From 49c608a598892226e86b03f71adfc5d366392df1 Mon Sep 17 00:00:00 2001
From: Duc Nguyen <106774416+ducnguyen-sb@users.noreply.github.com>
Date: Tue, 13 Feb 2024 12:45:42 -0500
Subject: [PATCH] Change XMSS License from `(Apache 2.0 AND MIT)` to `(Apache
 2.0 OR MIT) AND CC0-1.0` (#1697)

* include CC0 and convert to Apache 2.0 OR MIT

* update license

* Add missing CC0-1.0
---
 docs/algorithms/sig_stfl/xmss.md                   |  2 +-
 docs/algorithms/sig_stfl/xmss.yml                  |  4 ++--
 src/sig_stfl/xmss/CMakeLists.txt                   |  2 +-
 src/sig_stfl/xmss/LICENSE                          | 14 ++++++++++++--
 src/sig_stfl/xmss/LICENSE-MIT                      |  9 ---------
 src/sig_stfl/xmss/external/core_hash.c             |  2 +-
 src/sig_stfl/xmss/external/core_hash.h             |  2 +-
 src/sig_stfl/xmss/external/hash.c                  |  2 +-
 src/sig_stfl/xmss/external/hash.h                  |  2 +-
 src/sig_stfl/xmss/external/hash_address.c          |  2 +-
 src/sig_stfl/xmss/external/hash_address.h          |  2 +-
 src/sig_stfl/xmss/external/namespace.h             |  2 +-
 src/sig_stfl/xmss/external/params.c                |  2 +-
 src/sig_stfl/xmss/external/params.h                |  2 +-
 src/sig_stfl/xmss/external/utils.c                 |  2 +-
 src/sig_stfl/xmss/external/utils.h                 |  2 +-
 src/sig_stfl/xmss/external/wots.c                  |  2 +-
 src/sig_stfl/xmss/external/wots.h                  |  2 +-
 src/sig_stfl/xmss/external/xmss.c                  |  2 +-
 src/sig_stfl/xmss/external/xmss.h                  |  2 +-
 src/sig_stfl/xmss/external/xmss_commons.c          |  2 +-
 src/sig_stfl/xmss/external/xmss_commons.h          |  2 +-
 src/sig_stfl/xmss/external/xmss_core.c             |  2 +-
 src/sig_stfl/xmss/external/xmss_core.h             |  2 +-
 src/sig_stfl/xmss/external/xmss_core_fast.c        |  2 +-
 src/sig_stfl/xmss/sig_stfl_xmss.h                  |  2 +-
 src/sig_stfl/xmss/sig_stfl_xmss_functions.c        |  2 +-
 .../xmss/sig_stfl_xmss_secret_key_functions.c      |  2 +-
 src/sig_stfl/xmss/sig_stfl_xmss_sha256_h10.c       |  2 +-
 src/sig_stfl/xmss/sig_stfl_xmss_sha256_h16.c       |  2 +-
 src/sig_stfl/xmss/sig_stfl_xmss_sha256_h20.c       |  2 +-
 src/sig_stfl/xmss/sig_stfl_xmss_sha512_h10.c       |  3 ++-
 src/sig_stfl/xmss/sig_stfl_xmss_sha512_h16.c       |  2 +-
 src/sig_stfl/xmss/sig_stfl_xmss_sha512_h20.c       |  2 +-
 src/sig_stfl/xmss/sig_stfl_xmss_shake128_h10.c     |  3 ++-
 src/sig_stfl/xmss/sig_stfl_xmss_shake128_h16.c     |  3 ++-
 src/sig_stfl/xmss/sig_stfl_xmss_shake128_h20.c     |  3 ++-
 src/sig_stfl/xmss/sig_stfl_xmss_shake256_h10.c     |  3 ++-
 src/sig_stfl/xmss/sig_stfl_xmss_shake256_h16.c     |  3 ++-
 src/sig_stfl/xmss/sig_stfl_xmss_shake256_h20.c     |  3 ++-
 src/sig_stfl/xmss/sig_stfl_xmss_xmssmt.c           |  2 +-
 src/sig_stfl/xmss/sig_stfl_xmssmt_functions.c      |  2 +-
 src/sig_stfl/xmss/sig_stfl_xmssmt_sha256_h20_2.c   |  3 ++-
 src/sig_stfl/xmss/sig_stfl_xmssmt_sha256_h20_4.c   |  3 ++-
 src/sig_stfl/xmss/sig_stfl_xmssmt_sha256_h40_2.c   |  3 ++-
 src/sig_stfl/xmss/sig_stfl_xmssmt_sha256_h40_4.c   |  3 ++-
 src/sig_stfl/xmss/sig_stfl_xmssmt_sha256_h40_8.c   |  4 ++--
 src/sig_stfl/xmss/sig_stfl_xmssmt_sha256_h60_12.c  |  3 +--
 src/sig_stfl/xmss/sig_stfl_xmssmt_sha256_h60_3.c   |  3 ++-
 src/sig_stfl/xmss/sig_stfl_xmssmt_sha256_h60_6.c   |  2 +-
 src/sig_stfl/xmss/sig_stfl_xmssmt_shake128_h20_2.c |  2 +-
 src/sig_stfl/xmss/sig_stfl_xmssmt_shake128_h20_4.c |  2 +-
 src/sig_stfl/xmss/sig_stfl_xmssmt_shake128_h40_2.c |  2 +-
 src/sig_stfl/xmss/sig_stfl_xmssmt_shake128_h40_4.c |  2 +-
 src/sig_stfl/xmss/sig_stfl_xmssmt_shake128_h40_8.c |  2 +-
 .../xmss/sig_stfl_xmssmt_shake128_h60_12.c         |  2 +-
 src/sig_stfl/xmss/sig_stfl_xmssmt_shake128_h60_3.c |  2 +-
 src/sig_stfl/xmss/sig_stfl_xmssmt_shake128_h60_6.c |  2 +-
 58 files changed, 82 insertions(+), 70 deletions(-)
 delete mode 100644 src/sig_stfl/xmss/LICENSE-MIT

