: Apache-2.0
# SPDX-FileCopyrightText: Copyright (c) 2024-2026 Example Corp.
FROM ubuntu:24.04

# OCI 标准镜像注解（org.opencontainers.image.*）
LABEL org.opencontainers.image.title="My Service"
LABEL org.opencontainers.image.version="1.0.0"
LABEL org.opencontainers.image.description="Example microservice"
LABEL org.opencontainers.image.url="https://github.com/example/my-service"
LABEL org.opencontainers.image.source="https://github.com/example/my-service"
LABEL org.opencontainers.image.licenses="Apache-2.0"
LABEL org.opencontainers.image.vendor="Example Corp."
LABEL org.opencontainers.image.authors="team@example.com"

# 将 LICENSE 和 THIRD_PARTY_NOTICES 打入镜像
COPY LICENSE /usr/share/doc/my-service/LICENSE
COPY NOTICE /usr/share/doc/my-service/NOTICE
COPY THIRD_PARTY_NOTICES.txt /usr/share/doc/my-service/THIRD_PARTY_NOTICES.txt

{
  "name": "my-library",
  "version": "1.0.0",
  "license": "Apache-2.0",
  "author": "Example Corp. <legal@example.com>",
  "repository": {
    "type": "git",
    "url": "https://github.com/example/my-library.git"
  }
}

{
  "license": "(MIT OR Apache-2.0)"
}

# pyproject.toml
[project]
name = "my-library"
version = "1.0.0"
license = {text = "Apache-2.0"}
# 或者引用文件
# license = {file = "LICENSE"}

classifiers = [
    "License :: OSI Approved :: Apache Software License",
]

# setup.cfg（旧格式）
[metadata]
name = my-library
version = 1.0.0
license = Apache-2.0
license_files = LICENSE
  NOTICE
  THIRD_PARTY_NOTICES.txt

<project>
    <licenses>
        <license>
            <name>Apache License, Version 2.0</name>
            <url>https://www.apache.org/licenses/LICENSE-2.0</url>
            <distribution>repo</distribution>
        </license>
    </licenses>
</project>

[package]
name = "my-crate"
version = "1.0.0"
edition = "2021"
license = "MIT OR Apache-2.0"
license-file = "LICENSE"       # 若只用单许可证
repository = "https://github.com/example/my-crate"

// build.gradle (app)
plugins {
    id 'com.google.android.gms.oss-licenses-plugin' version '0.10.6'
}

dependencies {
    implementation 'com.google.android.gms:play-services-oss-licenses:17.1.0'
}

// 在 About 页启动 OssLicensesMenuActivity
OssLicensesMenuActivity.setActivityTitle(getString(R.string.custom_licenses_title))
startActivity(Intent(this, OssLicensesMenuActivity::class.java))

// build.gradle.kts
plugins {
    id("com.mikepenz.aboutlibraries.plugin") version "11.1.0"
}

# 使用 LicensePlist 工具自动生成
brew install mono0926/license-plist/licenseplist

# 在项目根目录运行（需先 pod install 或 swift package resolve）
licenseplist --output-path MyApp/Settings.bundle

# 生成文件：Settings.bundle/Root.plist + Settings.bundle/Acknowledgements.plist

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN"
  "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>PreferenceSpecifiers</key>
    <array>
        <dict>
            <key>FooterText</key>
            <string>Alamofire

Copyright (c) 2014-2024 Alamofire Software Foundation

Permission is hereby granted, free of charge...（MIT 正文）</string>
            <key>Title</key>
            <string>Alamofire</string>
            <key>Type</key>
            <string>PSGroupSpecifier</string>
        </dict>
    </array>
</dict>
</plist>

[![License: Apache-2.0](https://img.shields.io/badge/License-Apache%202.0-blue.svg)](https://opensource.org/licenses/Apache-2.0)

<!-- MIT -->
[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)

<!-- Apache-2.0 -->
[![License](https://img.shields.io/badge/License-Apache%202.0-blue.svg)](https://opensource.org/licenses/Apache-2.0)

<!-- GPL-3.0 -->
[![License: GPL v3](https://img.shields.io/badge/License-GPLv3-blue.svg)](https://www.gnu.org/licenses/gpl-3.0)

<!-- AGPL-3.0 -->
[![License: AGPL v3](https://img.shields.io/badge/License-AGPL%20v3-blue.svg)](https://www.gnu.org/licenses/agpl-3.0)

