# License Policy

Buildchain is released under the [Apache License 2.0](LICENSE).

This page explains how that license is applied across the public repository and
how contributions are accepted.

## Project license

Unless a file says otherwise, source code, examples, documentation, build
scripts, tests, workflow files, and repository metadata in this repository are
licensed under Apache-2.0.

Package manifests in this repository should use:

```json
"license": "Apache-2.0"
```

## Contributions

Buildchain uses the Developer Certificate of Origin (DCO), not a Contributor
License Agreement (CLA).

By contributing, you certify that you have the right to submit the contribution
under Apache-2.0 and that it may be distributed as part of Buildchain under that
license. Each commit in a pull request must include a DCO sign-off line:

```text
Signed-off-by: Your Name <you@example.com>
```

Use `git commit -s` to add this automatically.

## Trademarks and brand names

Apache-2.0 grants copyright and patent permissions. It does not grant trademark
rights. Names, logos, domain names, and product marks such as "Kungfu" and
"Buildchain" may be governed by separate brand guidelines.

See [TRADEMARK.md](TRADEMARK.md) for the official project mark and fork identity
boundary.

## Hosted and commercial services

The open source license covers this repository. Hosted services, team features,
enterprise support, managed deployments, commercial connectors, or other
services offered by the project maintainers may use separate terms.

See [ACCEPTABLE_USE.md](ACCEPTABLE_USE.md) for acceptable use of official hosted,
managed, or maintainer-operated services.

## Upstream provider integrations

Official Buildchain integrations should use documented provider APIs, workflow
surfaces, package-registry flows, cloud APIs, OIDC, and least-privilege
credentials. They should not bypass provider protections, hide credential
boundaries, or forge release evidence.

See [PROVIDER_COMPLIANCE.md](PROVIDER_COMPLIANCE.md) for the official provider
integration posture.

## Third-party software

Buildchain depends on third-party software. Source dependencies are declared in
the repository manifests and lockfiles. Binary or bundled release artifacts must
include the third-party notices and license information required by the
components they redistribute.