diff --git a/docs/algorithms/sig_stfl/xmss.md b/docs/algorithms/sig_stfl/xmss.md
index b78dce983b..b68bfc3020 100644
--- a/docs/algorithms/sig_stfl/xmss.md
+++ b/docs/algorithms/sig_stfl/xmss.md
@@ -7,7 +7,7 @@
 - **Specification version**: None.
 - **Primary Source**<a name="primary-source"></a>:
   - **Source**: https://github.com/XMSS/xmss-reference
-  - **Implementation license (SPDX-Identifier)**: Apache-2.0 AND MIT
+  - **Implementation license (SPDX-Identifier)**: (Apache-2.0 OR MIT) AND CC0-1.0
 
 
 ## Parameter set summary
diff --git a/docs/algorithms/sig_stfl/xmss.yml b/docs/algorithms/sig_stfl/xmss.yml
index bf57a7eeb8..ccc92c26ea 100644
--- a/docs/algorithms/sig_stfl/xmss.yml
+++ b/docs/algorithms/sig_stfl/xmss.yml
@@ -11,10 +11,10 @@ crypto-assumption: hash function second-preimage resistance
 website: https://www.rfc-editor.org/info/rfc8391
 nist-round: 
 spec-version: 
-spdx-license-identifier: Apache-2.0 AND MIT
+spdx-license-identifier: (Apache-2.0 OR MIT) AND CC0-1.0
 primary-upstream:
   source: https://github.com/XMSS/xmss-reference
-  spdx-license-identifier: Apache-2.0 AND MIT
+  spdx-license-identifier: (Apache-2.0 OR MIT) AND CC0-1.0
   upstream-ancestors:
 parameter-sets:
 - name: XMSS-SHA2_10_256 
diff --git a/src/sig_stfl/xmss/CMakeLists.txt b/src/sig_stfl/xmss/CMakeLists.txt
index dc57732e16..f9fc4fc08d 100644
--- a/src/sig_stfl/xmss/CMakeLists.txt
+++ b/src/sig_stfl/xmss/CMakeLists.txt
@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: Apache-2.0 AND MIT
+# SPDX-License-Identifier: (Apache-2.0 OR MIT) AND CC0-1.0
 