<!-- 双许可 MIT OR Apache-2.0 -->
[![License: MIT OR Apache-2.0](https://img.shields.io/badge/License-MIT%20OR%20Apache--2.0-blue.svg)](#license)

<!-- MulanPSL-2.0 -->
[![License: MulanPSL-2.0](https://img.shields.io/badge/License-MulanPSL%202.0-blue.svg)](https://license.coscl.org.cn/MulanPSL2)

## Third-party licenses

This project uses third-party software. See [THIRD_PARTY_NOTICES.txt](./THIRD_PARTY_NOTICES.txt)
for details. Key dependencies:

- [grpc-go](https://github.com/grpc/grpc-go) — Apache-2.0
- [zap](https://github.com/uber-go/zap) — MIT
- [prometheus/client_golang](https://github.com/prometheus/client_golang) — Apache-2.0

## Contributor License Agreement (CLA)

By submitting a pull request, you confirm that:

1. You have the right to submit the contribution under the project license.
2. You agree to the [Contributor License Agreement](./CLA.md).
3. Your contribution does not include any third-party code that would
   be incompatible with the project's license (Apache-2.0).

Alternatively, if the project uses DCO instead of CLA, every commit
must be signed-off with `git commit --signoff`.
See [Developer Certificate of Origin](https://developercertificate.org/).

## Trademark

"Apache", "Apache Foo", and the Apache feather logo are trademarks of
The Apache Software Foundation. See [ASF Trademark Policy](https://www.apache.org/foundation/marks/)
for usage guidelines.

## Trademark

"MyProject" is a registered trademark of Example Corp. Use of the name
is subject to the [Trademark Policy](https://example.com/trademark-policy).

{
  "name": "my-frontend",
  "version": "0.1.0",
  "license": "MIT",
  "author": "Example Corp. <legal@example.com>",
  "scripts": {
    "license:check": "license-checker --production --onlyAllow 'MIT;Apache-2.0;BSD-2-Clause;BSD-3-Clause;ISC;0BSD;CC0-1.0;CC-BY-4.0'",
    "license:generate": "license-checker --production --markdownTable > THIRD_PARTY_NOTICES.md"
  }
}

// SPDX-License-Identifier: MIT
// SPDX-FileCopyrightText: Copyright (c) 2026 Example Corp.

name: License Check
on:
  pull_request:
    paths: ['package.json', 'package-lock.json']
jobs:
  check:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: '20'
      - run: npm ci
      - run: npm run license:check
      - run: npm run license:generate
      - run: git diff --exit-code THIRD_PARTY_NOTICES.md

// SPDX-License-Identifier: Apache-2.0
// SPDX-FileCopyrightText: Copyright (c) 2024-2026 Example Corp.
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//     http://www.apache.org/licenses/LICENSE-2.0

package main

.PHONY: license-check license-generate

license-check:
    go-licenses check ./... \
      --allowed_licenses=MIT,Apache-2.0,BSD-2-Clause,BSD-3-Clause,ISC,0BSD,MPL-2.0

license-generate:
    go-licenses report ./... > THIRD_PARTY_NOTICES.txt

[build-system]
requires = ["setuptools>=68", "wheel"]
build-backend = "setuptools.backends.legacy:build"

[project]
name = "my-pylib"
version = "1.0.0"
license = {text = "BSD-3-Clause"}
classifiers = [
    "License :: OSI Approved :: BSD License",
    "Programming Language :: Python :: 3",
]

[project.optional-dependencies]
dev = ["pip-licenses", "pytest"]

# SPDX-License-Identifier: BSD-3-Clause
# SPDX-FileCopyrightText: Copyright (c) 2024-2026 Example Corp.
# All rights reserved.

license-check:
    pip-licenses --fail-on="GPL;LGPL;AGPL" \
      --allow-only="MIT;Apache-2.0;BSD-2-Clause;BSD-3-Clause;ISC;Python-2.0;\
    Unlicense;CC0-1.0;Public Domain" \
      --format=plain-vertical

license-generate:
    pip-licenses --format=plain-vertical --with-license-file \
      --output-file=THIRD_PARTY_NOTICES.txt

[package]
name = "my-crate"
version = "1.0.0"
edition = "2021"
license = "MIT OR Apache-2.0"
repository = "https://github.com/example/my-crate"
readme = "README.md"

// SPDX-License-Identifier: MIT OR Apache-2.0
// SPDX-FileCopyrightText: Copyright (c) 2024-2026 Example Corp.

