Research-2143: Root licence files, package licence fields, and where LICENSE-MIT was published¶

• Status: Active
• Workstream: ADR-1699, ADR-1250
• Last updated: 2026-10-05

Question¶

What do licence detectors read from the repository root before and after the layout of ADR-1699, which package manifests misstate the licences of the files they ship, and which published artifacts contained the root LICENSE-MIT that ADR-0686 added?

This digest records facts and where they were read. It is not legal advice.

Sources¶

• licensee 10.1.0, the detector GitHub's licence feature is built on (gem install licensee in the ruby:3.4 image, licensee detect <dir>), run 2026-10-05 on copies of the root files.
• GitHub REST API GET /repos/VMAFx/vmafx and GET /repos/VMAFx/vmafx/license, read 2026-10-05.
• cargo package --list -p <crate> --allow-dirty --offline (cargo 1.98.1) and cargo deny --offline check (cargo-deny 0.19.8) in this worktree.
• Artifact Hub docs/helm_annotations.md (artifacthub.io/license), read 2026-10-05.
• The registries: GHCR (package versions through the GitHub API; image manifests, configs and layers through ghcr.io/v2, anonymous pull tokens), proxy.golang.org (module list and the zips' central directories by HTTP range requests), PyPI's JSON API and files, the crates.io API and cargo search vmafx, and the release assets of every release (gh release download).
• git log -S'LICENSE-MIT', git cat-file -e <tag>:LICENSE-MIT and git ls-remote --tags origin in this repository.

Findings¶

Root files and detectors¶

On the whole tree (root files, LICENSES/ and Cargo.toml) the result depends on the licensee version, because 9.19.0 (PR licensee/licensee#926, January 2026) added LICENSES/ to the files it reads:

GitHub's answers for eza and for this branch match 9.18.0's behaviour. In both versions NOTICE is not a candidate licence file.

licensee reports a project licence only when the root's licence files agree on one licence; two licence files with different licences give NOASSERTION, which GitHub's API shows as other. Which names count is Licensee::ProjectFiles::LicenseFile::FILENAME_REGEXES of 10.1.0: LICENSE, LICENCE, UNLICENSE with any extension or -/_ suffix, COPYING*, <word>-LICENSE*, <word>-COPYING*, OFL*, COPYRIGHT* and PATENTS*, each with a score; NOTICE matches only the catch-all, score 0. On 2026-10-05 the API returned {"key": "other", "spdx_id": "NOASSERTION"} for the repository with LICENSE as its licence file. The repository description already read "fork code EUPL-1.2, Netflix code BSD-2-Clause-Patent"; the topics name no licence. The byte-identical copy of LICENSES/EUPL-1.2.txt is detected, so the repository keeps one EUPL-1.2 text rather than a second, differently wrapped one.

git log -S'LICENSE-MIT' finds three commits: 7f3504af4 (#1546, ADR-0686, 2026-05-28) added it, 384d97d03 (the layout move of the same day) touched it, and 02e7d834f (#1196) listed it in .github/ci-impact.json. No packaging configuration (pyproject.toml, Cargo.toml, a Dockerfile COPY, a bundle builder, a release workflow) ever named it.

Package manifests against their files¶

Read with tools/rc1-tester/image/licensing.py (SPDX header, else REUSE.toml), over the files each package ships:

go.mod has no licence field. Artifact Hub requires artifacthub.io/license to be "a valid SPDX identifier". With EUPL-1.2 for vmafx-sys and vmafx, cargo-deny needs EUPL-1.2 in deny.toml's allow list; vmafx-tad is private and ignored, and BSD-2-Clause-Patent is then unmatched (cargo-deny warns about an unused allowance), so the list swaps one for the other: licenses ok.

Where LICENSE-MIT was published¶

The root LICENSE of the time (Netflix's text) reached the artifacts as BSD-2-Clause-Patent.txt through licensing.json spdx_texts; after ADR-1699 the same bytes come from NOTICE, so a rebuilt artifact's notices do not change.

What the Go retraction reaches¶

The root go.mod now carries retract [v1.0.0-rc.1, v1.0.0-rc.2]. The Go modules reference says the go command loads retractions from the go.mod of the version @latest resolves to, and that the retracting version must be higher than every other release or pre-release. For this module path the proxy lists 26 versions (go 1.27.1, go list -m -versions github.com/VMAFx/vmafx, 2026-10-05): v1.0.0-rc.1, v1.0.0-rc.2, Netflix's tags v1.0.2 to v1.5.3, and v2.0.0+incompatible to v3.0.0+incompatible. go list -m github.com/VMAFx/vmafx@latest resolves to v3.0.0+incompatible: the highest compatible release, v1.5.3, has no go.mod, so the +incompatible versions stay eligible.

A local file-based module proxy reproduced that resolution and showed the consequence:

So with Netflix's tags in the module's version list, a retraction published in a v1.0.0-* or v1.0.0 version is not read by the go command.

.toml files and the provenance tool¶

relicense_fork_files.py skipped every file it had no comment style for, which included .toml. With .toml classified (praetor's .codex/agents/*.toml projections excluded), 15 files changed: 13 fork files gained the EUPL-1.2 header (REUSE.toml, .gitleaks.toml, .helix/config.toml, .helix/languages.toml, osv-scanner.toml, the root pyproject.toml, the ai/, dev-llm/, mcp-server/vmaf-mcp/ and ensemble-kit pyproject.toml, and the three crate manifests), and tools/vmaf-tune/pyproject.toml and tools/vmaf-roi-score/pyproject.toml (both "Copyright 2026 Lusoris") moved from BSD-2-Clause-Patent to EUPL-1.2. Those two had been kept by veto 3 because upstream has a python/pyproject.toml; the name now carries no provenance signal. bindings/rust/vmafx-sys/Cargo.toml was flagged by the derivation detector for "bindings.rs is produced by bindgen from libvmaf.h"; it is a manifest and was recorded under [not_ports]. python/pyproject.toml (an upstream path) keeps its terms through REUSE.toml.

Alternatives explored¶

• Canonical choosealicense text instead of LICENSES/EUPL-1.2.txt. Not needed: the SPDX text already passes licensee's threshold (99.20 %), and a second EUPL-1.2 text would differ from the one REUSE and every package ship.
• Counting the Helm subchart in the chart's own licence. Rejected in ADR-1699: Artifact Hub takes one identifier, and the subchart declares its own; the gate instead holds the subchart's REUSE.toml record to its declaration, which found the EUPL-1.2 record above.
• Running cargo package --list in the gate. It needs a Rust toolchain and a populated registry cache; the gate models cargo's selection instead and refuses include, exclude and license-file. For all three crates the model's file set is cargo package --list (its generated Cargo.toml and .cargo_vcs_info.json mapped to their sources) plus the workspace manifest whose inherited fields cargo writes into the generated Cargo.toml.

Open questions¶

• GitHub's licence API reports eupl-1.2 for this branch's ref; the sidebar shows the default branch. A GitHub detector that reads LICENSES/ (licensee 9.19.0 or later) would report NOASSERTION for this tree.
• The go.mod retraction reaches Go clients only through a version that @latest resolves to; see "What the Go retraction reaches".
• The crates ship no licence text; none is published.

Related¶

• ADRs: ADR-1699, ADR-1250, ADR-0686, ADR-1513, ADR-1560, ADR-1578
• Research: Research-2140
• PRs: #1546 (added LICENSE-MIT)