 set(_XMSS_OBJS "")
 
diff --git a/src/sig_stfl/xmss/LICENSE b/src/sig_stfl/xmss/LICENSE
index 90a1bebcfa..6fc799ea78 100644
--- a/src/sig_stfl/xmss/LICENSE
+++ b/src/sig_stfl/xmss/LICENSE
@@ -1,8 +1,18 @@
 ## License
 
-This XMSS reference implementation is Copyright (c) 2024 SandboxAQ and licensed under both the [Apache License, Version 2.0](https://www.apache.org/licenses/LICENSE-2.0.txt) and [MIT License](LICENSE-MIT).
+This XMSS reference implementation is Copyright (c) 2024 SandboxAQ and licensed under the CC0-1.0 AND ([Apache License, Version 2.0](https://www.apache.org/licenses/LICENSE-2.0.txt) OR MIT License) at your option.
 
-Unless you explicitly state otherwise, any contribution intentionally submitted for inclusion in the work by you, as defined in the Apache-2.0 license, shall be dual licensed as above, without any additional terms or conditions.
+---------------------------------
+The MIT License (MIT)
+
+Copyright © 2024 SandboxAQ
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the “Software”), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED “AS IS”, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+---------------------------------
 
 This XMSS reference implementation is based on the [XMSS reference implementation written by Andreas Hülsing and Joost Rijneveld](https://github.com/XMSS/xmss-reference#license) provided under the CC0 1.0 Universal Public Domain Dedication.
 
diff --git a/src/sig_stfl/xmss/LICENSE-MIT b/src/sig_stfl/xmss/LICENSE-MIT
deleted file mode 100644
index 7b1af979f6..0000000000
--- a/src/sig_stfl/xmss/LICENSE-MIT
+++ /dev/null
@@ -1,9 +0,0 @@
-The MIT License (MIT)
-
-Copyright © 2024 SandboxAQ
-
-Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the “Software”), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED “AS IS”, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
diff --git a/src/sig_stfl/xmss/external/core_hash.c b/src/sig_stfl/xmss/external/core_hash.c
index 72fe4e9d5c..7c80f3f860 100644
--- a/src/sig_stfl/xmss/external/core_hash.c
+++ b/src/sig_stfl/xmss/external/core_hash.c
@@ -1,4 +1,4 @@
-// SPDX-License-Identifier: Apache-2.0 AND MIT
+// SPDX-License-Identifier: (Apache-2.0 OR MIT) AND CC0-1.0
 #include <oqs/sha2.h>
 #include <oqs/sha3.h>
 #include "core_hash.h"
diff --git a/src/sig_stfl/xmss/external/core_hash.h b/src/sig_stfl/xmss/external/core_hash.h
index e292e4c06d..dbbeecca83 100644
--- a/src/sig_stfl/xmss/external/core_hash.h
+++ b/src/sig_stfl/xmss/external/core_hash.h
@@ -1,4 +1,4 @@
-// SPDX-License-Identifier: Apache-2.0 AND MIT
+// SPDX-License-Identifier: (Apache-2.0 OR MIT) AND CC0-1.0
 #ifndef CORE_HASH
 #define CORE_HASH
 
