From 74a6c435944e6021b10c79d97eb3d89f414e98ef Mon Sep 17 00:00:00 2001
From: Doreen <seider.doreen@gmail.com>
Date: Tue, 22 Sep 2026 11:47:45 +0200
Subject: [PATCH 1/2] chore: keep templating in the LICENSE file

---
 LICENSE | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/LICENSE b/LICENSE
index 4f62093..261eeb9 100644
--- a/LICENSE
+++ b/LICENSE
@@ -186,7 +186,7 @@
       same "printed page" as the copyright notice for easier
       identification within third-party archives.
 
-   Copyright 2026 Open Defense Cloud contributors
+   Copyright [yyyy] [name of copyright owner]
 
    Licensed under the Apache License, Version 2.0 (the "License");
    you may not use this file except in compliance with the License.

From f0d600005f7a68b1096ac6dfd3ae3dc2efbb65cc Mon Sep 17 00:00:00 2001
From: Doreen <seider.doreen@gmail.com>
Date: Tue, 22 Sep 2026 11:49:24 +0200
Subject: [PATCH 2/2] feat: check headers regarding copyright and license, not
 just header presence

---
 common.mk | 28 +++++++++++++++++++++++++++-
 1 file changed, 27 insertions(+), 1 deletion(-)

diff --git a/common.mk b/common.mk
index 9e468d3..da0cf6f 100644
--- a/common.mk
+++ b/common.mk
@@ -135,14 +135,40 @@ OSV_SCANNER_CONFIG ?= ./.osv-scanner.toml
 scan: $(OSV_SCANNER)  ## scan for vulnerabilities
 	$(OSV_SCANNER) scan --config $(OSV_SCANNER_CONFIG) -r .
 
+# Files subject to a license header: everything matching `pattern`, minus
+# generated files.
+addlicense_files = git ls-files '$(pattern)' | (xargs -r grep -L -E '^(//|\#) Code generated .* DO NOT EDIT\.$$' || true)
+
+# The SPDX identifier expected in the header, and what addlicense writes for
+# `license=apache`. Override `spdx` should a repository ever use another one.
+spdx ?= Apache-2.0
+
+# addlicense with -check, only ever sees a *missing* header, never an outdated
+# one, and it never inspects the SPDX line at all; 
+# `|| true` because grep -L exits 1 when it selects nothing, which
+# .SHELLFLAGS = -ec would make fatal.
+addlicense_mismatch = $$({ $(addlicense_files) | xargs -r grep -L -F 'Copyright $(comment)' || true; \
+	$(addlicense_files) | xargs -r grep -L -F 'SPDX-License-Identifier: $(spdx)' || true; } | sort -u)
+
 .PHONY: addlicense
 addlicense: $(ADDLICENSE)  ## Add License headers containing of `license` and `comment` to files matched by `pattern`.
 	@test -n "$(license)" && test -n "$(comment)" && test -n "$(pattern)" && \
-		git ls-files '$(pattern)' | xargs -r $(ADDLICENSE) -c '$(comment)' -l '$(license)' -s=only $(extraargs)
+		$(addlicense_files) | xargs -r $(ADDLICENSE) -c '$(comment)' -l '$(license)' -s=only -y '' $(extraargs)
+
+.PHONY: addlicense-list
+addlicense-list:  ## List files matched by `pattern` whose header does not carry `Copyright $(comment)` and `SPDX-License-Identifier: $(spdx)`.
+	@test -n "$(comment)" && test -n "$(pattern)"
+	@files=$(addlicense_mismatch); \
+	if [ -n "$$files" ]; then \
+		echo "Unexpected license header, expected 'Copyright $(comment)' and 'SPDX-License-Identifier: $(spdx)':"; \
+		echo "$$files" | sed 's/^/  /'; \
+	fi
 
 .PHONY: addlicense-check
 addlicense-check:
 	$(MAKE) addlicense extraargs='-check'
+	@$(MAKE) addlicense-list
+	@test -z "$(addlicense_mismatch)"
 
 # Local dev environment
 .PHONY: setup-local-cluster