Skip to content
cccskills
FreePublished on GitHub

rseng-license-compliance

Covers license compliance engineering: auditing the full dependency tree's licenses, compatibility analysis (permissive vs weak vs strong copyleft, GPL interactions, combining and linking), dual and multi-licensing, SPDX expressions and REUSE-compliant repositories, attribution and NOTICE obligations, and license policy in CI. Use when the user asks whether dependencies' licenses are compatible, wants a license audit, considers dual licensing or relicensing, must satisfy GPL/LGPL obligations, mentions SPDX, REUSE, NOTICE files or license scanners, or needs a license recommendation under real constraints. (License basics and first-time license choice: rseng-licensing.)

The English summary is being prepared. Showing the original description.

fdiblen/rseng-agent-skills24 stars(GitHub 24 + cccskills 0)

Run score Not tested

See how to install

Files included (2)

  • SKILL.md8.2 KB
  • references.md841 B

SKILL.md (original)

Review the instructions the agent will receive before you install.

License compliance for research software

Choosing a license is a decision; staying compliant is engineering. Every dependency in the tree grants rights under conditions, and a project distributing software must satisfy all of them at once - which is checkable, automatable and routinely neglected in research code. This skill covers the audit-and-verify side of licensing; license basics (what MIT/GPL/Apache mean, adding a LICENSE file, licensing docs and data) live in rseng-licensing. One boundary stated up front: an agent can analyze, flag and prepare, but consequential calls - relicensing, dual-licensing contracts, anything with commercial stakes - belong with the institution's legal or tech transfer office. Say so when the stakes warrant it.

Auditing the dependency tree

Inventory before judgment:

  • Enumerate licenses of ALL transitive dependencies with a tool, not by hand: pip-licenses (Python), the equivalent per ecosystem (license-checker for npm, cargo-license), or ScanCode Toolkit for a thorough multi-language scan that reads actual file texts rather than trusting declared metadata.
  • Treat "declared vs actual" skeptically: packages misdeclare; vendored files and copied snippets carry their own licenses; data and models bundled in the repo have licenses too (rseng-data-management).
  • Flag the findings in three buckets: fine (compatible), obligations (compatible but with duties - attribution, notices, source offers), and conflicts (incompatible or unknown/unlicensed). "No license found" means all rights reserved and is a conflict, not a shrug.
  • Record the audit result (a license inventory file or SBOM with license fields - rseng-security's SBOM practice carries license data naturally) so the next audit is a diff, not a redo.

Compatibility analysis

The mental model that resolves most questions:

  • Direction matters: compatibility means "may I combine this dependency into a work distributed under MY license". Permissive code (MIT/BSD/Apache) flows into almost anything; copyleft code pulls the combined work toward its own terms.
  • Strong copyleft (GPL family): distributing a work that links or combines GPL code requires the whole to be GPL-compatible; GPLv2- only vs GPLv3 is a real incompatibility to check, and Apache-2.0 is compatible with GPLv3 but not GPLv2.
  • Weak copyleft (LGPL, MPL, EPL): obligations attach to the covered files/library, not the whole work - dynamic linking against LGPL is generally fine for any project; modifying the LGPL library itself is not.
  • Network use: AGPL triggers source obligations on network service use - relevant the moment research software becomes a hosted service.
  • Non-commercial and academic-only licenses (CC-NC variants, homegrown academic licenses) are incompatible with OSI open source and block downstream reuse; flag them loudly in dependencies and discourage them for new projects (rseng-licensing explains why).
  • When a genuine conflict exists, the options in order: replace the dependency (rseng-software-reuse to find alternatives), isolate it behind a process/service boundary, seek an exception from its author, or change the project's own license. Present options with trade-offs; do not silently pick.

Authoritative references for specific pairs: the FSF license list and the EU Joinup Licensing Assistant's compatibility checker beat folklore; cite them when a pairing is contested.

