Check G6 · provenance family · severity MEDIUM · automatic · one of the 22 GitLab checks
The question this check asks: does this project declare a licence gitlab.com can recognise? Not which one — whether anyone bothered.
The OpenSSF baseline asks for a real SPDX licence for the same reason it asks for recent commits and a recent release: a project meant to be used by strangers has to say on what terms. A project with no licence is a legal risk to anyone who ships it and an obstacle to anyone auditing it — the vetting standard's word is that it “impedes audit”. That is the ordinary reason, and on gitlab.com it is the only one this page can stand on.
On GitHub the stronger reason came out of measurement: of 100 surviving FakeGit repositories, 50 had no licence, against roughly one of the 80 most popular — nobody building a lure writes a licence, because the lure is meant to be downloaded once. That is the C6 page's figure and it stays there. No gitlab.com campaign of the FakeGit shape exists in the 2024–2026 record, so there is no survivor set to repeat the count on and no catch figure to publish here (the GitLab intelligence page has what the record does hold). What this page has instead is the other side of the ratio, measured.
G6 reads the project's license object, which gitlab.com returns only when the record is asked for it with ?license=true — RepoGates always does. When it is empty the finding no-license fires at severity MEDIUM, costs 8 points, and reads “no license — legal risk and impedes audit”; a project that trips nothing else scores 92, the badge stays green, the verdict is REVIEW, and the default personal policy warns — the download is held, the line is shown, proceeding is one click. When a licence is present it is recorded as an information line at 0 points. It never blocks on its own. The rule is the C6 page's, unchanged.
What changes is the field. GitHub gives an SPDX identifier; gitlab.com gives license.key, a lower-case SPDX id where it resolved one — mit, gpl-3.0 — which RepoGates shows upper-cased. Where GitLab did not resolve the file, the key is other and RepoGates shows GitLab's own nickname for it instead, which for inkscape/inkscape is simply LICENSE. That is still a present licence at zero points: an unresolved file is not a missing one.
Measured on 19 September 2026 over the 100 most-starred gitlab.com projects, anonymously, through the same code as /v1/gl/score: 90 declare a licence — MIT 25, GPL-3.0 13, GPL-2.0+ 11, GPL-3.0+ 10, and 8 that came back as GitLab's unresolved “LICENSE” — and 10 do not. For one of those ten the missing licence was the only thing standing between it and a PASS. The GitHub top-100 the same day also had 10 without a licence.
Every personal project whose author never thought about it, every internal tool pushed public, every research artefact, every configuration-files project — and, on a top-100 by stars, ten projects that are plainly used by strangers and simply never added the file. The absence is common and mostly innocent, which is why the weight is 8 and the action is a warning: the finding asks you to notice, not to leave. A licence GitLab cannot classify still counts as present — the key reads other and the nickname is shown — so an unusual or custom licence does not fire the check; 8 of the 90 were that shape.
Anything about the code. A licence is a text file; an MIT file copied into a malicious project is still an MIT file, and a present licence costs zero points precisely because presence proves nothing. The check does not read the licence's terms, does not compare them with the dependencies', and does not see a licence that lives somewhere GitLab's detection does not look. It is the OpenSSF baseline's third question, and the standard's verdict on the whole group applies: necessary, nowhere near sufficient.
RepoGates runs the same 22 checks on a gitlab.com project that it runs on a GitHub repository, from gitlab.com's public API, under the key gl/{namespace…}/{project}. What that API withholds from an anonymous caller — fork status, a user namespace's account age, and OpenSSF Scorecard, which does not cover gitlab.com — is listed as not checked, never assumed. A self-managed GitLab is another hostname and is not assessed. The repository's code is not read on this tier: a PASS means the provenance and the declared execution surface are clean.
Without installing anything: ask the project record for its licence — the field is absent unless you ask, and the path is URL-encoded:
curl -s 'https://gitlab.com/api/v4/projects/NAMESPACE%2FPROJECT?license=true' | jq '.license // "none"'A resolved licence answers with a lower-case SPDX key; an unresolved one answers other and a nickname. If it says none, ask the question the number is standing in for: was this project ever meant to be used by anyone other than the person who put it up?
Does a missing licence mean the code is malicious? No. It means nobody wrote a licence — which is what a throwaway project and a weekend project have in common, and what 10 of the 100 most-starred gitlab.com projects have in common with them. The finding is worth 8 points and warns because on GitHub, in aggregate, half of the surviving FakeGit repositories had no licence against about one in a hundred of the most popular ones. On one project it is a prompt; across a campaign it is a signal. No gitlab.com campaign exists to measure it on.
Does a licence make a project safe? No. A licence is a text file, and an MIT file copied into a malicious project is still an MIT file. RepoGates records the licence as an information line at zero points — GitLab's SPDX key upper-cased, or GitLab's nickname for the file where it could not resolve one; the check only costs anything when the licence is absent.
Does RepoGates hold a download from gitlab.com in the browser? Not yet. The extension does not run on gitlab.com pages; the board and the download hold there are a later, separate store release. Today a gitlab.com project is assessed on request — through the verdict API (GET /v1/gl/score/{path}), the MCP server (check_repo with platform="gl") and the preflight, which judges a command line that names a gitlab.com project: git clone https://gitlab.com/…, glab repo clone, or a pasted project, archive or release-download URL.
C6 Licence — the GitHub original · G7 Maintenance activity — the other two questions of the OpenSSF baseline, and where gitlab.com's record differs most · G5 Contributor concentration — the other weak-alone finding · G1 Owner account age — the signal a lure is built to pass.
Add RepoGates to Chrome Pricing
Numbers on this page: the 19 September 2026 measurement of the 100 most-starred gitlab.com projects, run anonymously through the same code as /v1/gl/score, and the same-day GitHub top-100 control; the anonymous gitlab.com API reads of 18 September 2026 (the licence field's shape); the C6 page's Phase 0 live tier where GitHub is cited; the OpenSSF baseline as cited in the repository vetting standard; weights from the product's scoring table.