diff --git a/src/sig_stfl/xmss/external/hash.c b/src/sig_stfl/xmss/external/hash.c
index 557c8de7db..f9272f01c3 100644
--- a/src/sig_stfl/xmss/external/hash.c
+++ b/src/sig_stfl/xmss/external/hash.c
@@ -1,4 +1,4 @@
-// SPDX-License-Identifier: Apache-2.0 AND MIT
+// SPDX-License-Identifier: (Apache-2.0 OR MIT) AND CC0-1.0
 #include <stdint.h>
 #include <string.h>
 
diff --git a/src/sig_stfl/xmss/external/hash.h b/src/sig_stfl/xmss/external/hash.h
index bd1e1c1202..708dd6932a 100644
--- a/src/sig_stfl/xmss/external/hash.h
+++ b/src/sig_stfl/xmss/external/hash.h
@@ -1,4 +1,4 @@
-// SPDX-License-Identifier: Apache-2.0 AND MIT
+// SPDX-License-Identifier: (Apache-2.0 OR MIT) AND CC0-1.0
 #ifndef XMSS_HASH_H
 #define XMSS_HASH_H
 
diff --git a/src/sig_stfl/xmss/external/hash_address.c b/src/sig_stfl/xmss/external/hash_address.c
index a9fec506b5..eaa5ff6fc9 100644
--- a/src/sig_stfl/xmss/external/hash_address.c
+++ b/src/sig_stfl/xmss/external/hash_address.c
@@ -1,4 +1,4 @@
-// SPDX-License-Identifier: Apache-2.0 AND MIT
+// SPDX-License-Identifier: (Apache-2.0 OR MIT) AND CC0-1.0
 #include <stdint.h>
 #include "hash_address.h"
 
diff --git a/src/sig_stfl/xmss/external/hash_address.h b/src/sig_stfl/xmss/external/hash_address.h
index 06f5c502bd..3929558546 100644
--- a/src/sig_stfl/xmss/external/hash_address.h
+++ b/src/sig_stfl/xmss/external/hash_address.h
@@ -1,4 +1,4 @@
-// SPDX-License-Identifier: Apache-2.0 AND MIT
+// SPDX-License-Identifier: (Apache-2.0 OR MIT) AND CC0-1.0
 #ifndef XMSS_HASH_ADDRESS_H
 #define XMSS_HASH_ADDRESS_H
 
diff --git a/src/sig_stfl/xmss/external/namespace.h b/src/sig_stfl/xmss/external/namespace.h
index 7bb7d05349..3fe67527d2 100644
--- a/src/sig_stfl/xmss/external/namespace.h
+++ b/src/sig_stfl/xmss/external/namespace.h
@@ -1,4 +1,4 @@
-// SPDX-License-Identifier: Apache-2.0 AND MIT
+// SPDX-License-Identifier: (Apache-2.0 OR MIT) AND CC0-1.0
 #ifndef XMSS_NAMESPACE_H
 #define XMSS_NAMESPACE_H
 
diff --git a/src/sig_stfl/xmss/external/params.c b/src/sig_stfl/xmss/external/params.c
index f9ba544e47..a1d49d1340 100644
--- a/src/sig_stfl/xmss/external/params.c
+++ b/src/sig_stfl/xmss/external/params.c
@@ -1,4 +1,4 @@
-// SPDX-License-Identifier: Apache-2.0 AND MIT
+// SPDX-License-Identifier: (Apache-2.0 OR MIT) AND CC0-1.0
 #include <stdint.h>
 #include <string.h>
 
diff --git a/src/sig_stfl/xmss/external/params.h b/src/sig_stfl/xmss/external/params.h
index f75e3c97c5..e9a5faaa2b 100644
--- a/src/sig_stfl/xmss/external/params.h
+++ b/src/sig_stfl/xmss/external/params.h
@@ -1,4 +1,4 @@
-// SPDX-License-Identifier: Apache-2.0 AND MIT
+// SPDX-License-Identifier: (Apache-2.0 OR MIT) AND CC0-1.0
 #ifndef XMSS_PARAMS_H
 #define XMSS_PARAMS_H
 
