181

I've got a package.json that's expecting a SPDX-approved license acronym, but I can't find one that means 'proprietary commercial license, all rights reserved'.

Is there one for non-FOSS, where I want to specify that I want to allow no reuse?

Improve this question
5
  • 2
    There are some problems with your question, as it is currently written. 1. All copyrights are always reserved. 2. "Proprietary commercial" is a characteristic of many licenses. 3. There might not actually be an acronym for what you are requesting.
    – Robert Harvey
    Jun 5, 2015 at 5:11
  • 3
    @RobertHarvey 1. Many software systems (eg, npm) require a license to be set explicitly. 2 and 3. Yes, the answer handles that 3.
    – mikemaccana
    Jul 12, 2015 at 20:44
  • 2
    Since this is closed I can't give another answer. But according to [1] you should set license: "UNLICENSED",. [1] github.com/npm/npm/issues/8918
    – Jason Axelson
    Oct 2, 2015 at 20:04
  • 1
    might not actually [have] an acronym for what you are requesting is still a perfectly valid answer to a perfectly valid question.
    – Qix - MONICA WAS MISTREATED
    Sep 15, 2016 at 4:51
  • 1
    The equivalent for composer.json is "license": "proprietary" according to the docs.
    – Quinn Comendant
    Oct 16, 2019 at 19:58

2 Answers 2

Reset to default
168

As of npm 3.10 you have to use UNLICENSED:

{ "license": "UNLICENSED"}

or

{ "license": "SEE LICENSE IN <filename>"}

The value of license must either one of the options above or the identifier for the license from this list of SPDX licenses. Any other value is not valid.

The following is no longer valid for current versions of npm

For npm versions before 3.10 you may use:

{ "license" : "LicenseRef-LICENSE" }

Then include a LICENSE file at the top level of the package. It could be as short as:

(c) Copyright 2015 person or company, all rights reserved.

But you might want to be more explicit about what is not allowed.

Improve this answer
15
  • 22
    "all rights reserved", in that context, means EXACTLY what it says. NO permissions have been given. It is a legal term of art. Think of it as a magickal incantation that must be uttered in precisely that form to invoke the Law Demons.
    – John R. Strohm
    Jun 5, 2015 at 20:45
  • 5
    npm recommends to set { "license": "UNLICENSED"} "if you do not wish to grant others the right to use a private or unpublished package under any terms". That's an even easier option than an explicit license file.
    – Jörn Zaefferer
    Sep 28, 2015 at 9:49
  • 3
    setting the license to UNLICENSED still triggers license should be a valid SPDX license expression for me
    – cdmckay
    Oct 9, 2015 at 13:33
  • 22
    You can also just set "private": true and it won't bother you about including a license.
    – spex
    May 25, 2017 at 20:31
  • 16
    Also make sure not to confuse the npm-recommended "UNLICENSED" with the SPDX compliant identifier "Unlicense", which is the exact opposite of "all rights reserved".
    – Levente Huszko
    Oct 17, 2017 at 11:04
17

This does not exactly answer your question, but what about:

{
  "license": "Proprietary",
  "private": true,
}
Improve this answer
5
  • 3
    This answer reads more like a comment.
    – Mael
    Mar 13, 2018 at 7:40
  • 3
    This answer also does what is needed: stops npm complaining about licenses, so it is a good one in my book.
    – Malcolm Holmes
    Apr 26, 2018 at 9:20
  • 5
    Using "Proprietary" as the license type is not a supported SPDX type and will generate an error unless you also specify "private": true. That in turn prevents you from using NPM as a distribution channel for your proprietary package. So choose the answer above by @craig
    – abd3721
    Nov 1, 2018 at 21:18
  • 1
    To me, the following DOES answer the question and gives a full example of how to do it. I suggest, @WooYek, updating your answer. ` { "name": "my-descriptive-name", "description": "yeah, what it says", "repository": "npm/npm", "license": "Copyright Your Company 2019, all rights reserved.", "private": true, "dependencies": { "request": "^2.88.0", "request-promise-native": "^1.0.5" } }`
    – Kevin Buchs
    Jan 15, 2019 at 23:36
  • 1
    For brevity I did not want to put the usual copyright stuff. Just the bare minimum required for a packaged to be treated as proprietary software.
    – WooYek
    Jan 17, 2019 at 7:38

Not the answer you're looking for? Browse other questions tagged or ask your own question.