en
Support
A single LICENSE file in the repository is not enough: copyright, licence and disclaimer information must be included in every single source file. This was emphasised by Dr Johannes Loxen, Head of OSPO at SerNet, on 10 November 2026 at the fifth DENIC Spark in Frankfurt am Main, the staff conference of DENIC eG, which manages the .de domains. His examples were drawn directly from SerNet’s work: from Samba, which provides Windows file services and Active Directory on Linux and which SerNet distributes as SAMBA+, to verinice, an open-source platform for information security management (ISMS) that SerNet has been developing since 2006.
“Precisely because everything is free, licence rules are important to ensure that the software remains free in the long term, that liability issues are clarified, and that we do not fall into a nasty trap at the end of 2027 with the CRA – the Cyber Resilience Act,” says Loxen.
Using and distributing free software
The first part of his talk focused on the use of free software within organisations: who decides on downloads and installation, how management assesses supply chain risks, and why NIS2 does not ask about the licence. The second part was aimed at developers who distribute their own code. It is difficult to change a licence once others have contributed to it. Nevertheless, Samba switched to the GPLv3 in 2007 because the header permitted “Version 2 or later”; verinice switched to the AGPLv3 in 2018.
How difficult a change is depends on who is named in the copyright line. In the case of individual copyright, as with Samba and verinice, each person retains their rights; a licence change then requires the consent of all parties or a licence clause that also permits any later version of the licence (“or any later version”). In the case of a corporate copyright, the company can re-licence or dual-licence the work. A copyright assignment transfers this right to the employer by contract – legally sound, but unpopular within the community.
Regardless of the model, Loxen’s core requirement applies: headers in every file ensure that the licence information remains attached even to a file that has been copied out. The repository verinice-veo demonstrates this with headers as well as LICENSE, README, SECURITY and NOTICE files. The same applies to AI-generated code: Loxen showed a file written by Claude on his behalf, featuring a project header and his name in the copyright line.
The licence also specifies who is entitled to request the source code. Under the GPL, this applies to anyone who receives a binary; the AGPLv3, under which verinice is licensed, extends this entitlement to anyone who uses the software over a network. There is no obligation to publish the source code in either case.
What the Cyber Resilience Act requires
In addition to the obligations under the licence, there are now statutory requirements. Since 11 September 2026, manufacturers have been required to report actively exploited vulnerabilities and serious security incidents within 24 hours via ENISA’s reporting platform; from 11 December 2027, all other CRA obligations, including CE marking, will apply. A manufacturer is defined as anyone who incorporates open-source components into products and distributes them; the CRA does not directly impose obligations on end users. Open-source stewards have a less onerous role, and non-commercial development is exempt.
This is where the CRA and headers intersect: the CRA requires an SBOM and a reporting channel for vulnerabilities, and the SBOM only becomes robust when it contains accurate licence information in every file. This can be verified using REUSE, ScanCode or ORT; the SBOM formats used are SPDX and CycloneDX. You can find out how SerNet is preparing for this in the slides.
Slides and contact details
The presentation slides contain sources, header examples and tools for licence verification and SBOM.
Questions regarding open-source licences, SBOMs and CRAs are answered and discussed by SerNet’s Open Source Programme Office (OSPO) at ospo@sernet.de or by telephone on 0551 370000-0.
