Relicense CUDA Bindings and CUDA Python under Apache 2.0

[kkraus14]

What

• relicense cuda-bindings and the cuda-python metapackage under Apache 2.0
• make the root LICENSE canonical and package Apache 2.0 license copies in all independently built distributions while preserving package-specific copyright spans
• set License-Expression metadata and package the canonical license in wheels and sdists
• convert generated and maintained source headers without functional generated-code changes
• remove the remaining proprietary EULA text and enable cuda-bindings contributions through the DCO workflow

Dependency

This draft is based on the post-PR-2285 main branch and is blocked on the internal cybind MR.

Validation

• clean modern and legacy generation for CTK 13.3 and 12.9 emitted Apache-2.0 for all 68 CUDA outputs while preserving the proprietary default for unrelated outputs
• cuda-python and cuda-bindings wheels and sdists report License-Expression: Apache-2.0 and License-File: LICENSE with exact canonical license bytes
• local/path-based cuda-bindings lockfile entries report Apache-2.0 while historical released-package entries retain their original metadata
• CUDA 13.3 bindings wheel built successfully
• 378 bindings tests passed with 64 expected skips
• 9 Cython interoperability tests passed
• bindings documentation built successfully
• all repository pre-commit hooks passed

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

[kkraus14]

/ok to test

[github-actions]

Doc Preview CI
🚀 View preview at https://nvidia.github.io/cuda-python/pr-preview/pr-2293/
https://nvidia.github.io/cuda-python/pr-preview/pr-2293/cuda-core/
https://nvidia.github.io/cuda-python/pr-preview/pr-2293/cuda-bindings/
https://nvidia.github.io/cuda-python/pr-preview/pr-2293/cuda-pathfinder/
Preview will be ready when the GitHub Pages deployment is complete.

[mdboom]

We should update the latest copyright year on any file we've relicensed. The copyright year checker missed some -- possibly because you didn't have the changes statged when it ran (see #2293 and #2273).

Also I think the start copyright year for cuda-pathfinder was updated inadvertently.

[rwgk]

codex found this:

Tracked lockfiles still contain old cuda-bindings license metadata, e.g. cuda_bindings/pixi.lock:3035 and cuda_core/pixi.lock:4497. They are excluded from SPDX checks and partly describe old solved/released packages, but they will still show up in repo-wide old-license searches.

[rwgk]

Tracked lockfiles still contain old cuda-bindings license metadata

I raised issue #2298 after seeing this.

Not sure if we want to do anything about it, but I thought it's useful to document clearly what we have at the moment.

[rwgk]

@kkraus14 this branch is out-of-date with main. Do you want to re-trigger the CI with main merged?

[kkraus14]

@kkraus14 this branch is out-of-date with main. Do you want to re-trigger the CI with main merged?

Does it matter? I think the only non-comment changes are related to some packaging flows with regards to metadata. I don't think we'd gain any more signal vs the green CI we already have?

[rwgk]

Does it matter?

I wasn't sure. When I posted the comment, the CI had just triggered, i.e. it was just the right moment to update; but I didn't want to click the Update branch button without asking.

I agree it's fine to merge without updating now that the CI is finished already.

One small worry: is @mdboom's cybind MR 453 complete and ready for merging as well? — When I ran codex a couple hours ago, it reported that the cython-gen (aka legacy) updates still only came from 452.

[rwgk]

I just noticed, this PR updates the license in all release notes, e.g. cuda_bindings/docs/source/release/11.4.0-notes.rst. Is that intentional? — I guess we're just relicensing the release notes themselves, so should be OK? Might be worth calling out in the PR description.

In the meantime codex told me that MR 453 also takes care of the cython-gen / legacy changes, but it also found an potential issue that I'll report on the MR.

[rwgk]

To be sure there is no drift, please don't merge before:

• cybind MR 454 was merged.

• The new cybind main was run against this PR.

[rwgk]

@kkraus14 I merged main and ran cybind from it's latest main.

The new commits are:

• 3a641e5 — cybind cython-gen
• 86561aa — cybind native

Assuming the CI passes again, this LGTM. (Local testing under Linux passed.)

[rwgk]

I ran a local SPDX copyright-year audit over the tracked files, comparing the newest year in each NVIDIA SPDX-FileCopyrightText header against the latest Git author year for that file.

The full audit currently reports 53 mismatch files in the repository. I then intersected those mismatch files with the files changed by this PR, using PR head 86561aa against refreshed NVIDIA/main at 45c8b24.

Result: PR 2293 changes 260 files, and none of them overlap with the 53 copyright-year mismatch files.

---

(I backed up my script as spdx_copyright_year_full_audit_2026-07-02+173916.sh. Maybe I'll add it with another PR later.)

[kkraus14]

This pulled in a bunch of unintended and out of scope changes for this PR. Should we split this out into a different PR?

[rwgk]

That would leave cuda-python out-of-sync with cybind main.

All tests are passing, therefore I think it's better to accept that cybind moved ahead while we worked on this.