[Bugs5382]

What and why

One licensing PR for CNCF readiness: the verbatim Apache 2.0 LICENSE, NOTICE, the README licence line and every source header, in one change (owner decision; this folds in #132, which only replaced LICENSE).

The copyright notice follows the CNCF guidance (cncf/foundation copyright-notices.md): "Copyright The XYZ Authors.", with no year and no single holder name.

Refs CryptOS-PKI/.github#4

1. LICENSE: the verbatim Apache License 2.0 text

LICENSE is now the text published at https://www.apache.org/licenses/LICENSE-2.0.txt, byte for byte (sha256 cfc7749b96f63bd31c3c42b5c471bf756814053e847c10f3eb003417bc523d30), the same file CryptOS-PKI/.github#6 and CryptOS-PKI/cryptos-lab#3 add. The old file had sections 6 and 9 and the appendix reworded, and the appendix filled in with a copyright line, so GitHub reported NOASSERTION for this repo. On this branch GitHub detects Apache-2.0 (GET /repos/CryptOS-PKI/web/license?ref=chore/4-cncf-source-headers).

What the old file said that the published text does not (- old, + verbatim):

--- LICENSE (before)
+++ LICENSE (after)
@@ -1,3 +1,4 @@
+
                                  Apache License
                            Version 2.0, January 2004
                         http://www.apache.org/licenses/
@@ -137,8 +138,8 @@
 
    6. Trademarks. This License does not grant permission to use the trade
       names, trademarks, service marks, or product names of the Licensor,
-      except as required for describing the origin of the Work and
-      reproducing the content of the NOTICE file.
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
 
    7. Disclaimer of Warranty. Unless required by applicable law or
       agreed to in writing, Licensor provides the Work (and each
@@ -162,15 +163,16 @@
       other commercial damages or losses), even if such Contributor
       has been advised of the possibility of such damages.
 
-   9. Accepting Warranty or Support. While redistributing the Work or
-      Derivative Works thereof, You may accept support, warranty,
-      indemnity, or other liability obligations and/or rights consistent
-      with this License. However, in accepting such obligations, You may
-      act only on Your own behalf and on Your sole responsibility, not on
-      behalf of any other Contributor, and only if You agree to indemnify,
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
       defend, and hold each Contributor harmless for any liability
       incurred by, or claims asserted against, such Contributor by reason
-      of your accepting any such warranty or support.
+      of your accepting any such warranty or additional liability.
 
    END OF TERMS AND CONDITIONS
 
@@ -181,11 +183,11 @@
       replaced with your own identifying information. (Don't include
       the brackets!)  The text should be enclosed in the appropriate
       comment syntax for the file format. We also recommend that a
-      file's name and copyright notice be included on the same "page"
-      as the copyright notice for easier identification within third-party
-      archives.
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
 
-   Copyright 2026 Shane
+   Copyright [yyyy] [name of copyright owner]
 
    Licensed under the Apache License, Version 2.0 (the "License");
    you may not use this file except in compliance with the License.

2. NOTICE and README

NOTICE line 2 and the README licence line now say Copyright The CryptOS Authors.. NOTICE keeps the attribution.

3. Source headers

Every source header is now the verbatim notice from the appendix of the Apache License 2.0, with the CNCF copyright line and no title line:

Copyright The CryptOS Authors.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.

Against the old header, the title line and its blank line go and the copyright line changes. No other line in any file changes:

-Apache License 2.0
-
-Copyright 2026 Shane
+Copyright The CryptOS Authors.

 Licensed under the Apache License, Version 2.0 (the "License");
 ...
 limitations under the License.

• Stamped with golic v1.2.0, whose apache2 template is that verbatim notice: golic replace -t apache2 -c "The CryptOS Authors." swaps the header golic wrote for the new one in place and keeps the bytes around it. 175 golic-managed files.
• The interim re-stamp (62be158, which kept the title line) is undone by a revert commit (ff5e954), not a force-push, and the apache2-cncf licence it relied on is gone from .golic.yaml, so .golic.yaml is back to its main content.
• src/index.css carries a hand-maintained header (.css is outside .licignore) and got the same edit by hand.
• golic v1.2.0 skips **/*.d.ts by default, which would have dropped src/vite-env.d.ts (hand-written, stamped until now) out of the check. .licignore opts that one file back in by path (!src/vite-env.d.ts), so golic still manages 175 files, as it did under v0.3.0.
• Checked line by line: every changed source file has exactly one hunk, directly under the comment opener (or at the top of a # file), removing Apache License 2.0, its blank line and Copyright 2026 Shane, and adding Copyright The CryptOS Authors. Nothing else changed.

