Declare the licence in the package metadata

How to do it

Registries, licence scanners and bills of materials read the metadata, not your README. Use the license field in package.json, and the license and license-files keys in pyproject.toml, which PEP 639 defines. Python's old licence classifiers are deprecated. Other ecosystems have the same field, such as license in Cargo.toml. Write two licences as an expression, such as MIT OR Apache-2.0, when users may pick either. People who use your package read the field as List the licences of the code and every dependency says.

Examples

JavaScript example

import { readFile } from 'node:fs/promises';

const declared = JSON.parse(await readFile('package.json', 'utf8')).license;
const header = /SPDX-License-Identifier: (.+)/.exec(await readFile('src/index.js', 'utf8'))?.[1].trim();
if (declared !== header) throw new Error(`package.json says ${declared}, src/index.js says ${header}`);

Python example

import re, tomllib
from pathlib import Path

declared = tomllib.load(open("pyproject.toml", "rb"))["project"]["license"]
header = re.search(r"SPDX-License-Identifier: (.+)", Path("src/shop/__init__.py").read_text()).group(1).strip()
assert declared == header, f"pyproject.toml says {declared}, the source says {header}"

How to check

A test in CI reads the metadata licence and the SPDX-License-Identifier of the main source file. The two are equal, and the published package page shows the same identifier.

Sources

• PEP 639 (Improving license clarity with better package metadata)
• npm Docs on the package.json license field

Related rules

• TKO-29 List the licences of the code and every dependency in Codebase takeover