chore(license): align repository compliance text (#3467)

Signed-off-by: John Myers <9696606+johntmyers@users.noreply.github.com>

CONTRIBUTING.md

@@ -551,7 +551,46 @@ chore(deps): bump tokio to 1.40
 
 ### DCO
 
-All human contributions must include a `Signed-off-by` line in each commit message. This certifies you have the right to submit the work under the project license. See the [Developer Certificate of Origin](https://developercertificate.org/). Dependabot-authored dependency update PRs are allowlisted because the bot cannot sign commits.
+All human contributions must include a `Signed-off-by` line in each commit message. This certifies you have the right to submit the work under the project license. Dependabot-authored dependency update PRs are allowlisted because the bot cannot sign commits.
+
+The project uses version 1.1 of the [Developer Certificate of Origin](https://developercertificate.org/):
+
+```text
+Developer Certificate of Origin
+Version 1.1
+
+Copyright (C) 2004, 2006 The Linux Foundation and its contributors.
+
+Everyone is permitted to copy and distribute verbatim copies of this
+license document, but changing it is not allowed.
+
+
+Developer's Certificate of Origin 1.1
+
+By making a contribution to this project, I certify that:
+
+(a) The contribution was created in whole or in part by me and I
+    have the right to submit it under the open source license
+    indicated in the file; or
+
+(b) The contribution is based upon previous work that, to the best
+    of my knowledge, is covered under an appropriate open source
+    license and I have the right under that license to submit that
+    work with modifications, whether created in whole or in part
+    by me, under the same open source license (unless I am
+    permitted to submit under a different license), as indicated
+    in the file; or
+
+(c) The contribution was provided directly to me by some other
+    person who certified (a), (b) or (c) and I have not modified
+    it.
+
+(d) I understand and agree that this project and the contribution
+    are public and that a record of the contribution (including all
+    personal information I submit with it, including my sign-off) is
+    maintained indefinitely and may be redistributed consistent with
+    this project or the open source license(s) involved.
+```
 
 ```bash
 git commit -s -m "feat(sandbox): add new capability"

LICENSE

@@ -1,3 +1,4 @@
+Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
 
                                  Apache License
                            Version 2.0, January 2004
@@ -176,7 +177,18 @@
 
    END OF TERMS AND CONDITIONS
 
-   Copyright 2025-2026 NVIDIA CORPORATION & AFFILIATES
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
 
    Licensed under the Apache License, Version 2.0 (the "License");
    you may not use this file except in compliance with the License.

crates/openshell-cli/src/output.rs

@@ -1,4 +1,4 @@
-// Copyright (C) 2025 NVIDIA Corporation
+// SPDX-FileCopyrightText: Copyright (c) 2025 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 //! Generic output formatting helpers for CLI commands.

deploy/deb/control.in

@@ -1,3 +1,6 @@
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
 Package: openshell
 Version: @VERSION@
 Architecture: @ARCH@

deploy/deb/openshell-gateway.service

@@ -1,3 +1,6 @@
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
 [Unit]
 Description=OpenShell Gateway
 Documentation=https://github.com/NVIDIA/OpenShell

deploy/helm/openshell-workspace/templates/_helpers.tpl

@@ -1,3 +1,6 @@
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
 {{/*
 Expand the name of the chart.
 */}}

deploy/helm/openshell/templates/_helpers.tpl

@@ -1,3 +1,6 @@
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
 {{/*
 Expand the name of the chart.
 */}}

e2e/kubernetes/openbao-tls-values.yaml

@@ -1,4 +1,4 @@
-# Copyright 2026 NVIDIA CORPORATION & AFFILIATES
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
 # SPDX-License-Identifier: Apache-2.0
 
 global:

scripts/bin/openshell

@@ -1,4 +1,8 @@
 #!/usr/bin/env bash
+
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
 set -e
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"

scripts/keycloak-realm.json.license

@@ -0,0 +1,2 @@
+SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+SPDX-License-Identifier: Apache-2.0

scripts/lint-mermaid/lint-mermaid.mjs

@@ -1,4 +1,8 @@
 #!/usr/bin/env node
+
+// SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
 // Validate ```mermaid fenced blocks in Markdown/MDX files using the official
 // mermaid parser. Line numbers in error output are offset back to the source
 // file so editors can jump to them.

scripts/update_license_headers.py

@@ -20,6 +20,7 @@ from __future__ import annotations
 
 import argparse
 import os
+import re
 import subprocess
 import sys
 from pathlib import Path
@@ -47,6 +48,26 @@ COMMENT_STYLES: dict[str, str] = {
     ".tsx": "//",
     ".mts": "//",
     ".cts": "//",
+    ".mjs": "//",
+    ".css": "/*",
+    ".in": "#",
+    ".service": "#",
+    ".tpl": "#",
+}
+
+# Extensionless source files that cannot be identified by suffix.
+FILE_COMMENT_STYLES: dict[str, str] = {
+    "scripts/bin/openshell": "#",
+}
+
+# Strict JSON does not support comments. Keep SPDX data in REUSE-compatible
+# sidecars so these files remain valid inputs to their consumers.
