Software Licensing Compliance Skill

⚠️ LEGAL DISCLAIMER This guide is provided for educational and informational purposes only and does not constitute legal advice. The author is not a lawyer, and this material should not be relied upon as a substitute for professional legal counsel.

For production software, consult a qualified attorney familiar with intellectual property law, open source licensing, and your jurisdiction's legal requirements.

GitHub Disclaimer This repository provides general information and templates. It does not provide legal advice, create an attorney-client relationship, or guarantee compliance. Use at your own risk and consult qualified counsel for legal questions.

Overview

A comprehensive reference guide for managing software licensing compliance in modern software projects. This skill covers dependency auditing, license compatibility analysis, third-party attribution, EULA creation, and compliance workflows across multiple ecosystems.

Use this skill to:

• ✅ Audit open source dependencies for license compatibility
• ✅ Detect copyleft obligations (GPL, LGPL, MPL)
• ✅ Generate compliant third-party license bundles
• ✅ Create attribution UI (About dialogs, credits screens)
• ✅ Draft EULA templates with regional compliance (GDPR, CCPA)
• ✅ Handle multi-license expressions and dual licensing
• ✅ Scope build-time vs runtime dependencies

Contents

managing-software-licensing/
├── README.md                      # This file
├── SKILL.md                       # Complete licensing workflow guide
└── references/
    ├── eula-template.md           # EULA template with regional compliance
    ├── third-party-licenses-template.md  # License bundling formats
    └── attribution-ui-template.md # UI attribution examples

Features

1. Multi-Ecosystem Dependency Scanning

• JavaScript/Node.js: license-checker, npm-license-crawler
• Python: pip-licenses with json/csv/markdown output
• Rust: cargo-license with TSV/JSON formats
• Go: go-licenses for dependency scanning
• .NET/NuGet: dotnet-project-licenses for license reporting
• Java: Maven/Gradle plugins for license reports
• Ruby/PHP/Swift/C++: Ecosystem-specific tools (Composer, CocoaPods, vcpkg, Conan)
• Guidance for handling multi-license expressions (OR/AND/dual-license)

2. Non-Code Asset & Binary Auditing

• Fonts: SIL OFL, Apache-2.0 license verification
• Icons/Images: Creative Commons, MIT, proprietary asset tracking
• Datasets/Models: CC-BY, ODbL, ML model licensing
• Bundled Binaries: DLLs, embedded runtimes (Python, .NET, Node.js), native libraries
• OS Components: WebView2, GTK/Qt, system library disclosure

3. Third-Party Services & Data

• API terms of service disclosure (Google Maps, Stripe, etc.)
• SaaS library attribution (Sentry, Mixpanel, Firebase)
• Public dataset licensing (NCBI, OpenStreetMap, Kaggle)
• Content delivery network (CDN) requirements

4. License Compatibility Analysis

• Permissive licenses (MIT, Apache-2.0, BSD)
• Weak copyleft (LGPL, MPL-2.0)
• Strong copyleft (GPL, AGPL)
• Build-time vs runtime scoping
• Proc-macro and target-specific dependency exclusion

5. Packaging & Distribution Compliance

• Tauri/Electron/desktop app bundle.resources configuration
• Docker/container image license bundling
• Mobile app (iOS/Android) license disclosure
• Installer license file inclusion (Windows/Linux/macOS)
• Risk/decision matrix (ship/disclose/remove/replace)

6. Platform-Specific Checklists

• Electron: Chromium, Node.js, FFmpeg, native modules, auto-update disclosure
• Avalonia: .NET runtime, NuGet packages, SkiaSharp, embedded resources
• WPF: WebView2, third-party controls, P/Invoke DLLs, XAML resources

7. Third-Party Attribution Templates

• THIRD_PARTY_LICENSES.txt format (consolidated)
• Apache NOTICE file format
• GPL/LGPL source availability notices
• Multi-license summary guidance

8. EULA Template (Comprehensive)

• Clickwrap vs browsewrap acceptance
• Regional compliance sections (EU GDPR, California CCPA, Germany pre-purchase)
• Third-party software disclosure
• Export control language
• Dispute resolution (arbitration)
• Warranty disclaimers and limitation of liability

9. Attribution UI Examples

• React/TypeScript About dialog components
• Mobile settings screen layouts
• Web credits page templates
• Best practices for discoverability

Installation

Via npm (from npm registry)

npm install @rajioba1/managing-software-licensing

Via npm (from GitHub)

npm install github:Rajioba1/managing-software-licensing

Use with Codex

Option A: Copy into Codex skills

$CODEX_HOME/skills/managing-software-licensing/

Place this repo folder there so SKILL.md is at the root of the skill folder.

