Conformance
Ten checks, nine of them a script can run.
Each check is verifiable by a third party against a public repository, without contacting us. A conformance result describes one commit, expires when the licence files change, and costs nothing.
- Levels
- 3
- Checks
- 10
- Automatable
- 9
- Fee
- None
Levels
Three levels, each a superset of the last.
The artifact says which instrument governs it, and says it in a machine-readable place.
Checks 1 to 3
3 checks
Every obligation the instrument imposes has a corresponding artifact in the repository.
Checks 1 to 7
7 checks
The declared text matches the published bytes, and the provenance chain resolves end to end.
All checks
10 checks
Checks
What each check asserts and how it is verified.
Check 10 is the only one requiring judgement. The rest are mechanical.
A LICENSE file exists at the repository root
The file contains the canonical text of exactly one instrument version.
How
Fetch the file. It is present and non-empty.
The instrument and version are identifiable
The text names the instrument, its version and its canonical URL.
How
The identifier block resolves to a version on the OpenRoots registry.
Package metadata declares the same instrument
Where the ecosystem has a licence field, it carries the matching SPDX LicenseRef string.
How
Read package.json, pyproject.toml, Cargo.toml or the ecosystem equivalent and compare against the LICENSE file.
A NOTICE file carries version and attribution records
The NOTICE names the licensor, the instrument, the version, the canonical URL, and any upstream third-party notices.
How
Parse the NOTICE. Each named upstream component has a source URL, copyright notice, and licence reference.
No fallback conversion is claimed
Current OpenRoots notices must not state that the work converts to Apache, MIT, Creative Commons, or another fallback licence by time alone.
How
Read LICENSE, NOTICE, README, package metadata and public docs for automatic conversion claims.
A prior licence, where one existed, is preserved
If the work was previously distributed under another licence, the LICENSE carries a prior-licence notice stating that the earlier grant is irrevocable for versions released under it.
How
Read the git history for a preceding LICENSE. If one exists, the notice must be present.
Artifact-specific obligations are discharged
ORD preserves and extends provenance records; ORM identifies the base model, modification, and data categories; ORA preserves manifest attribution and states the validated runtime; ORL identifies altered portions when distributing a Modification.
How
Match the artifact-specific Section 8 duties to a discoverable record; filenames and document formats are recommendations, not additional legal requirements.
The licence text matches the published digest
The SHA-256 of the LICENSE file equals the digest published for that instrument version.
How
Hash the file and compare against the registry. A mismatch means the text is not the instrument.
The provenance chain resolves
Every input named in the provenance manifest resolves to a reachable artifact under a stated instrument.
How
Walk the manifest. Each input URL returns a licence and an identifier.
Commercialization is classified correctly
Any commercialization of the Work is documented as a Section 4.2 carve-out or is backed by the separate written agreement Section 4.1 requires.
How
Review the product, service, deployment ownership, and marketplace structure against Sections 1.13, 1.15, and 4. This check requires judgement.
Result
The shape a conformance result takes.
{
"$schema": "https://openroots.org/schema/conformance.schema.json",
"subject": {
"repository": "https://github.com/OWNER/REPO",
"commit": "COMMIT-SHA"
},
"instrument": "ORL-2.2",
"level": "verified",
"checkedAt": "YYYY-MM-DDTHH:MM:SSZ",
"checks": [
{
"id": "C1",
"result": "pass"
},
{
"id": "C8",
"result": "pass",
"digest": "SHA-256"
},
{
"id": "C10",
"result": "pass",
"method": "manual"
}
],
"expiresOn": "the next change to LICENSE, NOTICE or package licence metadata"
}Expiry
What withdraws a result.
- 01A conformance result is a statement about a specific commit, never about a project.
- 02It expires when the repository changes the LICENSE, the NOTICE, or the package licence field.
- 03It is withdrawn on a failed re-check, and the withdrawal is recorded with the check that failed.
- 04No fee is charged, so nothing is refunded and nothing is owed on withdrawal.
The certification position on SPDX is at /certification and /spdx.