Are NuGet metadata a good place to exclusively set license for source code?

Question

I've found a library (that I'd like to fork, if it makes any difference).

On NuGet, the project file says it's distributed under the MIT license (with a link to the license). However, in the GitHub repository of the project, I don't see any mentions of the MIT license (or any other license) either in the source code files or in a readme. I'm a little concerned about this, since NuGet is a repository for binaries and I'm interested in the source.

Should I assume that the source code is covered under the MIT license, judging only by the NuGet metadata of a package? Or does this mean that the permissions apply only for the binary and not for the source?

Answer 1

Making assumptions with legal matters, like copyright licenses, is never a good idea. Wrong assumptions is what lawyers can get big fees on.

The fact that there is no explicit copyright license mentioned in the source code archive means that the source code falls under the default copyright 'license' of "all rights reserved", meaning that no permission is given to copy the sources.

As the binaries are distributed with a permissive open-source license, there is confusion about under what rights the author meant to release the software. The best option here is to contact the author of the library and get the license status of the sources clarified.

Without that, the MIT license gives you the right to modify the (binary) library, but you would have to do that through reverse engineering and you would have to be able to legally prove that you didn't use the original source code in your modification, which might be hard to prove.

Answer 2

Should you take the copyright notice from one distribution and assume that it applies to another, of a precursor work to the one that actually provided the notice? Absolutely Not!

The MIT License is a draft license primarily concerned with preserving original credit and disclaiming all liability. While it's a fairly broad statement allowing you do do just about whatever you want with the software and documentation, it does not compel the provision of source code, either from the original author or any sub-licensor.

If the NuGet package only included a link as I did so above, it's almost certainly not a proper-form release. You need to contact the developer of the software if you want to use it. Either someone stole their project and released it in error, or (much more likely), they didn't realize that they have to do more than click the "MIT license" box to actually release "Software" under an MIT license.

Let me be as clear as I possibly can. If you have any doubt as to the license of software, assume you CAN'T and ASK FOR PERMISSION. (Expect a reply pointing to the [updated] license file.)