Suggesting a license (constraint-driven)

Recommend from constraints, not fashion. Ask or infer: what do the dependencies already require (a GPL dependency decides the question for distributed works)? Does the institution or funder have a policy? Is commercial adoption desired (permissive lowers friction) or is reciprocity the goal (copyleft)? Is the artifact a library (LGPL/MPL/permissive keep adopters) or an application? Then suggest one license with a one-paragraph rationale and the runners-up - choosealicense.com framing works well for users; rseng-licensing covers the fuller decision guidance. Never leave a repository unlicensed while the decision pends; that blocks everyone.

Dual and multi-licensing

  • Dual licensing offers the same code under two licenses: commonly copyleft-or-commercial (revenue model requiring copyright concentration - every contributor must agree via CLA or assignment, which changes community dynamics - rseng-community-governance), or license-choice offers like "MIT OR Apache-2.0" (adopter-friendly, common in some ecosystems).
  • Express it precisely with SPDX expressions: MIT OR Apache-2.0 (recipient chooses), MIT AND CC-BY-4.0 (different artifacts under different terms - code vs docs/data is the research-typical case). Put the expression in package metadata and per-file tags.
  • Relicensing an existing project requires consent of all copyright holders; enumerate contributors (git history) and treat it as a months-long consent project, not an edit. This is a route-to-legal-office decision.

Verifiable compliance: SPDX, REUSE and CI

Make license state machine-checkable:

<!-- REUSE-IgnoreStart -->
  • Per-file SPDX tags (SPDX-License-Identifier: Apache-2.0) plus LICENSES/ directory per the REUSE specification; reuse lint then verifies the whole repository mechanically - the license analogue of a test suite.
<!-- REUSE-IgnoreEnd -->
  • Enforce policy in CI (rseng-ci-cd): a license-audit step that fails on new dependencies outside the allowlist, and reuse lint where adopted. Policy-as-code prevents the quiet arrival of an incompatible dependency two years before anyone notices.
  • Fulfill obligations at release time (rseng-publishing-releasing): ship required notices (Apache NOTICE files aggregated, copyright lines preserved), include dependency license texts where distribution requires them, and keep binary/container distributions in mind - an image distributes everything inside it.
  • Record AI-assisted audits and license changes in aidecl.yaml (rseng-ai-declaration); license history is provenance.

Working with this skill

This skill is source-independent: its authority is the SPDX and REUSE specifications, the FSF and OSI license references and the tool documentation linked below. It complements rseng-licensing (fundamentals and first license choice).

Learn more (verified):

<!-- related-skills:begin -->

Related skills

Check whether any of these applies before moving on:

  • rseng-ci-cd - policy-as-code license gates
  • rseng-community-governance - CLA implications of dual licensing
  • rseng-dependency-management - license axis of intake vetting
  • rseng-licensing - first license choice basics
  • rseng-publishing-releasing - notice obligations at release
  • rseng-security - SBOM carries license data
<!-- related-skills:end -->

Reviews

No reviews yet. Tell others what you thought.

Comments

No login needed. Share how it worked for you, ask a question, or note where it did not run.

No comments yet. Be the first to write one.

Comments are published right away. Do not include personal information such as email addresses or phone numbers. Up to 2 URLs.

0 / 1,000 characters

This form is protected by reCAPTCHA, and the Google Privacy Policy and Terms of Service apply.

More skills from this repository

Covers operating AI coding agents securely: auditing whether the agent runs sandboxed, permission and dangerous-command configuration, containerized environments, secrets kept out of context, network egress and token privileges, prompt-injection risk, and the privacy of agent use itself. Use PROACTIVELY when permission gating is broadly disabled (skip-permissions modes), when secrets are visible to the agent's shell, or when the agent processes untrusted code, issues or web content; when a project holds personal or confidential data while a cloud agent is active (what leaves the machine, retention, training use), or when the user asks how to run coding agents safely or privately. (Supply-chain security: rseng-security; disclosing agent contributions: rseng-ai-declaration.)