Option B: Install from GitHub (if you use a Codex skill installer)

Rajioba1/managing-software-licensing

Then reference the skill by name in your prompt:

Use the managing-software-licensing skill to audit my dependency licenses.

Use with Claude

Project Knowledge

Add SKILL.md to your Claude Project Knowledge. Then prompt:

Use the managing-software-licensing guide to review my license compliance plan.

One-off sessions

Paste the contents of SKILL.md into the chat and ask for the specific task.

Usage

Command Line:

# View the complete guide
licensing-skill guide

# Copy templates to your project
licensing-skill copy eula
licensing-skill copy licenses
licensing-skill copy attribution

# List available templates
licensing-skill list

Programmatic Usage (Node.js):

const licensing = require('@rajioba1/managing-software-licensing');

// Get the complete guide
const guide = licensing.getGuide();

// Get templates
const eulaTemplate = licensing.getEulaTemplate();
const licensesTemplate = licensing.getThirdPartyLicensesTemplate();
const attributionTemplate = licensing.getAttributionTemplate();

// Copy a template to your project
licensing.copyTemplate('eula', './EULA.txt');

Quick Start

1. Review the Main Guide

Read SKILL.md for the complete licensing compliance workflow:

# Audit JavaScript dependencies
npx license-checker --production --json > licenses.json
npx license-report --output=table > THIRD_PARTY_LICENSES.txt

# Audit Python dependencies
pip-licenses --format=plain --with-license-file > THIRD_PARTY_LICENSES.txt

# Audit Rust dependencies
cargo install cargo-license
cargo license --json > licenses.json

2. Use the Templates

EULA Template: See references/eula-template.md

• Customize [Company Name], [Software Name], [Contact Email]
• Add regional compliance sections as needed (EU, California, Germany)
• Include third-party software disclosure
• Get legal review before shipping

Third-Party License Bundle: See references/third-party-licenses-template.md

• Copy the THIRD_PARTY_LICENSES.txt template
• Run automated license scans for your ecosystems
• Include full license text (not just SPDX identifiers)
• Bundle with your installer

Attribution UI: See references/attribution-ui-template.md

• Add an About dialog with "Third-Party Licenses" link
• Include copyright notices for major dependencies
• Link to full THIRD_PARTY_LICENSES.txt file

3. Before Shipping

• [ ] Run license scans for runtime dependencies only (exclude dev/build-time)
• [ ] Generate THIRD_PARTY_LICENSES.txt with full license text
• [ ] Bundle license file with installer (Windows: NSIS, macOS: DMG, Linux: .deb/.rpm)
• [ ] Add attribution to About dialog or Settings → Legal
• [ ] Review for copyleft obligations (GPL/LGPL)
• [ ] Get legal review from qualified attorney

Key Concepts

Permissive vs Copyleft Licenses

| License Type | Examples | Compatibility | Obligations | |--------------|----------|---------------|-------------| | Permissive | MIT, Apache-2.0, BSD | ✅ Compatible with proprietary software | Preserve copyright notice, include license text | | Weak Copyleft | LGPL-2.1/3.0, MPL-2.0 | ⚠️ File-level or library copyleft | Modified MPL files must remain MPL; LGPL requires relinking allowance | | Strong Copyleft | GPL-2.0, GPL-3.0, AGPL | ❌ Derivative works must be GPL | Must provide source code or written offer |

Build-Time vs Runtime Dependencies

Runtime dependencies:

• Bundled in your final executable/installer
• MUST be included in THIRD_PARTY_LICENSES.txt
• Examples: production npm packages, Python requirements, statically linked Rust crates

Build-time only (exclude from attribution):

• Dev dependencies (e.g., eslint, pytest, clippy)
• Proc-macro crates (compile-time code generation)
• Target-specific dependencies not included in your platform build

Multi-License Expressions

Apache-2.0 OR MIT        # Dual-licensed (you can choose either)
Apache-2.0 AND MIT       # Both licenses apply (must comply with both)
Apache-2.0 WITH LLVM-exception  # Apache with LLVM exception clause

How to handle:

• OR expressions: Choose the most permissive license for your use case
• AND expressions: Comply with both licenses
• Document your choice in THIRD_PARTY_LICENSES.txt

Limitations

What This Skill Does NOT Cover

❌ Legal advice - Consult a qualified attorney ❌ No compliance guarantees - This is guidance only; you are responsible for legal compliance

❌ Patent analysis - Patents are complex; get professional counsel ❌ Trademark clearance - Trademarks require separate legal review ❌ Export control - ITAR/EAR compliance requires specialized counsel ❌ Industry-specific regulations - Medical (FDA), finance (SOX), etc. need domain specialists ❌ Contract negotiation - Commercial license agreements need lawyers