diff --git a/src/sig_stfl/xmss/external/utils.c b/src/sig_stfl/xmss/external/utils.c
index c2d76aba15..f03ef93d40 100644
--- a/src/sig_stfl/xmss/external/utils.c
+++ b/src/sig_stfl/xmss/external/utils.c
@@ -1,4 +1,4 @@
-// SPDX-License-Identifier: Apache-2.0 AND MIT
+// SPDX-License-Identifier: (Apache-2.0 OR MIT) AND CC0-1.0
 #include "utils.h"
 
 /**
diff --git a/src/sig_stfl/xmss/external/utils.h b/src/sig_stfl/xmss/external/utils.h
index 14d8588ddc..e3c1d2853d 100644
--- a/src/sig_stfl/xmss/external/utils.h
+++ b/src/sig_stfl/xmss/external/utils.h
@@ -1,4 +1,4 @@
-// SPDX-License-Identifier: Apache-2.0 AND MIT
+// SPDX-License-Identifier: (Apache-2.0 OR MIT) AND CC0-1.0
 #ifndef XMSS_UTILS_H
 #define XMSS_UTILS_H
 
diff --git a/src/sig_stfl/xmss/external/wots.c b/src/sig_stfl/xmss/external/wots.c
index a4bfae956d..8ef4f026cd 100644
--- a/src/sig_stfl/xmss/external/wots.c
+++ b/src/sig_stfl/xmss/external/wots.c
@@ -1,4 +1,4 @@
-// SPDX-License-Identifier: Apache-2.0 AND MIT
+// SPDX-License-Identifier: (Apache-2.0 OR MIT) AND CC0-1.0
 #include <stdint.h>
 #include <string.h>
 
diff --git a/src/sig_stfl/xmss/external/wots.h b/src/sig_stfl/xmss/external/wots.h
index e0e3f1d0a9..8f8756ede3 100644
--- a/src/sig_stfl/xmss/external/wots.h
+++ b/src/sig_stfl/xmss/external/wots.h
@@ -1,4 +1,4 @@
-// SPDX-License-Identifier: Apache-2.0 AND MIT
+// SPDX-License-Identifier: (Apache-2.0 OR MIT) AND CC0-1.0
 #ifndef XMSS_WOTS_H
 #define XMSS_WOTS_H
 
diff --git a/src/sig_stfl/xmss/external/xmss.c b/src/sig_stfl/xmss/external/xmss.c
index 71d3f0a463..6a224a8d3e 100644
--- a/src/sig_stfl/xmss/external/xmss.c
+++ b/src/sig_stfl/xmss/external/xmss.c
@@ -1,4 +1,4 @@
-// SPDX-License-Identifier: Apache-2.0 AND MIT
+// SPDX-License-Identifier: (Apache-2.0 OR MIT) AND CC0-1.0
 #include <stdint.h>
 
 #include "params.h"
diff --git a/src/sig_stfl/xmss/external/xmss.h b/src/sig_stfl/xmss/external/xmss.h
index 53d21e2dbd..566b809b9e 100644
--- a/src/sig_stfl/xmss/external/xmss.h
+++ b/src/sig_stfl/xmss/external/xmss.h
@@ -1,4 +1,4 @@
-// SPDX-License-Identifier: Apache-2.0 AND MIT
+// SPDX-License-Identifier: (Apache-2.0 OR MIT) AND CC0-1.0
 #ifndef XMSS_H
 #define XMSS_H
 
