Build1 publisher3 min readPublished
NuGet license metadata misses the binary fee on both Open Source Maintenance Fee adopters
Pennyforge's audit of the two confirmed Open Source Maintenance Fee packages on NuGet found the fee in registry metadata for neither of them. The companies above the fee thresholds are the ones that run automated license scans, and they have to read each project's terms by hand.
The Engineer · Build desk
Drafted by a language model from the sources cited here and checked against its claim ledger before publication. How we use AISend a correction
What happened
- Downloading each package and searching its files for fee, EULA and sponsor terms found the fee in one of the two adopters.
- The OSMF site tells consumers to search each dependency on NuGet, click through to the project website and follow its README, and it publishes no adopter list.
- The .NET Foundation's August 2026 board statement stays neutral on the model and tells consumers to review every artifact's terms.
Compiled by The EngineerSomething wrong?How this is made
Why it matters
- exposure Organizations above Excelsior's $10k and Polly's $20k thresholds are the ones who owe the fee, and Pennyforge says they are also the ones clearing dependencies with automated scanners.
- constraint The fee is defined as not a license fee and has no license-expression extension, so the field scanners trust cannot carry it; closing the gap needs a new metadata marker.
- decision A license-unknown result on a NuGet package can now mean a binary fee, so teams that wave unknowns through have to decide whether to route them to manual review.
- cost Until a marker exists, each direct dependency needs a person to search NuGet, open the project site and read the README, and that work grows with the dependency list.
Pennyforge's registry-only check read four fields from NuGet's V3 registration API: licenseExpression, licenseUrl, tags and description [5]. Pennyforge says those fields are exactly what an automated license scanner sees without downloading anything [5]. The fee showed up in none of them for either package [6]. Under the model, created by Rob Mensching, a project's source stays under its existing OSI license and the fee attaches to the official binary release [1].
The license field has nothing correct to say about the fee. The model is explicitly not a license fee, and there is no license-expression extension for it [2][13]. Polly's entry says BSD-3-Clause. That is true of its source, and it is the only license signal in the registry [9]. The registry knew more about Excelsior before it charged anyone: the expression read MIT at 4.0.0 and went empty at 5.0.0, when the EULA landed [8].
Scanners do not report both packages as clean [8][9]. An empty expression is how scanners report "unknown", so Excelsior gets flagged with no reason attached [8]. Polly passes, and today the pass is correct. Its fee covers "maintained releases", the latest 8.8.0 is clean, and the first fee-gated release is still pending [10]. When that release ships, current metadata has no marker to put on it [13].
Excelsior's EULA allows "suspending access to the Binary Release" for non-payment, and the package ships a build-time nudge [11]. None of that is reachable from the registry [11]. The full-package audit downloaded the latest nupkg and searched its files for fee, OSMF, sponsor and EULA strings [7]. It caught one adopter of two [6]. That one is Excelsior, since nothing at either depth reveals Polly's announced fee [18]. For a team that waves "unknown" through, the build-time nudge is where the fee first shows up [11].
Discovery is defined as a human workflow [12]. The OSMF site's "Which projects do you pay?" page gives consumers these steps [12]:
1. Collect the direct dependencies. 2. Search each one on NuGet. 3. Click "Project website". 4. Follow the instructions in the project's README [12].
The OSMF site does not publish an adopter list [13]. The .NET Foundation's August 2026 board statement, deliberately neutral on the model, gives consumers the same instruction: review every artifact's terms, because the license element "does not tell the whole story" [14].
Excelsior has an under-$10k exemption and Polly an under-$20k threshold [15]. Pennyforge argues that leaves the exposure with revenue-generating organizations, the same ones that run automated license scanners [15].
The audit is careful work. Pennyforge dates the first adoption wave June to September 2026 [3]. It reports two confirmed adopters as the complete confirmed population as of 2026-10-06, and it excludes Verify because that project is still considering [4]. It labels its expectation of the same gap on npm and PyPI as an inference it has not measured, even though the OSMF site documents npm consumer workflows [19]. For the 0-of-2 result to transfer, those registries would need the same missing marker, and Pennyforge has not checked [19]. The paper trail is already decaying. Polly's announcement URL, dated 2026-07-14, returns 404 since the project site moved [16].
Pennyforge proposes a marker in package metadata that flags a project as an adopter or, failing that, a list of adopters published on the OSMF site [17]. Of the two, only the marker would reach a tool that reads registry metadata and nothing else [5][17].
What to watch
- Polly's first fee-gated maintained release: whether its NuGet entry or package contents show the fee when it ships.
- Whether the OSMF site publishes an adopter index or NuGet metadata gains an adoption marker.
- A measured audit of npm or PyPI adopters, testing whether the 0-of-2 registry result holds outside NuGet.