//! My Crate — 一个示例 Rust 库。

## License

This project is dual-licensed under the terms of both the MIT license
and the Apache License, Version 2.0.

- [LICENSE-MIT](./LICENSE-MIT)
- [LICENSE-APACHE](./LICENSE-APACHE)

You may use this software under the terms of either license.

name: License Check
on:
  pull_request:
    paths: ['Cargo.toml', 'Cargo.lock']
jobs:
  deny:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: taiki-e/install-action@cargo-deny
      - run: cargo deny check licenses
  about:
    runs-on: ubuntu-latest
    needs: deny
    steps:
      - uses: actions/checkout@v4
      - run: cargo install cargo-about
      - run: cargo about generate about.hbs > THIRD_PARTY_NOTICES.html
      - run: git diff --exit-code THIRD_PARTY_NOTICES.html

// SPDX-License-Identifier: Apache-2.0
// SPDX-FileCopyrightText: Copyright (c) 2024-2026 Example Corp.
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//     http://www.apache.org/licenses/LICENSE-2.0

package com.example;

<project>
    <groupId>com.example</groupId>
    <artifactId>my-java-lib</artifactId>
    <version>1.0.0</version>
    <packaging>jar</packaging>

    <licenses>
        <license>
            <name>Apache License, Version 2.0</name>
            <url>https://www.apache.org/licenses/LICENSE-2.0</url>
            <distribution>repo</distribution>
        </license>
    </licenses>

    <build>
        <plugins>
            <!-- 生成 THIRD-PARTY.txt -->
            <plugin>
                <groupId>org.codehaus.mojo</groupId>
                <artifactId>license-maven-plugin</artifactId>
                <version>2.3.0</version>
                <configuration>
                    <outputDirectory>${project.basedir}</outputDirectory>
                    <thirdPartyFilename>THIRD-PARTY.txt</thirdPartyFilename>
                    <useMissingFile>true</useMissingFile>
                    <failIfWarning>true</failIfWarning>
                    <includedLicenses>
                        <includedLicense>Apache-2.0</includedLicense>
                        <includedLicense>MIT</includedLicense>
                        <includedLicense>BSD-2-Clause</includedLicense>
                        <includedLicense>BSD-3-Clause</includedLicense>
                        <includedLicense>EPL-2.0</includedLicense>
                    </includedLicenses>
                </configuration>
                <executions>
                    <execution>
                        <id>check-third-party</id>
                        <goals>
                            <goal>add-third-party</goal>
                        </goals>
                        <phase>generate-resources</phase>
                    </execution>
                </executions>
            </plugin>
            <!-- 检查源文件头部 -->
            <plugin>
                <groupId>com.mycila</groupId>
                <artifactId>license-maven-plugin</artifactId>
                <version>4.3</version>
                <configuration>
                    <header>com/mycila/maven/plugin/license/templates/APACHE-2.txt</header>
                    <properties>
                        <owner>Example Corp.</owner>
                        <year>2024-2026</year>
                    </properties>
                    <excludes>
                        <exclude>**/README.md</exclude>
                        <exclude>**/NOTICE</exclude>
                        <exclude>**/LICENSE</exclude>
                    </excludes>
                </configuration>
                <executions>
                    <execution>
                        <goals>
                            <goal>check</goal>
                        </goals>
                    </execution>
                </executions>
            </plugin>
        </plugins>
    </build>
</project>

#!/usr/bin/env bash
# SPDX-License-Identifier: Apache-2.0
# SPDX-FileCopyrightText: Copyright (c) 2024-2026 Example Corp.
set -euo pipefail

echo "=== Checking GPL components are present in source release ==="
GPL_DIRS=("kernel" "bootloader" "rootfs/usr/bin/busybox-src")
for d in "${GPL_DIRS[@]}"; do
    if [ ! -d "$d" ]; then
        echo "ERROR: GPL source directory missing: $d"
        exit 1
    fi
done

echo "=== Checking WRITTEN_OFFER.txt exists ==="
if [ ! -f WRITTEN_OFFER.txt ]; then
    echo "ERROR: WRITTEN_OFFER.txt is required for GPL binary distribution"
    exit 1
fi

echo "=== Checking OPEN_SOURCE_NOTICES.txt is up to date ==="
if [ ! -f OPEN_SOURCE_NOTICES.txt ]; then
    echo "ERROR: OPEN_SOURCE_NOTICES.txt is missing"
    exit 1
fi

echo "All license checks passed."