diff --git a/src/sig_stfl/xmss/external/xmss_commons.c b/src/sig_stfl/xmss/external/xmss_commons.c
index 168e6ffed5..645faf0112 100644
--- a/src/sig_stfl/xmss/external/xmss_commons.c
+++ b/src/sig_stfl/xmss/external/xmss_commons.c
@@ -1,4 +1,4 @@
-// SPDX-License-Identifier: Apache-2.0 AND MIT
+// SPDX-License-Identifier: (Apache-2.0 OR MIT) AND CC0-1.0
 #include <stdlib.h>
 #include <string.h>
 #include <stdint.h>
diff --git a/src/sig_stfl/xmss/external/xmss_commons.h b/src/sig_stfl/xmss/external/xmss_commons.h
index 26eb537ee3..958fd3ffa3 100644
--- a/src/sig_stfl/xmss/external/xmss_commons.h
+++ b/src/sig_stfl/xmss/external/xmss_commons.h
@@ -1,4 +1,4 @@
-// SPDX-License-Identifier: Apache-2.0 AND MIT
+// SPDX-License-Identifier: (Apache-2.0 OR MIT) AND CC0-1.0
 #ifndef XMSS_COMMONS_H
 #define XMSS_COMMONS_H
 
diff --git a/src/sig_stfl/xmss/external/xmss_core.c b/src/sig_stfl/xmss/external/xmss_core.c
index 4d7e8de096..1052d4d7e5 100644
--- a/src/sig_stfl/xmss/external/xmss_core.c
+++ b/src/sig_stfl/xmss/external/xmss_core.c
@@ -1,4 +1,4 @@
-// SPDX-License-Identifier: Apache-2.0 AND MIT
+// SPDX-License-Identifier: (Apache-2.0 OR MIT) AND CC0-1.0
 #include <stdlib.h>
 #include <string.h>
 #include <stdint.h>
diff --git a/src/sig_stfl/xmss/external/xmss_core.h b/src/sig_stfl/xmss/external/xmss_core.h
index 007c42172a..54cccc25e4 100644
--- a/src/sig_stfl/xmss/external/xmss_core.h
+++ b/src/sig_stfl/xmss/external/xmss_core.h
@@ -1,4 +1,4 @@
-// SPDX-License-Identifier: Apache-2.0 AND MIT
+// SPDX-License-Identifier: (Apache-2.0 OR MIT) AND CC0-1.0
 #ifndef XMSS_CORE_H
 #define XMSS_CORE_H
 
diff --git a/src/sig_stfl/xmss/external/xmss_core_fast.c b/src/sig_stfl/xmss/external/xmss_core_fast.c
index 71b0f471ca..d539c1f6c2 100644
--- a/src/sig_stfl/xmss/external/xmss_core_fast.c
+++ b/src/sig_stfl/xmss/external/xmss_core_fast.c
@@ -1,4 +1,4 @@
-// SPDX-License-Identifier: Apache-2.0 AND MIT
+// SPDX-License-Identifier: (Apache-2.0 OR MIT) AND CC0-1.0
 #include <stdlib.h>
 #include <string.h>
 #include <stdint.h>
diff --git a/src/sig_stfl/xmss/sig_stfl_xmss.h b/src/sig_stfl/xmss/sig_stfl_xmss.h
index 4166cafcb7..a926c5ddd3 100644
--- a/src/sig_stfl/xmss/sig_stfl_xmss.h
+++ b/src/sig_stfl/xmss/sig_stfl_xmss.h
@@ -1,4 +1,4 @@
-// SPDX-License-Identifier: Apache-2.0 AND MIT
+// SPDX-License-Identifier: (Apache-2.0 OR MIT) AND CC0-1.0
 
