Licensing cleanup: fix contradictory copyright metadata, add third-party notices

[johnpierson]

Fixes a set of licensing inconsistencies found during a read-only audit of the repo. Four commits, each independently reviewable.

Why

The repo ships under BSD 3-Clause (LICENSE, 2019 John Pierson), but the metadata said otherwise in several places, and there was no third-party notices file despite a meaningful amount of vendored third-party source — including weak-copyleft code compiled into the shipped DLLs.

What changed

1. csproj <Copyright> said "MIT" (0faaf86)

RhythmCore, RhythmRevit and RhythmUI (plus RhythmUI - Backup) all had <Copyright>MIT</Copyright> — a license name in a copyright field, and the wrong license. Replaced with Copyright (c) 2019 John Pierson, matching LICENSE.

Since the underlying problem was a license name stuffed into a copyright field, I also added <PackageLicenseExpression>BSD-3-Clause</PackageLicenseExpression>, which is the field that actually exists for this. Verified both evaluate correctly with dotnet msbuild -getProperty. Swept the other three csproj files — no other project had the same problem.

2. Correction: the csproj <Copyright> never reached the DLLs (a10bc92)

Worth flagging, because it changes what the real problem was.

All five projects set GenerateAssemblyInfo=False. That means Properties/AssemblyInfo.cs — not the csproj <Copyright> property — supplies AssemblyCopyrightAttribute. Confirmed against a built binary:

deploy/2020/RhythmCore.dll  ->  LegalCopyright: 'Copyright ©  2023'

So "MIT" was never baked into a shipped assembly. It was NuGet pack metadata that contradicted LICENSE — still worth fixing, but not the thing users' DLLs carried.

What was shipping is the untouched Visual Studio placeholder Copyright © 2023: no holder name, and a year matching neither LICENSE nor anything else. Normalized across all five AssemblyInfo.cs files, the two extension csproj files, and both Dynamo package manifests (deploy/pkg.json, deploy/Rhythm/pkg.json, which had copyright_holder: "j0hnp" with years 2024/2025).

CI only builds DLLs into deploy/<version>/ — it does not regenerate pkg.json — so these edits persist. Metadata strings only; no behavioural or version changes.

3. Two RhythmPython files marked GPL-3.0 (05c04ab)

RhythmPython/FileSystem/zipDirectories.py and RhythmPython/Revit/Application/unloadLinksFromFile.py declared __license__ = 'GNU General Public License v3.0', incompatible with BSD-3.

I investigated provenance before touching either, since silently relicensing someone else's code would be the worse error. Findings:

• Both were created from scratch in this repo (d20bdcb, fbaa69f, July 2021) — not imported.
• __author__ is John Pierson on both.
• Neither derives from third-party code: zipDirectories wraps System.IO.Compression.ZipFile; unloadLinksFromFile wraps the Revit TransmissionData API. No upstream reference in either file.
• Both carry the identical GPL string and come from the same batch — consistent with a copy-paste slip in the header template.
• Every other RhythmPython file with a marker declares BSD 3-Clause.

Corrected to the same BSD-3 string the other RhythmPython files use. This is the author's own marker on the author's own code — no third-party code was relicensed.

4. Added THIRD-PARTY-NOTICES.md (f92d319)

Covers eleven items. Beyond those already known, my sweep turned up three the audit had missed:

• ShortestWalk — ~1,030 lines across nine files (src/RhythmRevit/ShortestWalk/, Utilities/ShortestWalkUtils.cs), compiled into RhythmRevit.dll. MIT, © 2011 McNeel Europe — Giulio Piacentino's Grasshopper component, arrived via Proving Ground's LunchBox.
• polylabel-csharp (src/RhythmCore/Polylabel/) — upstream publishes no license at all.
• SpringNodes (MIT), @erfajo's Dynamo-forum converters, and two forum-sourced snippets.

Also documents the redistributed Humanizer and Markov binaries in deploy/ (both MIT), and notes that the LGPL LunchboxML file is 100% commented out and contributes nothing to any build.

The Nuclex rectangle packer (IBM CPL-1.0, six files) is called out at the top with a warning rather than buried in a flat list, since it's the one item with real copyleft implications.

Added a pointer from the README's License section so the BSD-3 claim is qualified where readers actually encounter it.

All licenses were verified against file headers or upstream sources rather than assumed; all 25 referenced file paths verified to exist. No existing inline license headers were stripped.

Needs your decision

Three items I deliberately did not act on. Each is disclosed accurately in the notices file, but each needs a call from you.

ShortestWalk is missing its MIT headers. Upstream MIT requires that "the above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software." None of the nine vendored files carries any copyright header. The notices file satisfies this at the distribution level, but adding per-file headers would be the cleaner fix. I left the files alone rather than editing headers into nine files of someone else's code without asking.

polylabel-csharp has no upstream license. https://github.com/eqmiller/polylabel-csharp publishes no LICENSE file and no license statement. Absent an express grant, the default position is that no redistribution rights were given — so this is arguably the highest-risk item in the repo, ahead of the CPL code. It's ~220 lines used by Rhythm.Geometry.Polygon. Options: ask the author to add a license, re-derive it from Mapbox's ISC-licensed original, or replace the implementation.

Nuclex CPL-1.0 code is disclosed, not removed. Six files under IBM Common Public License v1.0 — weak copyleft — compiled into both shipped DLLs, duplicated across RhythmCore/GenerativeDesign/ and RhythmRevit/Revit/Views/. Swapping out a rectangle packer that both DLLs depend on is a code change with behavioural risk, not a licensing cleanup. Your call whether to replace it or accept the CPL obligations; this PR only makes the situation visible.

Testing

No end-to-end build was run — the changes are metadata strings plus one new markdown file, and a full build needs the Revit/Dynamo SDKs. Verified instead:

• All four modified csproj files still parse as well-formed XML.
• Both pkg.json files still parse as valid JSON.
• dotnet msbuild -getProperty:Copyright -getProperty:PackageLicenseExpression returns the expected values.
• No stale Copyright © 2023, <Copyright>MIT<, or j0hnp markers remain anywhere in src/ or deploy/.
• Every file path referenced in the notices file exists.

🤖 Generated with Claude Code