ABOUT EXTENSION LICENSES
Someone who finds an extension on the registry wants to know whether they may use it, change it and pass it on. A license answers that. The registry does not require one: an extension without a license publishes, lists and installs like any other. It scores a license instead, because a license is one of the things that makes an extension easier to adopt.
A name and a text
An extension can state its license in two forms, which do different jobs and earn a scorecard point each.
The license: field in the manifest names the license with an
SPDX expression such as MIT or
MIT OR Apache-2.0. A name is something tools can read: the registry checks it,
swamp extension info reports it, and anything that audits dependencies can
compare it with a list of licenses it accepts. Only SPDX ids count, so the name
always means the same license to every reader. Because the field lives in the
manifest, it is recorded on each version, and the version history shows when it
changed.
The LICENSE file carries the text. Many licenses require their text and the copyright notice to travel with the code, and a name alone cannot do that. The registry checks that the file is there and is not empty. It does not read the file or compare it with the field.
One place to declare it
The registry used to offer a license setting on the extension page. It belonged to the extension rather than to any version, was not checked against SPDX, and the CLI could not see it. It has been removed, so the manifest is the only place a license is declared, and the registry and the CLI always read the same value.
The Swamp exception is not a license you declare
Swamp is licensed under the AGPL with the Swamp Extension and Definition
Exception. The exception is a permission from Swamp's copyright holders: it lets
anyone write extensions and license them however they choose. It is not a
license an extension declares. A third-party extension names its own license,
such as MIT or Apache-2.0, in license:. First-party @swamp extensions
declare AGPL-3.0-or-later.