Scope

This skill focuses on:

• ✅ Open source license compliance (MIT, Apache, GPL, etc.)
• ✅ Third-party attribution requirements
• ✅ EULA template structure and common clauses
• ✅ Dependency scanning automation
• ✅ Best practices from industry sources

Sources & Attribution

This skill incorporates best practices and templates from:

• License Compliance:

  • AboutCode OSS Attribution Best Practices
  • Apache Licensing Howto
  • Google Open Source Licenses
  • Amazon OSS Attribution Builder

• EULA Templates:

  • TermsFeed EULA Guide
  • Termly EULA Resources
  • ComplyDog EULA Guide
  • Hyperstart EULA Best Practices

• Attribution UI:

  • Android AttributionPresenter
  • Amazon OSS Attribution Builder

All templates have been adapted for general use and are provided under the terms specified in LICENSE.

Related Resources

• SPDX License List - Standard license identifiers
• Choose a License - GitHub's license guide
• TLDRLegal - Software licenses in plain English
• FOSSology - Open source license scanning tool
• ScanCode Toolkit - Comprehensive license scanner

License

This skill is licensed under the MIT License (see LICENSE file).

Note: Replace placeholders in LICENSE before publishing.

You are free to:

• ✅ Use this skill for personal or commercial projects
• ✅ Modify templates for your specific needs
• ✅ Distribute copies with attribution

You must:

• ✅ Include the original MIT license and copyright notice
• ✅ Provide attribution to this repository

You cannot:

• ❌ Hold the author liable for damages
• ❌ Use this material as a substitute for legal advice

Disclaimer & Warranty

NO WARRANTY: This information is provided "as is" without warranty of any kind, express or implied. The author makes no representations or warranties about the accuracy, completeness, or suitability of this information.

NO LIABILITY: In no event shall the author be liable for any claim, damages, or other liability arising from the use of this information.

NOT LEGAL ADVICE: This skill does not create an attorney-client relationship. For legal matters, consult a licensed attorney in your jurisdiction.

Contributing

Contributions are welcome! If you find errors, outdated information, or want to add new templates:

1. Open an issue to discuss proposed changes
2. Submit a pull request with clear descriptions
3. Cite sources for any new legal/compliance information
4. Maintain the educational tone - this is a reference guide, not legal advice

Note: Contributions should focus on factual information, best practices, and template improvements. Legal interpretations should cite authoritative sources.

Changelog

v1.5.0 (2026-01-29)

• ✅ Added non-code asset audit (fonts, icons, images, datasets, ML models)
• ✅ Added bundled binaries & native libraries audit (DLL/.so/.dylib, embedded runtimes)
• ✅ Added third-party services & data disclosure (API terms, SaaS, datasets)
• ✅ Added OS-provided components disclosure (WebView2, GTK/Qt, system libraries)
• ✅ Added packaging surface checklist (Tauri, Electron, Docker, mobile, installers)
• ✅ Added risk/decision matrix (ship/disclose/remove/replace framework)
• ✅ Added platform-specific checklists (Electron, Avalonia, WPF)
• ✅ Expanded ecosystem coverage (Go, .NET/NuGet, Java/Gradle, Ruby, PHP, Swift, C++/vcpkg/Conan)

v1.4.0 (2026-01-29)

• ✅ Added third-party license bundling templates
• ✅ Added attribution UI examples (React, mobile, web)
• ✅ Added scan command examples (Node.js, Python, Rust)
• ✅ Clarified UI attribution scope (best practice vs requirement)
• ✅ Expanded license text guidance in templates

v1.3.1 (2026-01-29)

• ✅ Initial EULA template with regional compliance
• ✅ Clickwrap guidance and acceptance mechanisms
• ✅ Export control and data privacy sections

v1.0.0 (2025-12-15)

• ✅ Initial release with dependency scanning workflows
• ✅ License compatibility analysis
• ✅ Basic THIRD_PARTY_LICENSES.txt templates

Support & Questions

This resource is maintained by the author. For questions:

1. Check the SKILL.md guide - Most questions are answered there
2. Search existing issues - Your question may already be answered
3. Open a new issue - Provide context and specific questions

For legal questions: Consult a qualified attorney. This project cannot provide legal advice.

Acknowledgments

Thanks to the open source community for publishing licensing best practices, and to the organizations cited in Sources for making compliance resources freely available.

Version: 1.5.0 Last Updated: January 29, 2026 Author: Rajioba1 Repository: https://github.com/Rajioba1/managing-software-licensing

Remember: Licensing compliance is not one-size-fits-all. Use these templates as starting points, customize for your specific needs, and always get legal review before shipping production software.