The English summary is being prepared. Showing the original description.

fdiblen/rseng-agent-skills24Updated Sep 23, 2026

Covers declaring AI involvement with the AI Declaration Format (https://ai-declaration.org): creating and maintaining an aidecl.yaml that records which AI tools and agents were used, what each contributed, when and how much, plus the README disclosure footnote, JSON/JSON-LD export and CI validation. Machine-readable disclosure is the practice; this format is one implementation. Use PROACTIVELY when an AI assistant or agent creates or modifies a project's content - generate aidecl.yaml if missing, update it after AI-assisted changes. Also use when the user asks about AI transparency, provenance, disclosure or EU AI Act disclosure, wants to state that NO AI was used, or mentions aidecl. For concealment requests see rseng-honesty; for the human review duty see rseng-human-verification.

The English summary is being prepared. Showing the original description.

fdiblen/rseng-agent-skills24Updated Sep 23, 2026

Covers long-term archiving of research software and data: Software Heritage save requests and SWHID persistent identifiers, Zenodo deposits with versioned DOIs and forge integration, choosing domain and institutional repositories, deciding what to archive (code, data, environments, documentation) and when, and archiving at project retirement. Use when the user wants software or data preserved beyond the life of a forge account, grant or lab, mentions Software Heritage, SWHIDs, Zenodo deposits or archiving, retires or hands over a project, prepares artifacts that must stay resolvable for a paper, or when funder policy requires long-term preservation. (Cutting the release itself is rseng-publishing-releasing; day-to-day data storage and repository choice is rseng-data-management.)

The English summary is being prepared. Showing the original description.

fdiblen/rseng-agent-skills24Updated Sep 23, 2026

Covers processing research data that outgrows one machine's memory: out-of-core and chunked computation, Dask for scaling the scientific Python stack, Spark for distributed tabular pipelines, lazy evaluation, partitioning strategies, idempotent and restartable batch jobs, and knowing when NOT to distribute. Use when datasets no longer fit in memory, when the user mentions Dask, Spark, out-of-core or larger-than-memory data, when a pandas/NumPy workflow hits memory limits, or when designing batch pipelines over many files. (Cluster job submission and job arrays are rseng-hpc-computing; pipeline orchestration engines are rseng-workflows; profile first with rseng-performance-profiling.)

The English summary is being prepared. Showing the original description.

fdiblen/rseng-agent-skills24Updated Sep 23, 2026

Covers continuous integration and delivery for research software: CI/CD concepts, automating builds and tests with GitHub Actions and GitLab CI/CD, and wiring an organization's GitLab CI infrastructure to a GitHub-hosted project. Use when the user asks to set up CI, write a pipeline or workflow file (.github/workflows, .gitlab-ci.yml), add automated builds/tests on push or pull request, publish a package or deploy docs when a tag or release is cut, cache dependencies to speed up CI runs, choose between GitHub Actions and GitLab CI, use self-hosted or GPU runners, mirror a repo, or report external CI status back to GitHub. For what to test and shrinking a test matrix see rseng-testing; for linter and pre-commit policy see rseng-code-quality.

The English summary is being prepared. Showing the original description.

fdiblen/rseng-agent-skills24Updated Sep 23, 2026

Covers verifying that every citation is real, correct and current: checking references in manuscripts, READMEs, references files and code metadata against Crossref and OpenAlex, screening cited DOIs against the Retraction Watch database, catching fabricated or mis-attributed citations (a documented AI failure mode), and keeping bibliographies and CITATION.cff files resolvable. Use PROACTIVELY before any bibliography, reference list or citation metadata is finalized or published, whenever the agent itself has produced citations, and when the user asks to check references, mentions broken DOIs, retracted papers or citation verification, or prepares a manuscript, README or software paper with references. (Making your own software citable is rseng-citation-metadata.)

The English summary is being prepared. Showing the original description.

fdiblen/rseng-agent-skills24Updated Sep 23, 2026

See all skills by fdiblen

Report a problem with this skill