synapsecommand-public
Copyright 2026 Decent Cybersecurity s.r.o.

Licensed under the Apache License, Version 2.0 (the "License"); you may not use
this work except in compliance with the License. You may obtain a copy of the
License in the LICENSE file at the root of this repository, or at:

    http://www.apache.org/licenses/LICENSE-2.0

--------------------------------------------------------------------------------
WHY THIS FILE AND NOT THE APPENDIX IN LICENSE

Apache-2.0's APPENDIX is a TEMPLATE FOR PER-FILE HEADERS — "attach the following
boilerplate notice, with the fields enclosed by brackets replaced with your own
identifying information". This repository has no per-file headers: NO tracked
file carries an SPDX tag, and every copyright notice in the tree is in a LICENCE
FILE — LICENSE, this file, and DCO, whose notice is the Linux Foundation's and
not ours, together with the byte-identical copies of LICENSE and this file that
sit beside packages/cdm/pyproject.toml. Those two copies exist for one reason
and have no other: setuptools resolves `license-files` against the DISTRIBUTION
root, so without them the built wheel carries the SPDX expression Apache-2.0 and
not one byte of licence text — and section 4(d), below, makes carrying this file
a condition of redistributing the Work. A wheel on an index is a redistribution.
tests/test_cdm_packaging.py makes any drift from the originals a build failure,
which is the only reason a second copy is allowed to exist at all. The licence
policy is stated at the repository level instead, in README.md and
CONTRIBUTING.md. Filling in a
template for headers that will never exist is completing the wrong form.

That sentence used to read "none of its 769 tracked files", and by the day this
repository went public the tree held 770. A count of every file in the
repository is a number that goes stale on the next commit that adds one, so it
is a stale-count generator rather than a fact — and the count was never the
claim. The claim is the ABSENCE. So the absence is what is stated, and it is
what tests/test_cdm_publication.py enforces over every tracked file, in both
halves: no SPDX tag anywhere, and no copyright notice outside a licence file —
where the set of licence files is derived from this repository's own packaging
declaration rather than typed out, so a copy added for a second distribution
cannot be forgotten in one place and remembered in the other.

NOTICE is the file Apache-2.0 actually defines for this. Section 4(d) requires a
redistributor of a Work that includes a NOTICE file to carry its attribution
notices forward, which is precisely the effect wanted — and it is achieved
without editing LICENSE, whose text stays byte-identical to the canonical
Apache-2.0 so that GitHub's licence detection and any SPDX scanner keep
recognising it. A modified LICENSE is a licence tools stop being sure about.

WHY ONE YEAR AND NOT A RANGE

2026 is the year of the first commit (d798601, 2026-08-22) and the current year.
A range asserts a span of authorship, and there is not yet a span to assert. When
this repository sees a second calendar year of work the convention is to extend
it then — a range written in advance is a claim about the future.

WHAT THIS FILE DOES NOT COVER

The specification documents this repository PINS are not part of the Work and are
not covered by this licence. None of their bytes is in this repository or in its
history: each is recorded by SHA-256, byte count, page count, edition and source
URL, and the documents themselves remain under their publishers' own terms —
EUROCONTROL's for the ASTERIX specifications, NATO's for the STANAGs and AEDPs,
MISB's for the Motion Imagery Standards Profile. See the pin records under
packages/cdm/synapse_cdm/fixtures/*/spec/ for each document's terms as its own
front matter states them.