4. Taskfile and CI

• Taskfile.yml pins golic v1.2.0 (go install github.com/Bugs5382/golic/cmd/golic@v1.2.0, in license and license:fix; it was v0.3.0). That is the only golic pin: CI installs golic through task license, and go install checks the module against the Go checksum database.
• license (the CI check) is golic inject -t apache2 -c "The CryptOS Authors." --license-file --dry -x, and license:fix is the same without --dry -x. --license-file makes golic check LICENSE against the official Apache 2.0 text too, so a reworded LICENSE fails CI. The task descriptions say so.
• .github/workflows/job-golic.yaml runs task license, so it follows the Taskfile: it has no golic version or template of its own.
• The dependency licence checks (the license-checker-rseidelsohn allowlist in job-license-check-npm.yaml) check third-party dependencies, not this repo's own LICENSE or headers, and Apache-2.0 is already on the allowlist, so they are unaffected and unchanged.

Merge last, after the open PRs in this repo. It touches nearly every source file, so it conflicts with every open PR. After it merges, each open PR rebases and runs the same golic replace -t apache2 -c "The CryptOS Authors." line with the pinned golic.

No docs change in this repo: the license page on CryptOS-PKI/docs#28 shows this copyright line and header (commit bdc6ee2), and CryptOS-PKI/docs#46 moves the docs repo itself to the same text.

Verification

• LICENSE is byte for byte the published text (sha256 above), and golic's --license-file check agrees
• GitHub licence API on this branch reports Apache-2.0
• golic replace -t apache2 -c "The CryptOS Authors." --dry listed 174/174, plus src/vite-env.d.ts (1/175) once .licignore opted it back in, and the real run changed only the header lines (checked hunk by hunk)
• golic inject -t apache2 -c "The CryptOS Authors." --license-file --dry -x: exit 0, 0/175 changed; a second inject -x and a second replace -x both change 0 files
• task license: exit 0
• Pre-push hook (npm run lint, npm test) passed on push, and npm run build passes.

How this was verified

shasum -a 256 LICENSE matches curl -sSL https://www.apache.org/licenses/LICENSE-2.0.txt | shasum -a 256, and gh api "repos/CryptOS-PKI/web/license?ref=chore/4-cncf-source-headers" returns spdx_id: Apache-2.0. golic v1.2.0 replace --dry first, then the real run; git diff -U0 over the source files shows only -Apache License 2.0, - (or -#), -Copyright 2026 Shane and +Copyright The CryptOS Authors., one hunk per file. The check and the second runs above all exit 0 with nothing to change. git diff origin/main...HEAD touches 181 files: the 175 golic-managed headers, the hand-maintained headers, LICENSE, NOTICE, the README licence line, Taskfile.yml and .licignore.

---

Before merging: add a closing comment summarizing what was actually done in this PR
(not just the checked boxes).

[Bugs5382]

Staying in draft until the next golic release. golic's apache2 template is changing to the verbatim Apache 2.0 appendix notice, which drops the "Apache License 2.0" title line. The target header for CryptOS becomes Copyright The CryptOS Authors. followed by the standard "Licensed under the Apache License, Version 2.0 ..." block, with no title line and no year.

The re-stamp in this branch still has the title line, so it will be redone with the new golic: golic replace -t apache2 -c "The CryptOS Authors.", dropping the local apache2-cncf licence and bumping the Taskfile pin. The NOTICE and README changes stay as they are.

One requirement for that release: in golic v1.1.0, replace strips any leading comment block, not only the known header. A dry run on this org deleted two real comment lines under the header in helm charts/manager/values.yaml, added a blank line after the header in 26 cryptos doc.go-style files, and removed the blank line after the header in 171 web files. The new release needs replace to strip exactly the header it recognizes and keep the spacing. The re-stamp waits until that's fixed.

[Bugs5382]

Closing summary: brought up to date with main (4 commits since the re-stamp). Main added no new source files, so no re-stamp was needed. task license, lint, the test suite and the build pass locally, and CI is green (web validation, licence headers, DCO).