[Bugs5382]

What and why

One licensing PR for CNCF readiness: the verbatim Apache 2.0 LICENSE, NOTICE, the README licence line and every source header, in one change (owner decision; this folds in #41, which only replaced LICENSE). It matches the combined PRs in the code repos: CryptOS-PKI/cryptos-node#291, CryptOS-PKI/api#126, CryptOS-PKI/cryptos-manager#132, CryptOS-PKI/cryptos-web#134 and CryptOS-PKI/helm#26.

The copyright notice follows the CNCF guidance (cncf/foundation copyright-notices.md): "Copyright The XYZ Authors.", with no year and no single holder name.

Refs CryptOS-PKI/.github#4

1. LICENSE: the verbatim Apache License 2.0 text

LICENSE is now the text published at https://www.apache.org/licenses/LICENSE-2.0.txt, byte for byte (sha256 cfc7749b96f63bd31c3c42b5c471bf756814053e847c10f3eb003417bc523d30), the same file CryptOS-PKI/.github#6, CryptOS-PKI/cryptos-lab#3 and the code repos carry. The old file had sections 6 and 9 and the appendix reworded, and the appendix filled in with a copyright line, so GitHub reported NOASSERTION. On this branch GitHub detects Apache-2.0 (GET /repos/CryptOS-PKI/docs/license?ref=chore/4-cncf-licensing).

What the old file said that the published text does not (- old, + verbatim):

--- LICENSE (before)
+++ LICENSE (after)
@@ -1,3 +1,4 @@
+
                                  Apache License
                            Version 2.0, January 2004
                         http://www.apache.org/licenses/
@@ -137,8 +138,8 @@
 
    6. Trademarks. This License does not grant permission to use the trade
       names, trademarks, service marks, or product names of the Licensor,
-      except as required for describing the origin of the Work and
-      reproducing the content of the NOTICE file.
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
 
    7. Disclaimer of Warranty. Unless required by applicable law or
       agreed to in writing, Licensor provides the Work (and each
@@ -162,15 +163,16 @@
       other commercial damages or losses), even if such Contributor
       has been advised of the possibility of such damages.
 
-   9. Accepting Warranty or Support. While redistributing the Work or
-      Derivative Works thereof, You may accept support, warranty,
-      indemnity, or other liability obligations and/or rights consistent
-      with this License. However, in accepting such obligations, You may
-      act only on Your own behalf and on Your sole responsibility, not on
-      behalf of any other Contributor, and only if You agree to indemnify,
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
       defend, and hold each Contributor harmless for any liability
       incurred by, or claims asserted against, such Contributor by reason
-      of your accepting any such warranty or support.
+      of your accepting any such warranty or additional liability.
 
    END OF TERMS AND CONDITIONS
 
@@ -181,11 +183,11 @@
       replaced with your own identifying information. (Don't include
       the brackets!)  The text should be enclosed in the appropriate
       comment syntax for the file format. We also recommend that a
-      file's name and copyright notice be included on the same "page"
-      as the copyright notice for easier identification within third-party
-      archives.
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
 
-   Copyright 2026 Shane
+   Copyright [yyyy] [name of copyright owner]
 
    Licensed under the Apache License, Version 2.0 (the "License");
    you may not use this file except in compliance with the License.

2. NOTICE and README

NOTICE line 2 and the README licence line now say Copyright The CryptOS Authors.. NOTICE keeps the attribution.

3. Source headers

The four hand-stamped sources (docusaurus.config.ts, sidebars.ts, src/pages/index.tsx, src/components/HomepageFeatures/index.tsx) go straight to the final header, the verbatim Apache 2.0 appendix notice with the CNCF copyright line. docs has no .golic.yaml, so they were edited by hand; the golic-managed files in the code repos carry the same text:

 /*
-Apache License 2.0
-
-Copyright 2026 Shane
+Copyright The CryptOS Authors.

 Licensed under the Apache License, Version 2.0 (the "License");
 ...
 limitations under the License.
 */

The site footer (Copyright © <year> Shane in docusaurus.config.ts) is left to the theme change in #38.

4. Taskfile and CI

• Taskfile.yml pins golic v1.2.0 (go install github.com/Bugs5382/golic/cmd/golic@v1.2.0, in license and license:fix; it was v0.3.0). golic v1.2.0 renders apache2 as the verbatim notice these four files already carry, so the GoLic check now passes.
• license (the CI check) is golic inject -t apache2 -c "The CryptOS Authors." --license-file --dry -x, and license:fix is the same without --dry -x. --license-file makes golic check LICENSE against the official Apache 2.0 text too, so a reworded LICENSE fails CI. The task descriptions say so.
• .github/workflows/job-golic.yaml runs task license, so it follows the Taskfile: it has no golic version or template of its own. Unchanged.
• The dependency licence check (the license-checker-rseidelsohn allowlist in job-license-check-npm.yaml) checks third-party npm dependencies, not this repo's own LICENSE or headers, and Apache-2.0 is already allowed, so it is unaffected and unchanged.

The license page on #28 now shows the same copyright line and header (commit bdc6ee2).

Verification

• LICENSE is byte for byte the published text (sha256 above), and golic's --license-file check agrees
• GitHub licence API on this branch reports Apache-2.0
• golic inject -t apache2 -c "The CryptOS Authors." --license-file --dry -x: exit 0, 0/4 changed; a second inject -x changes 0 files
• task license: exit 0
• npm run typecheck and npm run build pass
• Pre-push checks pass

How this was verified

shasum -a 256 LICENSE matches curl -sSL https://www.apache.org/licenses/LICENSE-2.0.txt | shasum -a 256, and gh api "repos/CryptOS-PKI/docs/license?ref=chore/4-cncf-licensing" returns spdx_id: Apache-2.0. With golic v1.2.0, task license exits 0 with 0/4 changed, a second golic inject ... --license-file -x changes nothing, and a deliberately edited LICENSE makes the check exit 1. npm ci --ignore-scripts, npm run typecheck and npm run build pass. git diff origin/main...HEAD touches 8 files: LICENSE, NOTICE, README.md, Taskfile.yml and the four source headers. git grep "2026 Shane" finds nothing; the site footer (Copyright © <year> Shane) is left to #38.

---

Before merging: add a closing comment summarizing what was actually done in this PR
(not just the checked boxes).

[Bugs5382]

Closing summary: brought up to date with main (6 commits since the pin, including the theme and the alpha page rewrite). Main added src/css/theme.css with the old header, outside golic's allow-list, so its header was fixed by hand to match the other sources; that commit changes header lines only. task license and the site build pass locally, and CI is green (build site, licence headers, DCO).