Proposal: license files GitHub can read

[ChristopherA]

This is the third question from the README survey behind #219 and #220. This one is about the file beside the README: the license.

Almost all of our software is under the BSD-2-Clause Plus Patent License, but GitHub only knows that for 8 of the 93 repos I surveyed. For the rest, the repo sidebar says "Other" or nothing, and a search filtered by license won't find them. The cause is the text our secure template puts at the top of LICENSE:

Unless otherwise noted (either in /README.md or in the file's header comments) the contents of this repository are released under the following license:

GitHub's detector compares the file against the license text, and that opening sentence keeps it from matching. 34 repos carry it and GitHub recognizes none of them. All 8 that it does recognize start directly at the copyright line, as passkey-cloudflare does.

The sentence does real work, though. Before proposing to move it, I cloned every repo in the survey to see what it covers. Four READMEs list files under other terms in the template's "Origin, Authors, Copyright & Licenses" table: bc-ur, keytool-cli, lethekit and seedtool-cli. Several more repos include third-party code noted only in the file's own header, bc-mur-ts and bc-lifehash among them. And in 25 repos, all 18 TypeScript libraries included, the license file is the only place the sentence appears.

What I'm proposing:

• LICENSE holds only the license, starting at the copyright line.
• The README carries the scoping. Its License section says what the repo is licensed under, with the license's SPDX id in words, then the "unless otherwise noted" sentence and the table of exceptions wherever there are any. Where a repo's README doesn't have the sentence yet, the change that trims LICENSE adds it, so nothing loses its exceptions.
• A second license gets its own file, named LICENSE-<SPDX id>, such as LICENSE-CC-BY-4.0 for a book's text beside its code.
• Manifests carry the SPDX id: license = "BSD-2-Clause-Patent" in Cargo.toml, "license" in package.json.

The file name is the other half. 34 repos use LICENSE and 37 use LICENSE.md, and the split follows authors: Wolf's repos use LICENSE.md, and nearly everyone else uses LICENSE. GitHub reads either, but the split already costs readers something. Four READMEs link LICENSE where the file is LICENSE.md, and the link goes nowhere. I'd standardize on LICENSE, the template's name and the one our other authors already use. The alternative is to accept both names and fix only the text, which avoids 37 renames and leaves the links to be checked by hand.

Some repos are rightly under a different license. The zewif family (zewif, zewif-zcashd, zewif-zingo and zmigrate) is dual-licensed MIT and Apache-2.0, the license the Zcash Rust ecosystem uses. My recollection is that the Zcash funding asked for a specific license there and may have allowed the dual one. I'll check the grant terms before anything changes. Nothing in those repos says why they differ, and I think the README should. For dual licenses, I'd use the same layout as the Zcash Foundation's own repos: LICENSE-MIT and LICENSE-APACHE side by side.

The survey also turned up 18 repos with no license file at all. Seven declare one only in Cargo.toml. Nine have neither a license file nor a license field in a manifest, among them SmartCustodyBook, XID-Quickstart and www.blockchaincommons.com. Each would get a license file as part of bringing its README up to the standard.

Who the copyright holder should be, and which years to list, is a separate question I'll raise on its own.

Two things I haven't settled:

1. Is LICENSE worth the renames, or should LICENSE.md stay acceptable?
2. For books and courses under Creative Commons, should the main file be LICENSE with the CC text in it, or keep the LICENSE-CC-BY-4.0.md names that Learning-Bitcoin-from-the-Command-Line and others use now?

What's your read? @wolfmcnally, most of the renames would be on your repos, and @leonardocustodio, the TypeScript libraries would each gain the README sentence. @shannona, the content repos are mostly yours. Once this settles I'll update the secure template to match.

-- Christopher Allen

[leonardocustodio]

Hey @ChristopherA , sounds good to me. I will make the changes and create a PR for each TypeScript repository.