The repository arrived on a Friday afternoon with 41 Java files and a README that promised "fully original work." Nine of those files carried a copyright header naming a Dutch software consultancy. The students had hidden nothing. They had copied a utility class from a public GitHub project, left the header intact, and moved on, the same way they had lifted snippets from Stack Overflow since their first programming course. What none of them had done, and what no assignment in four years had asked them to do, was read the license.
Open source license compliance in student code means determining, for every line a student did not write, whether the license attached to that line permits the reuse and what conditions it imposes. That is narrower than plagiarism and broader than citation. It is also, in most computer science departments, untaught. The teaching that does happen tends to collapse into a single instruction: cite your sources. That instruction is necessary and insufficient, and the gap between the two is where departments get into trouble.
Why a Citation Comment Is Not a License
Academic citation and license compliance answer different questions with different consequences. A citation tells a reader where an idea came from. A license tells a user what they are permitted to do and what they must do in exchange.
The MIT License, which governs a large share of the code students find on GitHub, grants permission to use, copy, modify, and distribute. It attaches one condition: the copyright notice and permission notice must appear in all copies or substantial portions. Strip the header and you have breached the condition, even if your comment block names the author and links the repository. A citation comment alone does not satisfy MIT. A citation comment plus the retained notice does.
The legal weight here is settled. In Jacobsen v. Katzer, decided by the Federal Circuit in 2008, the court held that the conditions in an open source license operate as copyright conditions rather than mere contractual covenants. That distinction matters: breach of a copyright condition is infringement, not a contract dispute, and it carries statutory damages. The case involved model railroad software and an Artistic License, which is a small thing to build a landmark on, but the holding has shaped every open source compliance program since.
Departments tend to discover this distinction in one of two ways. Either a student publishes a capstone project on GitHub and a maintainer emails the department chair, or an alumni team ships a product and legal review finds a copyleft obligation nobody could unwind. Both routes end with a policy that should have existed earlier.
The Licenses Students Actually Copy From
Four families account for nearly everything a grader will encounter in an undergraduate repository.
Permissive licenses and the notice requirement
MIT, BSD-2-Clause, BSD-3-Clause, and Apache 2.0 all allow reuse inside proprietary or differently-licensed work. The obligations are modest but real. MIT and the BSD licenses require notice retention. Apache 2.0, released in 2004, adds two more: a NOTICE file must be preserved if the original distribution included one, and modified files must carry a statement of the changes. Apache 2.0 also grants an explicit patent license, which is why corporate legal departments prefer it to MIT for anything patent-adjacent.
Students consistently get the notice requirement backwards. They believe that adding their own name to a file they copied constitutes attribution. It does not. The original copyright line has to stay, and the license text has to travel with the code.
Copyleft and the derivative work question
GPLv2, from 1991, and GPLv3, from 2007, require that derivative works be distributed under the same license. What counts as a derivative work is the argument that never quite ends. Linking to a GPL library is generally treated as creating a combined work; invoking a separate process is generally not. GPLv3 added language about installation information and anti-tivoization provisions, and AGPLv3, also 2007, extended the trigger to network use through Section 13. A student who builds a web app around an AGPL library and deploys it publicly owes the source code to every user of that service.
MPL 2.0 takes a middle path with file-level copyleft: modified files stay MPL, new files can be anything. LGPL permits dynamic linking without copyleft spreading to the calling application, though modifications to the library itself remain covered. These distinctions are the kind of thing a working engineer learns on the job, usually the hard way. Expecting a junior to infer them from a course syllabus is optimistic.
Stack Overflow, tutorials, and CC BY-SA
Stack Overflow moved its contributor content to CC BY-SA 4.0 in 2018, having previously used CC BY-SA 2.5 and 3.0. The share-alike clause is the part students miss. A method copied from an answer and dropped into a file means that file is now, arguably, a derivative of CC BY-SA material. Attribution with a link and the author's name satisfies the BY portion. Nothing satisfies the SA portion except licensing the resulting file compatibly, and CC BY-SA is not compatible with most software licenses, MIT included.
There is a persistent folk rule that copying twenty lines or fewer is fine. It has no basis in statute. The number appears to trace back to a 1980s music sampling guideline that someone repeated in a forum post, and it has been repeated ever since with the confidence of settled law. Two lines of a distinctive algorithm can infringe. A hundred lines of boilerplate get-up might not. The measure is creativity and originality, not line count, and no counter in the world answers it.
Google's decade-long fight with Oracle over the Java API illustrates how expensive this question gets. When the Supreme Court finally ruled in 2021 that Google's copying of roughly 11,500 lines of declaring code was fair use, the litigation had already consumed eleven years. Fair use is a defense a defendant raises after being sued. It is not a permission a student can rely on in advance.
Four Failure Modes That Show Up in Grading
Across the departments that have described their grading incidents publicly, the same four patterns recur. They are worth naming because each one calls for a different response, and treating them as a single category of cheating produces the wrong one.
- The intact header nobody read. A student copies a file, keeps the upstream copyright line, and adds nothing else. This is the most common and the most benign. The student was not concealing anything; they simply had no framework for what the header meant. The right response is instruction.
