A few months ago, the question was posed: what licences do crates on crates.io use?

Obviously I couldn’t resist the opportunity to dive into this, so I gathered the data, and generated this chart:

Or, in table format, the top 10:

Licence Count
MIT 110204
Apache-2.0 61993
GPL-3.0 4970
MPL-2.0 3676
BSD-3-Clause 2951
GPL-3.0-or-later 2818
AGPL-3.0 1549
Unlicense 1426
AGPL-3.0-or-later 1116
ISC 1072

The keen-eyed observer will note that the numbers add up quite obviously to more than the actual number of crates published on crates.io. This is because many crates are dual (or even more than dual) licensed: in fact, over 40,000 crates are dual licensed under MIT and Apache 2.0. (This is about a quarter of all crates on crates.io!)

I don’t think cargo has ever prefilled a licence for new projects, so I suspect this is purely the social norm arising from Rust itself being dual MIT and Apache 2.0 licensed: that led to many early and influential crates being dual licensed the same way, and then it snowballed from there.

Update: After publishing this post, Ed Page pointed me to this page on Rust API guidelines which does explicitly recommend the MIT OR Apache-2.0 combination, so that may explain at least some of its dominance.

I tried to visualise the most common combinations of licences, but I don’t think it ended up being all that useful, since I had to take the logarithm of the edge weights due to how dominant the MIT and Apache 2.0 pair was. Nevertheless, here it is:

The processed data (as of November 21, 2024)1 is available: both the individual licence counts after splitting multi-licensed crates, along with the graph data showing all the pairs found in multi-licensed projects. I’ve also included the raw CSV generated from the crates.io database, which is simply the count of each licence seen in the default version for each crate.

I’ve also published the analysis code to GitHub. It’s a little fiddly, but if anyone wants to replicate or build on this, that’s where to start.

May your crates be forever licensed appropriately! (Or at all.)

  1. Yes, I’ve been sitting on this for a while. I did the visualisations and then completely forgot I had to actually write a blog post around them. ↩