Valid locations for propagated MIT/BSD licenses?

Question

Background

My own project is a module for Python (without GUI, so this answer does not fully apply). It’s licensed with a three-clause BSD license which resides in a separate file (say License), and only there.

In this project, I want to use code from NumPy’s randomkit.h and randomkit.c, which is modified and strongly reduced for my specific needs. This is the only external code in my project and it resides in its own file (say random.c).

License of the employed code

The Randomkit files contains the following in its license/copyright statement:

• An MIT license¹ as the main license (extended by the following), stating amongst others:

  The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.

• Quoted as the license for parts is a the three-clause BSD license¹, stating amongst others:

  Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.

• Also included are some further acknowledgements which are part of the copyright notice mentioned by the MIT license.

---

^{¹ I didn’t compare those word by word.}

Actual question

Which are valid or best-practice ways to mention those licenses? I can think of the following (in order of increasing obnoxiousness):

1. Add Randomkit’s license to random.c mentioning my own modifications and add a sentence to License along the lines of:

   The file random.c is based on NumPy’s Randomkit; see that file for its copyright and license.

2. Add Randomkit’s license to License; add a sentence to random.c along the lines of:

   This file is based on NumPy’s Randomkit. See the file “License” for its copyright and license.

3. Add Randomkit’s license to both, random.c and License.

Answer 1

Add and/or keep existing notices is the best way to go at the file level and a top level summary helps. More is best e.g. 3. such that you can cover the case of source and binary redistribution more easily.

You could also consider using SPDX-License-Identifier in the files and keep only a top-level notice. This is something that I am helping with in the Linux kernel for instance.

Now, for a Python project, the setup.py license arg and the trove classifiers are a way to start. You could also include all this narrative in your top level LICENSE file: if you build a wheel, and if your licensing file is named LICENSE, put this in your setup.cfg to include the license in the built wheel:

[metadata]
license_file = LICENSE

You would get belt and suspenders this way. And extra credits for being nice.