- The vendored directory. A student commits an entire third-party library into
vendor/orlib/so the project builds. In an enterprise setting this is normal and tracked by a dependency manifest. In a student repository it usually means nobody looked at the license, and copyleft code can silently enter a project that later becomes a startup or a patent filing. - The tutorial copy. Code from a blog post or a YouTube tutorial, reproduced with the tutorial author's name but under no license at all. This is the trickiest case, because a tutorial without a stated license grants nothing. Absence of a license is not permission. A student who reproduces it anyway has a copyright problem that attribution does not solve, and the honest answer is that they need to rewrite from the underlying concept.
- The linked dependency that changes the project. The capstone team that links a GPL library and then tries to distribute the result under terms the GPL forbids. This is the failure mode with real downstream consequences, and it is the one most likely to surface years later.
Only the fourth is a genuine institutional problem. The first three are curriculum problems, which is a far cheaper category to fix.
A File Header That Carries Its Own Provenance
If a department is going to require one mechanical habit, this is the one worth requiring. The SPDX License Identifier standard, maintained by the SPDX project whose license list now runs past 600 entries, puts a machine-readable license declaration in a single comment line. Paired with a source URL and a LICENSES/ directory, it makes a repository auditable by tooling rather than by eye.
/*
* Copyright 2024 Maya Okonkwo, Daniel Reyes, Priya Shah
*
* Portions of this file are derived from jsoup (https://jsoup.org/),
* Copyright 2009-2024 Jonathan Hedley, licensed under the MIT License.
* The full text of that license is in LICENSES/MIT.txt.
*
* SPDX-License-Identifier: MIT
*/The share-alike case needs a different header, because the obligation is heavier. A method adapted from a Stack Overflow answer does not get to claim MIT:
// Adapted from "Sorting a list of objects by multiple fields"
// by Stack Overflow user "Marijn", licensed CC BY-SA 4.0.
// https://stackoverflow.com/q/ ... retrieved 2024-02-11.
// Modified to use Comparator.comparing() instead of reflection.
//
// This file is licensed CC BY-SA 4.0 as a result.
Students find the second header strange the first time they write it. That strangeness is the lesson. The share-alike term is doing visible work in their own file, and once they have seen it once, they recognize it in a dependency manifest a few years later.
What to Scan For, and What to Exclude
License scanning in an academic setting is mostly about knowing which files carry obligations and which files are noise. ScanCode Toolkit from nexB and the REUSE tool from the Free Software Foundation Europe are the two that fit a course budget, which is to say they are free and they run offline.
# Inventory copyright, license, package, and URL findings per file
scancode -clpieu --license-score 80 --json-pp scan.json ./student-repos
# Verify SPDX headers and a LICENSES/ directory are present and correct
cd student-repos/team-07 && reuse lint
# Find out what was pulled in from a package registry
grep -rl --include=package-lock.json --include=poetry.lock --include=pom.xml . | headCommercial scanners do more. FOSSA, Snyk's license compliance module, and Synopsys Black Duck all handle policy enforcement at scale, and any of them is a reasonable choice for a university research computing group or an enterprise CI pipeline. For grading 200 submissions, the open tools are easier to justify and easier to explain to an honor council.
The exclusion list matters as much as the detection. Minified JavaScript, generated protocol buffers, Jupyter checkpoint folders, and anything under node_modules will bury a report in false positives. One instructor described a first scan that returned 1,400 license findings for a class of 80 students, nearly all of them from a single committed node_modules directory. Excluding build artifacts and vendored trees before the scan is not optional.
Building a Provenance Rubric
Grading provenance directly is where most of the friction lives, because the line between a two-point deduction and an honor code referral is not obvious to a first-year TA. A published rubric removes the improvisation. The version below is adapted from a scheme used by a software engineering program at a mid-sized public university in the Midwest, which added it to the capstone syllabus after the GPL incident described later in this piece.
| Level | What the submission shows | Response |
|---|---|---|
| 4 | Every non-original file has an SPDX identifier, a source URL, and license text in LICENSES/. Project-level license declared in the repository root. | Full credit for the provenance component. |
| 3 | Attribution present and accurate, SPDX identifier missing, wrong, or inconsistent with the license text. | Minor deduction, written feedback on identifier syntax. |
| 2 | Source named in a comment, no license information anywhere in the repository. | Deduction plus a required rewrite of the affected files. |
| 1 | Copied code with the upstream copyright notice removed, or a copyleft dependency neither disclosed nor addressed. | Grade hold pending a conversation with the instructor. |
| 0 | Copied code with the license stripped and the origin falsified, or code presented as original when a detection tool shows a verbatim match. | Referred under the academic integrity policy. |
Two things make this rubric work in practice. The first is that it is weighted separately from correctness, so a student cannot trade a working program for a provenance violation or the reverse. The second is that level 1 and level 0 are explicitly distinguished, which keeps honest sloppiness out of the integrity process. The instructor who shared the scheme said the single biggest reduction in honor code referrals came from that separation, not from better detection.
