⚖️ License
CryptOS is open source under the Apache License, Version 2.0. You can use it, change it and redistribute it, including commercially, as long as you keep the license and notices with it.
Which repos carry which license
| Repo | License | Files |
|---|---|---|
| cryptos-node | Apache License 2.0 | LICENSE, NOTICE |
| api (archived) | Apache License 2.0 | LICENSE, NOTICE |
| cryptos-manager | Apache License 2.0 | LICENSE, NOTICE |
| cryptos-web | Apache License 2.0 | LICENSE, NOTICE |
| website (this site and the product site) | Apache License 2.0 | LICENSE, NOTICE |
| cryptos-lab | Apache License 2.0 | LICENSE, NOTICE |
| .github | Apache License 2.0 | LICENSE |
Every repo's LICENSE file is the Apache License 2.0 text exactly as published at apache.org/licenses/LICENSE-2.0.txt, with nothing reworded or filled in, so GitHub and other license scanners detect it as Apache-2.0. The copyright line lives in NOTICE, not in LICENSE.
Copyright
Copyright The CryptOS Authors.
This follows the CNCF's recommended form (copyright notices): no year and no single holder name, so the notice stays the same as contributors join.
Each code repo has a NOTICE file in this form, with its own repo name on the first line:
CryptOS-PKI / cryptos
Copyright The CryptOS Authors.
This product includes software developed as part of the CryptOS-PKI project
(https://github.com/CryptOS-PKI).
Section 4 of the license asks you to keep this notice when you redistribute the work or something built from it.
License headers in source files
Source files carry the notice from the appendix of the Apache License 2.0, word for word, with the CryptOS copyright line. In Go files it is a block comment after the package line; in YAML it is a # comment block:
Copyright The CryptOS Authors.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
The headers are managed with golic. Each repo's .golic.yaml and .licignore say which files get one, task license checks every header and that LICENSE is the verbatim text, and task license:fix adds any missing header. If you contribute, run task license:fix before you push; each repo's CI runs task license on pull requests.
Third-party code
CryptOS uses open source libraries, and each keeps its own license. On each pull request, CI checks the third-party Go modules and production npm packages against an allowlist, and fails if one carries any other license:
| Repo | Checked | Allowed licenses |
|---|---|---|
| cryptos | Go modules | MIT, ISC, Apache-2.0, BSD-2-Clause, BSD-3-Clause, 0BSD, CC0-1.0, Unlicense, MPL-2.0, CC-BY-4.0 |
| api | Go modules | MIT, ISC, Apache-2.0, BSD-2-Clause, BSD-3-Clause, 0BSD, CC0-1.0, Unlicense, MPL-2.0, CC-BY-4.0 |
| manager | Go modules | MIT, ISC, Apache-2.0, BSD-2-Clause, BSD-3-Clause, 0BSD, CC0-1.0, Unlicense, MPL-2.0, CC-BY-4.0 |
| web | npm packages | MIT, ISC, Apache-2.0, BSD-2-Clause, BSD-3-Clause, 0BSD, CC0-1.0, Unlicense, BlueOak-1.0.0, Python-2.0, MPL-2.0, CC-BY-4.0, OFL-1.1 |
| docs | npm packages | MIT, ISC, Apache-2.0, BSD-2-Clause, BSD-3-Clause, 0BSD, CC0-1.0, Unlicense, BlueOak-1.0.0, Python-2.0, MPL-2.0, CC-BY-4.0 |
web also allows OFL-1.1, the license of the Inter and JetBrains Mono fonts it bundles instead of loading them from a CDN. The helm chart has no third-party dependencies to check.
A CryptOS image built from cryptos also contains third-party components built from their own sources, most notably the Linux kernel, and the disk tools that build/ packages (cryptsetup, dosfstools, e2fsprogs and gptfdisk). Those keep their own licenses, not Apache 2.0. The allowlist check above covers Go and npm dependencies only.
Read the license
The full text is in each repo's LICENSE file, and at apache.org/licenses/LICENSE-2.0.