chore: relicense to Apache-2.0 + DCO + TRADEMARKS + third-party notices

[guycochran]

Relicenses the project from MIT to Apache-2.0, adopts the DCO (no CLA), and adds TRADEMARKS.md and THIRD-PARTY-NOTICES.md. There are no code-behaviour changes.

TODO before merge: settle the copyright holder in writing. NOTICE carries the copyright line from the old MIT LICENSE verbatim. This PR does not decide which person or entity is the holder. Confirm it in writing, then update NOTICE (and add an AUTHORS file if useful) before this lands.

⚠️ DCO rollout: once .github/workflows/dco.yml is on master, every open PR is checked on its next push or sync. Their existing commits have no Signed-off-by, so they will fail the check until rebased with git rebase --signoff origin/master. Alternatively, don't make the DCO check a required status until the open PRs have merged. This PR's own commit is signed off and passes scripts/check-dco.sh locally.

1. License

• LICENSE: the full Apache License 2.0 text (verbatim from apache.org).
• NOTICE (new):
  • project name and the existing copyright line;
  • a statement that releases and tags published before the switch (v0.2.0, core-v1.0.0) were MIT and remain available under MIT;
  • a pointer to the third-party notices.
• README.md: new License section (Apache-2.0, the prior-MIT note, DCO, trademarks).
• license: Apache-2.0 in backend/package.json (added; plus the lockfile root entry), companion-module-mxl-switcher/package.json and companion/manifest.json.
• SPDX headers: SPDX-License-Identifier: Apache-2.0 added to 100 existing py/js/sh/md files, inserted after the shebang where present. Skipped:
  • vendored: web/vendor/**;
  • non-source: JSON, HTML, fonts, images, *.companionconfig;
  • files under active edit in open PRs, to avoid merge conflicts (follow-up once those land): tools/nmos_node.py, tools/contribution_core.py, tools/adapters.py, tests/test_contribution_core.py, docs/CONFIG.md, docs/VERSIONS.md, tests/test_env_config.py, and the new files from those PRs (tests/test_nmos_is05.py, tools/ingress-soak.sh, the new ADR/roadmap docs).

2. DCO (Developer Certificate of Origin 1.1)

• CONTRIBUTING.md: new sections, License of contributions (Apache-2.0 §5, no CLA) and Developer Certificate of Origin. They cover:

  • git commit -s;
  • fixing missed sign-offs (--amend -s, rebase --signoff);
  • AI-assisted commits (the human submitter signs off);
  • the full DCO 1.1 text.

  The sections are appended at the end of the file so they don't collide with other open edits.

• scripts/check-dco.sh (new, bash + git only): every non-merge commit in BASE..HEAD needs a Signed-off-by whose email matches the commit author (case-insensitive). It gives a clear failure message with the fix. tests/test_check_dco.py covers pass, missing, mismatched, merge-ignored and usage-error cases against a throwaway repo.

• .github/workflows/dco.yml (new): runs on pull_request, with permissions: contents: read and actions/checkout pinned by SHA (persist-credentials: false). No third-party DCO action.

• .github/workflows/ci.yml: added permissions: contents: read, and pinned actions/checkout / setup-python / setup-node to commit SHAs (same major versions as before; tag noted in a comment).

3. TRADEMARKS.md (new)

• The project name and logo are reserved. Apache-2.0 §6 doesn't grant trademark rights.
• Forks and redistributions must use their own name and logo.
• Nominative use is fine, e.g. "compatible with mxl-switcher", "a skin for mxl-switcher", "uses the /api/mxl/v1 API", "for MXL".
• It notes that "MXL" appears to be the EBU / Linux Foundation community project's name (rights holder not confirmed). It recommends that any brand meant to be protected be distinctive rather than built mainly on "MXL". This is a recommendation only; nothing is renamed.

4. THIRD-PARTY-NOTICES.md (new): ffmpeg.wasm finding

web/vendor/ffmpeg/ file	Identified as	In git?	License
ffmpeg.js, 814.ffmpeg.js	@ffmpeg/ffmpeg 0.12.10 (byte-identical to npm)	yes	MIT
ffmpeg-core.js	@ffmpeg/core 0.12.6 Emscripten loader (byte-identical to npm)	yes	MIT per npm metadata
ffmpeg-core.wasm	@ffmpeg/core 0.12.6 compiled FFmpeg 5.1	no (fetched by fetch-core-wasm.sh, git-ignored)	GPL-2.0-or-later

⚠️ GPL flag: the npm metadata for @ffmpeg/core says "MIT", but the shipped .wasm's embedded FFmpeg build configuration includes --enable-gpl --enable-libx264 --enable-libx265 (plus vpx, lame, theora, vorbis, opus, zlib, webp, freetype, fribidi, ass, zimg). The binary is therefore GPL-2.0-or-later.

• This repository is OK as-is. The GPL binary is not committed; only the MIT JS wrapper and loader are.
• Deployments are a different matter. Any deployment that serves the clip/record pages (web/mxl-clip.html, web/mxl-tams.html) distributes GPL object code to browsers and takes on GPL obligations for it, such as offering the corresponding source.
• Proposed follow-up (not done here): load the core at runtime from upstream instead of self-hosting it, or build an LGPL-only core (no --enable-gpl, no x264/x265), or document the source offer in the deployment.

fetch-core-wasm.sh now states the GPL status in a comment and in its output. The web fonts are covered as OFL-1.1 (existing web/fonts/LICENSE).

Tests

• node --test tests/js/*.test.js → 36/36 pass.
• python -m pytest tests/ → 138 passed, 2 skipped (+5 new DCO tests).
• bash -n is clean on all shell scripts; node --check is clean on all non-vendored JS; both workflow files parse as YAML.
• This branch was merged locally with each of the other open PR branches (not pushed). It merges cleanly with each one, and the suite stays green on the two combinations tested (with the 60fps/NMOS PR and with the adopter-quick-fixes PR).

Follow-ups

• Settle the copyright holder (see TODO above).
• Add SPDX headers to the skipped files once their open PRs land; optionally add a test that enforces headers on new files.
• Make the DCO check a required status once open PRs are signed off or merged.
• Decide how the GPL ffmpeg core is delivered (see above).

[guycochran]

Decision (Guy): Apache-2.0 copyright holder = Guy Cochran (individual). Please set the NOTICE/LICENSE holder accordingly. Merge position #4 (#38→#40→#37→**#39**→#41).