She also mentioned that the departmental rollout of the rubric slipped by a full semester while the honor council reviewed the policy language, which is the kind of schedule reality that never makes it into a syllabus template.
The Capstone Team That Shipped a GPL Library
The following account combines details from two programs that described similar incidents on the condition that neither department be named. In both cases the mechanism was the same.
A four-person capstone team built a scheduling application over two semesters. Midway through the second term, one member found a calendar-recurrence library that handled the hardest edge cases in the project. It was well maintained, well documented, and licensed under GPLv3. Nobody read the license file. The team's repository carried an MIT license in the root, which had been auto-generated by GitHub when the project was created and never reconsidered.
The mismatch stayed invisible until the team entered the project in a university startup competition and a judge from a local software company asked about the license. The judge was not trying to catch anyone. He had spent two weeks that quarter on a similar problem at his own employer, where the same library had triggered a legal review before it could ship.
"Every year I meet three or four teams who have no idea what they've linked," he said afterward. "It's never because they're careless. It's because nobody ever told them that the license file is part of the code."
The resolution in one case was a rewrite: the recurrence logic was reimplemented from the underlying RFC by a student who had, by then, developed strong opinions about calendar edge cases. In the other, the team relicensed the entire project under GPLv3, which was acceptable for a course project and would have been fatal for a product. Both outcomes cost weeks. Neither was necessary.
There is no reliable published figure for how often this happens. The anecdotes are consistent across institutions, and the data simply is not collected, largely because departments have no incentive to keep records of it.
Where Similarity Detection Ends and License Review Begins
The provenance question and the similarity question overlap, and the overlap is where a workflow becomes tractable. Similarity detection answers where the code came from. License review answers whether the student was allowed to take it. The second question is unanswerable without an answer to the first.
That sequencing is why an instructor running an open source license compliance unit usually starts with a similarity scan rather than a license scanner. A license scanner pointed at a whole class returns hundreds of findings, most of them from dependencies that are perfectly fine. A similarity scan returns the handful of files that actually came from somewhere else, and those are the files worth reading a license for.
Codequiry covers the first half of that pipeline in a way the free academic tools do not. It runs peer comparison, web and GitHub source matching, and AI-generated code detection in a single pass, so a submission that was partly copied from a Stack Overflow answer and partly written by ChatGPT shows both signals rather than one masked by the other. The matching engine works on tokens and abstract syntax trees rather than raw text, which means renaming a variable, reformatting a file, or extracting a method into a helper class does not erase the evidence. Anyone who has watched a text-based checker return a clean report on a file with every identifier changed understands why that distinction carries weight.
For departments, the practical shape is a check per assignment, a review queue that surfaces the outliers first, and a 0-100 similarity score that a TA can triage in an afternoon. For engineering teams the same engine is available through a REST API and CLI, which means an open source provenance gate can run in CI alongside the build, the way a lint step does.
The workflow that holds up is short. Run the similarity and AI check first. Take the flagged files and run scancode against them specifically. Read the license on the ten files that matter instead of the four hundred that do not. Codequiry's code plagiarism checker handles the triage step, and its AI code detector catches the case where a student paraphrases a source into their own structure, which no string-matching tool will find. A useful comparison of approaches for anyone weighing the free options lives in this breakdown of Codequiry versus MOSS, and instructors running a first scan may want the teacher-focused walkthrough before configuring a course.
One caution worth stating plainly. A similarity match is not a license violation, and a license violation is not plagiarism. A student can copy MIT-licensed code with proper attribution and satisfy both the citation norm and the license, which is exactly the behavior a license unit is trying to produce. The detection tool finds the reuse. The department decides what the reuse means.
Frequently Asked Questions
Is copying code from GitHub plagiarism?
Not necessarily. Plagiarism is an academic judgment about presenting someone else's work as your own. Copying a file and presenting it as original is plagiarism regardless of the license. Copying the same file with attribution, a retained copyright notice, and a compliant license is legitimate reuse, though it may still violate a course rule that requires original implementation. The two systems run in parallel and only one of them is about honesty.
Do students need to comply with open source licenses for coursework that never leaves the classroom?
Formally, the distribution right is what triggers most license obligations, and submitting code to a course grader is a limited distribution. In practice, three things make compliance worth teaching anyway. Student repositories are frequently public by default, capstone projects turn into products, and the habit is far cheaper to build in a sophomore data structures course than to correct in a company's legal review. The compliance obligation is sometimes theoretical. The pedagogical one is not.
Does an SPDX identifier in a file header satisfy the license?
It satisfies the identification requirement and nothing else. An SPDX-License-Identifier: MIT line tells a scanner what the file is, which is genuinely useful, but MIT still requires the copyright notice and the permission text to travel with the code. Think of the identifier as a label on a box, not the contents of the box.
What is the fastest way to check a whole class for license problems?
Scan for similarity first to isolate the files that came from elsewhere, then run a license scanner against those files only. Codequiry's source code plagiarism checker handles peer matching, web and GitHub sources, and AI-generated code in one pass, which turns a 400-file license audit into a 10-file one.