The repository ships a license file whose license matches the package manifest

Rule

R-COM-01

Forge scope

GitHub and GitLab

Fixed by

oss-community

Without a license file the default is exclusive copyright, so nobody may legally use the code. A manifest field saying MIT while the file says Apache-2.0 forces every downstream legal review to stop and ask.

Observable check

LICENSE or LICENSE.md exists at the repository root, and every package manifest that declares a license names the license that file contains.

Read the whole standard