Relicense to Apache-2.0 (dual-license; external-contributor files remain MIT)

[Anerudhan]

Summary

Relicenses NVIDIA-authored code in cudnn-frontend from MIT to the Apache License 2.0, using the exact NVIDIA OSS SPDX header (Confluence template). Files that carry non-NVIDIA contributions remain under MIT, so no third party's code is relicensed without consent. Rebased onto current develop.

⚠️ Draft — do not merge until NVIDIA legal/OSPO sign-off (issue #431) is confirmed.

License assignment

Every source file now carries an SPDX SPDX-License-Identifier: tag.

License	Files	Which
Apache-2.0	494	Authored solely by NVIDIA
MIT (consent-pending)	63	Contain surviving lines from external contributors in the sign-off list, determined by git blame on develop
MIT (third-party-derived)	29	FlashAttention / QuACK-derived files carrying external authors' copyright

The MIT files are pinned with an explicit SPDX-License-Identifier: MIT so the Apache-2.0 root license does not absorb them. Each consent-pending file can be moved to Apache-2.0 simply by flipping its SPDX tag once the contributor consents.

How the split was computed

• Blame-based, not touch-based. A file stays MIT only if an external contributor's lines survive in current develop. Files an external contributor merely touched but whose lines were fully overwritten by NVIDIA (e.g. README.md) go to Apache-2.0.
• The consent-pending set maps to the 17 external committers + Benjamin Leff (co-author) from the sign-off list. Full file→contributor mapping is in LICENSING.md.

Licensing files

• LICENSE.txt — Apache-2.0 (primary) with NVIDIA copyright line
• LICENSE-MIT.txt — MIT text for the MIT-licensed subset
• LICENSING.md — dual-license manifest: lists every MIT file and, for the consent-pending set, the external contributor it is attributed to
• THIRD_PARTY_LICENSES.txt — nlohmann/json, FlashAttention, CUTLASS, QuACK, labml.ai, dlpack, pybind11, Catch2
• NOTICE, pyproject.toml (license = "Apache-2.0 AND MIT"), README.md updated

For legal review

1. 63 consent-pending MIT files — listed with their external contributor in LICENSING.md Category 1. These are the files whose relicensing needs contributor sign-off.
2. Jerry Chen (cjerry@nvidia.com) holds a personal copyright in FlashAttention-derived DSA files despite an NVIDIA email — confirm treatment.
3. CUTLASS-example-derived kernels normalized to Apache-2.0 on the basis that CUTLASS is NVIDIA-copyrighted — confirm.

Verification

• Every source file has exactly one SPDX tag; no file has both
• All Python compiles (py_compile); git diff -U0 confirms every source change is comment/header-only (compile-neutral)
• New files on develop (tools/cudnn_repro tests) also headered

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 4efc3497-6d43-4235-8cd9-e01b0b4e535c

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}