Missing Copyright Or Licence Header
ID |
kotlin.track_lack_copyright_license_headers |
Severity |
high |
Remediation Complexity |
medium |
Remediation Risk |
low |
Remediation Effort |
medium |
Resource |
Code Smell |
Language |
Kotlin |
Tags |
best-practice, code-style |
Description
Reports a Kotlin source file whose leading comment block — the comments above the package
clause, the @file: annotations or the first declaration, whichever comes first — does not carry
the project’s copyright or licence notice.
What counts as a header is a project decision, so the notice is supplied as a regular expression
in the headerPattern property. It ships matching the two notices in general use — an SPDX
identifier, or a copyright line in any spelling and any case — so the rule is silent on a project
that carries either and reports the files that carry neither. Replace it with the notice the
project enforces. An empty pattern turns the rule off: that is the escape hatch for a project
with no header policy, where flagging every one of its files would be pure noise.
Both comment forms count, so a // run and a block or KDoc comment are equally good places for
the notice. Kotlin has no generated-code marker convention of its own, so no file is exempted on
that ground — a project that generates Kotlin sources excludes them by path instead.
Rationale
A file with no header leaves its ownership and its redistribution terms undeclared. Source files
travel on their own: they get vendored, copied into a snippet, pasted into an issue, or shipped
inside a container image. Once separated from the repository’s LICENSE file, an unheaded file
carries no evidence of the terms it was released under.
That has concrete consequences. Licence-compliance scans and SPDX inventories read per-file notices, so an unheaded file shows up as unknown-licence and blocks the release. Contributors cannot tell whether a file is safe to reuse. And in a repository that mixes licences — a vendored third-party directory, a dual-licensed module — the absence of a header is genuinely ambiguous rather than merely untidy.
package com.example.billing // FLAW -- no copyright or licence notice anywhere above the package clause
fun charge(amount: Int): Int = amount
Remediation
Add the project’s notice as a comment block at the very top of the file. A file annotation or a
shebang line may sit between the notice and the package clause; the pattern is searched anywhere
in the leading block, so any order matches.
// Copyright 2026 Example Corp.
// SPDX-License-Identifier: Apache-2.0
package com.example.billing
fun charge(amount: Int): Int = amount
Adding headers across an existing repository is mechanical and worth automating — addlicense,
reuse and similar tools insert the block in place. Most IDEs also apply a copyright profile to
every new file, which keeps the problem from coming back.
Configuration
| Property | Default | Description |
|---|---|---|
|
|
Regular expression searched inside the file’s leading comment block. The default matches an SPDX
identifier or a copyright line in any spelling and any case — |