# 第一步：确认版权持有人
# 检查所有文件的版权归属，确保公司或指定法人拥有所有代码的版权
git log --format='%aN <%aE>' | sort -u > all-contributors.txt
# 逐一确认每位贡献者是否已签署 IP 转让协议（员工劳动合同或外包合同）

# 第二步：批量添加 SPDX 头
go install github.com/google/addlicense@latest
addlicense -c "Example Corp." -l apache -y 2020-2026 \
  -ignore "vendor/**" -ignore "third_party/**" \
  ./...

# 第三步：添加 LICENSE 文件
curl -o LICENSE https://www.apache.org/licenses/LICENSE-2.0.txt

# 第四步：创建 NOTICE 文件
cat > NOTICE <<'EOF'
My Project
Copyright 2020-2026 Example Corp.
EOF

# 第五步：审查依赖协议兼容性
go-licenses check ./... --allowed_licenses=MIT,Apache-2.0,BSD-2-Clause,BSD-3-Clause

# 第六步：创建 GitHub 仓库（设为 Public），推送
git add LICENSE NOTICE THIRD_PARTY_NOTICES.txt
git commit -m "chore: add open source license files (Apache-2.0)

Co-authored-by: Alice Wang <alice@example.com>"
git push origin main

# 前提：所有贡献者已签 CLA，将著作权或足够的授权转让给项目持有人

# 第一步：记录变更点（commit hash + 日期）
git log --oneline -1  # 记录最后一个 Apache-2.0 提交
# 例如：abc1234 (2025-12-31) Last commit under Apache-2.0

# 第二步：创建变更说明文件
cat > LICENSE-CHANGE-NOTICE.md <<'EOF'
## License Change Notice

Effective [变更日期], the license for this project changes from
Apache License 2.0 to GNU Affero General Public License v3.0 or later (AGPL-3.0-or-later).

Code committed prior to [变更日期] (up to and including commit abc1234)
remains available under Apache-2.0 at that git tag.

This change requires all contributors to have signed our CLA.
See the git tag "last-apache-release" for the last Apache-2.0 version.
EOF

# 第三步：打 tag 保留最后一个 Apache-2.0 版本
git tag last-apache-release abc1234

# 第四步：替换 LICENSE 文件
curl -o LICENSE https://www.gnu.org/licenses/agpl-3.0.txt

# 第五步：批量更新源文件头的 SPDX 标识符
find . -name "*.go" -not -path "*/vendor/*" | \
  xargs sed -i 's/SPDX-License-Identifier: Apache-2.0/SPDX-License-Identifier: AGPL-3.0-or-later/g'

# 第六步：提交
git add -A
git commit -m "chore: change license from Apache-2.0 to AGPL-3.0-or-later

This change is effective [变更日期].
All contributors have signed the CLA.
The last Apache-2.0 release is tagged as 'last-apache-release'."

# 列出所有有 commit 的贡献者
git log --format='%aN <%aE>' | sort -u

# 按提交数量排序
git shortlog -sn

# 对照 CLA 签署记录，确认每位贡献者都已签署
# 如果某位贡献者无法联系或未签 CLA，其贡献的文件需要重写或移除

# 验证原协议是否为 "or later"
grep -r "either version 2 of the License, or" . --include="*.c" --include="*.h" | head

# 如果确认是 "or later"，替换 LICENSE
curl -o LICENSE https://www.gnu.org/licenses/gpl-3.0.txt

# 更新 SPDX 头（从 GPL-2.0-or-later 到 GPL-3.0-or-later）
find . -name "*.c" -o -name "*.h" | \
  xargs sed -i 's/SPDX-License-Identifier: GPL-2.0-or-later/SPDX-License-Identifier: GPL-3.0-or-later/g'

# 注意：所有模块的 MODULE_LICENSE 宏也需要更新（内核模块）
# MODULE_LICENSE("GPL v2") -> MODULE_LICENSE("GPL")  # "GPL" 接受 v2 and later

# 第一步：核查 CLA 完整性
# 确认每一位有代码贡献的人都签署了 CLA
# 对于只有小量贡献（如修错别字）的贡献者，可根据 de minimis 原则排除

# 第二步：打 tag 保留最后开源版本
git tag last-open-source-release

# 第三步：向社区公告（提前 90-180 天，参考 HashiCorp 的 BSL 切换时间表）

# 第四步：替换协议文件
# 将 LICENSE 替换为商业许可证文本（由法务起草）
# 或替换为 BSL（BUSL-1.1）

# 第五步：更新所有 SPDX 头
find . -name "*.go" | \
  xargs sed -i 's/SPDX-License-Identifier: Apache-2.0/SPDX-License-Identifier: LicenseRef-Commercial/g'

