Licenses Are Part of the Artifact

Two byte-identical files, two different holdings

Suppose two archives hold bit-identical copies of a model. One records it under Apache-2.0; the other under a custom community license with field-of-use restrictions. They do not hold the same thing. The bytes are half the artifact; the terms are the other half, and unlike the bytes, the terms can differ between holders of the same file — because obligations follow the artifact into whatever you do with it next.

This is why the woodpile treats the license as part of the acquisition record, stored beside the digest: an archive that cannot answer "under what terms do we hold this" is not a library, it is an unsorted drawer.

The license families you will actually meet

Truly open — Apache-2.0, MIT. Fewest surprises: use, modify, distribute, commercially, with notice/attribution obligations. The closest thing to "just own it".
Open with copyleft flavor — GPL-family (rare for weights). Redistribution carries source/derivative obligations; read before building products on top.
Community custom — the LLaMA-style and Gemma-style licenses. Freely available for most uses, but with named conditions: acceptable-use policies, user-count thresholds, trademark restrictions, sometimes regional clauses. These are contracts you accept by using — not open-source licenses, and the difference is load-bearing.
Research-only. Exactly what it says; commercial use is not licensed. An archive holding research-only weights holds a lab specimen, not a building material — the vessel argument narrows accordingly.
Unstated. The most expensive kind. No terms means no rights beyond whatever copyright defaults grant; you are holding a question mark with a digest.

Two practical consequences for derivatives: base-model licenses usually attach to fine-tunes of them (a fine-tune of a research-only base is not automatically commercial), and merged models answer to every parent's terms at once: restrictions combine (the strictest clause on each axis governs), and affirmative duties like Apache's attribution notice simply stack.

The bytes say what the model is; the license says what it may become. Record both at acquisition or your catalog misdescribes every holding that has terms.

A reading protocol that scales

You do not need to be a lawyer; you need a fixed reading protocol. At acquisition: (1) identify the license from the card's structured tag, not the prose; (2) if custom, read the actual text once — five minutes, focusing on field-of-use limits, thresholds, and redistribution clauses; (3) record license + version + URL in the acquisition note; (4) for derivatives, walk the base_model chain and record the most restrictive term found. That protocol fits in one log line per artifact and answers every later "can we...?" question without re-reading anything.

Code

One acquisition line that answers future questions·text

# The license half of an acquisition record:
#   license: apache-2.0                (tag -> known terms)
#   license: llama3-community          (custom: read once ->
#        700M MAU threshold, AUP applies, trademark rules;
#        recorded 2026-09 by <who>)
#   license: UNSPECIFIED               (decision deferred;
#        treat as most restrictive until resolved)
#
# Derivative chain rule:
#   fine-tune(base=llama3-community) -> terms: llama3-community
#   merge(a=apache-2.0, b=research-only) -> terms: research-only
#   (the intersection -- most restrictive parent wins)
#
# The point: 'can I ship this in a product?' becomes a lookup,
# not an evening of re-reading licenses you already read.

Exercise

For three models in your orbit (one Apache/MIT, one custom community license, one derivative), write the license line of the acquisition record: identified license, the one or two conditions that actually constrain your use, and — for the derivative — the terms inherited through its base chain. Note any holding whose license line would currently read UNSPECIFIED.

Hint

The structured tag is the entry point, but custom licenses differ in exactly the clauses the tag cannot summarize. For derivatives, the base's page is one click through the base_model pointer.

Two byte-identical files, two different holdings

The license families you will actually meet

A reading protocol that scales

Code

External links

Exercise

Progress

Comments 0