+SIDECAR_LICENSE_FILES: set[str] = {
+    "scripts/keycloak-realm.json",
+    "sdk/conformance/oauth-client-credentials.json",
+    "sdk/typescript/biome.json",
+    "sdk/typescript/tsconfig.build.json",
+    "sdk/typescript/tsconfig.json",
 }
 
 # Directories to skip entirely (relative to repo root).
@@ -83,6 +104,13 @@ EXCLUDE_DIR_PREFIXES: tuple[str, ...] = (
 
 def make_header(comment: str) -> str:
     """Return the two-line SPDX header for a given comment prefix."""
+    if comment == "/*":
+        return (
+            "/*\n"
+            f" * SPDX-FileCopyrightText: {COPYRIGHT_TEXT}\n"
+            f" * SPDX-License-Identifier: {LICENSE_ID}\n"
+            " */\n"
+        )
     return (
         f"{comment} SPDX-FileCopyrightText: {COPYRIGHT_TEXT}\n"
         f"{comment} SPDX-License-Identifier: {LICENSE_ID}\n"
@@ -173,6 +201,8 @@ def is_dockerfile(path: Path) -> bool:
 
 def get_comment_style(path: Path) -> str | None:
     """Return the comment prefix for a file, or None if unsupported."""
+    if path.as_posix() in FILE_COMMENT_STYLES:
+        return FILE_COMMENT_STYLES[path.as_posix()]
     if is_dockerfile(path):
         return "#"
     return COMMENT_STYLES.get(path.suffix)
@@ -190,7 +220,10 @@ def discover_files(root: Path) -> list[Path]:
                 continue
             if is_excluded(rel):
                 continue
-            if get_comment_style(rel) is not None:
+            if (
+                get_comment_style(rel) is not None
+                or rel.as_posix() in SIDECAR_LICENSE_FILES
+            ):
                 results.append(path)
         return sorted(results)
 
@@ -205,7 +238,10 @@ def discover_files(root: Path) -> list[Path]:
             rel = fpath.relative_to(root)
             if is_excluded(rel):
                 continue
-            if get_comment_style(rel) is not None:
+            if (
+                get_comment_style(rel) is not None
+                or rel.as_posix() in SIDECAR_LICENSE_FILES
+            ):
                 results.append(fpath)
 
     return sorted(results)
@@ -216,11 +252,20 @@ def discover_files(root: Path) -> list[Path]:
 # ---------------------------------------------------------------------------
 
 SPDX_MARKER = "SPDX-License-Identifier"
+SPDX_COPYRIGHT_RE = re.compile(
+    r"SPDX-FileCopyrightText: Copyright \(c\) \d{4}(?:-\d{4})? "
+    r"NVIDIA CORPORATION & AFFILIATES\. All rights reserved\."
+)
 
 
 def has_header(lines: list[str]) -> bool:
-    """Check if the SPDX header is present in the first 10 lines."""
-    return any(SPDX_MARKER in line for line in lines[:10])
+    """Check if the complete NVIDIA SPDX header is in the first 10 lines."""
+    header_lines = lines[:10]
+    has_license = any(
+        f"{SPDX_MARKER}: {LICENSE_ID}" in line for line in header_lines
+    )
+    has_copyright = any(SPDX_COPYRIGHT_RE.search(line) for line in header_lines)
+    return has_license and has_copyright
 
 
 def find_insertion_point(lines: list[str], path: Path) -> int:
@@ -276,6 +321,30 @@ def insert_header(content: str, comment: str, path: Path) -> str:
 def process_file(path: Path, root: Path, *, check: bool, verbose: bool) -> bool:
     """Process a single file. Returns True if the file is compliant."""
     rel = path.relative_to(root)
+
+    if rel.as_posix() in SIDECAR_LICENSE_FILES:
+        sidecar = path.with_name(f"{path.name}.license")
+        lines = (
+            sidecar.read_text(encoding="utf-8").splitlines()
+            if sidecar.exists()
+            else []
+        )
+        if has_header(lines):
+            if verbose:
+                print(f"  ok: {rel} ({sidecar.name})")
+            return True
+        if check:
+            print(f"  MISSING: {rel} ({sidecar.name})")
+            return False
+        sidecar.write_text(
+            f"SPDX-FileCopyrightText: {COPYRIGHT_TEXT}\n"
+            f"SPDX-License-Identifier: {LICENSE_ID}\n",
+            encoding="utf-8",
+        )
+        if verbose:
+            print(f"  added: {rel} ({sidecar.name})")
+        return True
+
     comment = get_comment_style(rel)
     if comment is None:
         return True
@@ -338,7 +407,10 @@ def main() -> int:
                 continue
             if is_excluded(rel) or is_git_ignored(root, rel):
                 continue
-            if get_comment_style(rel) is not None:
+            if (
+                get_comment_style(rel) is not None
+                or rel.as_posix() in SIDECAR_LICENSE_FILES
+            ):
                 files.append(p)
     else:
         files = discover_files(root)

sdk/conformance/oauth-client-credentials.json.license

@@ -0,0 +1,2 @@
+SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+SPDX-License-Identifier: Apache-2.0

sdk/go/docs/theme/custom.css

@@ -1,3 +1,8 @@
+/*
+ * SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
 /* OpenShell Go SDK - Custom Typography
  *
  * Font: Inter from Google Fonts CDN

sdk/typescript/biome.json.license

@@ -0,0 +1,2 @@
+SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+SPDX-License-Identifier: Apache-2.0

sdk/typescript/tsconfig.build.json.license

@@ -0,0 +1,2 @@
+SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+SPDX-License-Identifier: Apache-2.0

sdk/typescript/tsconfig.json.license

@@ -0,0 +1,2 @@
+SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+SPDX-License-Identifier: Apache-2.0