Mark the license of every file with a comment header that has a copyright notice and an SPDX-License-Identifier tag, keep each license text in a LICENSES directory at the repository root, and use adjacent .license files for things that cannot hold comments. That is the approach the REUSE specification describes.
The pieces of the specification
According to the REUSE specification:
- A comment header must contain at least one copyright notice and at least one SPDX-License-Identifier tag. The tag must be followed by a valid SPDX license expression.
- The project root must contain a LICENSES directory with one plain text file for every license that applies, named after its SPDX identifier, such as GPL-3.0-or-later.txt.
- Licenses not on the SPDX list use a LicenseRef identifier.
- Files that cannot carry a comment, such as images, get a sidecar file with the same name plus .license.
- A REUSE.toml file can carry licensing information in bulk. The older DEP5 route is deprecated.
Why per file marking helps
A repository level LICENSE file tells you the main license. It does not tell you that one folder was copied from elsewhere under different terms. Per file tags make that visible, and they travel with the file if it is copied.
For acquirers, this is the difference between guessing and checking. A file with a clear tag can be classified in seconds. A file with nothing needs investigation.
A short example
A source file header might look like this in a code block:
// SPDX-FileCopyrightText: 2026 Example Co
//
// SPDX-License-Identifier: Apache-2.0
Steps to adopt it
- List the licenses that apply to your repository.
- Add a LICENSES folder with one text file for each.
- Add headers to source files, using a script for the bulk work.
- Add .license files for images, data and binaries.
- Use a linting tool in CI to catch files that lack a header.
- Keep the headers when you copy code in from elsewhere.
Limits
Marking files does not decide whether a license is acceptable for your product. It makes the facts easy to read. Policy and legal review sit on top of that. Pair it with an inventory of dependencies, as in license fields to require in a supplier SBOM.
Safeguard offers SBOM and dependency scanning plus compliance and evidence automation, which can help you keep an inventory and supporting records current. A free scan shows the inventory side.
Quick check
Do I need REUSE for a small repository?
No, but the habit is cheap early and costly to add later, especially if you may be sold.
What about generated files?
Mark them the same way, or cover them in bulk with REUSE.toml, so every file has a stated license.
Sources
Last reviewed: 19 October 2026.