## CLA 追溯检查清单

| 贡献者 | GitHub 用户名 | 首次提交日期 | CLA 签署日期 | 状态 |
|--------|-------------|------------|------------|------|
| Alice Wang | @alice | 2022-03-01 | 2022-02-28 | ✅ |
| Bob Chen   | @bob   | 2023-06-15 | 2023-06-10 | ✅ |
| Charlie Li | @charlie | 2024-01-20 | — | ⚠️ 待联系 |

对于未签 CLA 的贡献者，处理方案：
1. 联系贡献者补签。
2. 若无法联系，评估其贡献是否为 de minimis（通常 < 10 行非独创代码）。
3. 若贡献重要且无法联系，重写相关代码。

// SPDX-License-Identifier: MulanPSL-2.0

本项目由[开放原子开源基金会](https://www.openatom.org/)托管。

# 1. 确认修改部分的著作权归属（公司）
# 2. 维护一个 PATCHES/ 目录，记录所有相对于上游的修改
mkdir -p PATCHES
git diff upstream/main HEAD -- . > PATCHES/my-changes.patch

# 3. 在修改的文件头部添加 "此文件已被修改" 声明（Apache-2.0 第4条b款要求）
# 4. 更新 NOTICE 文件，保留上游 NOTICE 内容，追加自己的版权声明
cat >> NOTICE <<'EOF'

This file has been modified from the original Apache-2.0 project.
Modifications Copyright (c) 2024-2026 Example Corp.
EOF

# 5. 如果要提交 PR 给上游，检查上游的 CLA 要求

// vite.config.ts
import { defineConfig } from 'vite';
export default defineConfig({
  build: {
    rollupOptions: {
      output: {
        // 保留以 @license 开头的注释
        banner: '/*! See THIRD_PARTY_NOTICES.txt for third-party licenses. */',
      }
    }
  }
});

// webpack.config.js
const TerserPlugin = require('terser-webpack-plugin');
module.exports = {
  optimization: {
    minimizer: [new TerserPlugin({
      terserOptions: {
        format: {
          // 保留 @license 或 @preserve 注释
          comments: /^\s*(@license|@preserve)/,
        },
      },
      extractComments: {
        condition: /^\s*(@license|@preserve)/,
        filename: 'LICENSES.txt',   // 提取到单独文件
        banner: (licenseFile) => `License information can be found in ${licenseFile}`,
      },
    })],
  },
};

# 错误做法
FROM golang:1.22 AS builder
COPY . .
RUN go build -o /myapp ./cmd/server

FROM scratch
COPY --from=builder /myapp /myapp
# 没有复制 LICENSE 相关文件！

# 正确做法
FROM golang:1.22 AS builder
COPY . .
RUN go build -o /myapp ./cmd/server
RUN go-licenses save ./... --save_path=/third_party_licenses

FROM alpine:3.19
COPY --from=builder /myapp /myapp
COPY --from=builder /third_party_licenses /usr/share/doc/myapp/
COPY LICENSE /usr/share/doc/myapp/LICENSE
COPY NOTICE /usr/share/doc/myapp/NOTICE

#!/usr/bin/env bash
# 检查 Apache-2.0 项目是否有 NOTICE 文件
if grep -q "Apache-2.0" LICENSE 2>/dev/null; then
    if [ ! -f NOTICE ]; then
        echo "ERROR: Apache-2.0 project must have a NOTICE file"
        exit 1
    fi
fi

syft myimage:latest -o spdx-json | \
  jq '[.packages[].licenseConcluded] | unique | join(", ")'

cargo metadata --format-version 1 | jq '.packages[0].license'
# 应输出 "MIT OR Apache-2.0"

#!/usr/bin/env bash
# 检查相对于上游的修改文件是否包含修改声明
MODIFIED=$(git diff upstream/main HEAD --name-only -- '*.go' '*.java' '*.py')
for f in $MODIFIED; do
    if ! grep -q "This file has been modified" "$f" 2>/dev/null; then
        echo "WARNING: Modified file lacks modification notice: $f"
    fi
done