Skip to main content

DECLARE AN EXTENSION LICENSE

This guide shows you how to declare the license an extension is published under. A license is optional. Nothing is refused or hidden without one, but each of the two parts below earns one point on the scorecard:

  • License declared: a license: field in the manifest that names the license as an SPDX expression.
  • LICENSE file included: a license file in the extension that carries the license text.

To learn why there are two parts, read About Extension Licenses.

Declare the license

  1. Add license: to manifest.yaml, set to an SPDX license identifier:

    license: MIT

    An expression can combine licenses with OR, AND and parentheses:

    license: MIT OR Apache-2.0

    Only SPDX ids count. Write each one exactly as the SPDX list does: a deprecated id such as GPL-2.0 does not count, so use its current form, GPL-2.0-only or GPL-2.0-or-later. A custom LicenseRef- reference does not count either.

  2. Put the license text in a file named LICENSE beside the manifest. The scorecard also accepts LICENSE.md, LICENSE.txt and COPYING, in the case variants listed in the rubric. The file must not be empty.

  3. List the file under additionalFiles as a bare file name:

    additionalFiles:
      - README.md
      - LICENSE
  4. Bump version and push:

    swamp extension push manifest.yaml

The license is recorded on the version you pushed. The extension page and swamp extension info show it, and the version history shows when it changed. Existing versions are never changed, so a license applies from the next version you push.

When the license is not accepted

An expression that is not valid SPDX does not stop the push. The registry publishes the version without a license and reports a warning, for example:

License "GPL-2.0" in manifest.yaml is not a valid SPDX expression, so it earns no quality points: "GPL-2.0" is a deprecated SPDX id; did you mean GPL-2.0-only? The version was published without a license.

The version earns no point for License declared. Fix the expression and push a new version.

The registry license setting is gone

The extension page used to have a License (SPDX) setting. It has been removed, and the manifest is the only place to declare a license. A PATCH /api/v1/extensions/<name> request that sets license is refused with:

The registry license setting has been removed. Declare the license in manifest.yaml (`license: <SPDX id>`) and push a new version.