 #ifndef OQS_SIG_STFL_XMSS_H
 #define OQS_SIG_STFL_XMSS_H
diff --git a/src/sig_stfl/xmss/sig_stfl_xmss_functions.c b/src/sig_stfl/xmss/sig_stfl_xmss_functions.c
index ce2df38238..64d714e600 100644
--- a/src/sig_stfl/xmss/sig_stfl_xmss_functions.c
+++ b/src/sig_stfl/xmss/sig_stfl_xmss_functions.c
@@ -1,4 +1,4 @@
-// SPDX-License-Identifier: Apache-2.0 AND MIT
+// SPDX-License-Identifier: (Apache-2.0 OR MIT) AND CC0-1.0
 #include <string.h>
 #include <stdlib.h>
 
diff --git a/src/sig_stfl/xmss/sig_stfl_xmss_secret_key_functions.c b/src/sig_stfl/xmss/sig_stfl_xmss_secret_key_functions.c
index 4f6413a98b..59321ffcfa 100644
--- a/src/sig_stfl/xmss/sig_stfl_xmss_secret_key_functions.c
+++ b/src/sig_stfl/xmss/sig_stfl_xmss_secret_key_functions.c
@@ -1,4 +1,4 @@
-// SPDX-License-Identifier: Apache-2.0 AND MIT
+// SPDX-License-Identifier: (Apache-2.0 OR MIT) AND CC0-1.0
 
 #include <oqs/oqs.h>
 #include <string.h>
diff --git a/src/sig_stfl/xmss/sig_stfl_xmss_sha256_h10.c b/src/sig_stfl/xmss/sig_stfl_xmss_sha256_h10.c
index 7b9bcff39b..7e4a5e50c2 100644
--- a/src/sig_stfl/xmss/sig_stfl_xmss_sha256_h10.c
+++ b/src/sig_stfl/xmss/sig_stfl_xmss_sha256_h10.c
@@ -1,4 +1,4 @@
-// SPDX-License-Identifier: Apache-2.0 AND MIT
+// SPDX-License-Identifier: (Apache-2.0 OR MIT) AND CC0-1.0
 
 #include "sig_stfl_xmss_xmssmt.c"
 
diff --git a/src/sig_stfl/xmss/sig_stfl_xmss_sha256_h16.c b/src/sig_stfl/xmss/sig_stfl_xmss_sha256_h16.c
index c883e21e0e..bcd4cd56de 100644
--- a/src/sig_stfl/xmss/sig_stfl_xmss_sha256_h16.c
+++ b/src/sig_stfl/xmss/sig_stfl_xmss_sha256_h16.c
@@ -1,4 +1,4 @@
-// SPDX-License-Identifier: Apache-2.0 AND MIT
+// SPDX-License-Identifier: (Apache-2.0 OR MIT) AND CC0-1.0
 
 #include "sig_stfl_xmss_xmssmt.c"
 
diff --git a/src/sig_stfl/xmss/sig_stfl_xmss_sha256_h20.c b/src/sig_stfl/xmss/sig_stfl_xmss_sha256_h20.c
index a190255f2c..80392100cd 100644
--- a/src/sig_stfl/xmss/sig_stfl_xmss_sha256_h20.c
+++ b/src/sig_stfl/xmss/sig_stfl_xmss_sha256_h20.c
@@ -1,4 +1,4 @@
-// SPDX-License-Identifier: Apache-2.0 AND MIT
+// SPDX-License-Identifier: (Apache-2.0 OR MIT) AND CC0-1.0
 
 #include "sig_stfl_xmss_xmssmt.c"
 
diff --git a/src/sig_stfl/xmss/sig_stfl_xmss_sha512_h10.c b/src/sig_stfl/xmss/sig_stfl_xmss_sha512_h10.c
index 1ff4cd891a..1a4fe53c41 100644
--- a/src/sig_stfl/xmss/sig_stfl_xmss_sha512_h10.c
+++ b/src/sig_stfl/xmss/sig_stfl_xmss_sha512_h10.c
@@ -1,6 +1,7 @@
-// SPDX-License-Identifier: Apache-2.0 AND MIT
+// SPDX-License-Identifier: (Apache-2.0 OR MIT) AND CC0-1.0
 
 #include "sig_stfl_xmss_xmssmt.c"
 
 // ======================== XMSS-SHA2_10_512 ======================== //
+
 XMSS_ALG(, _sha512_h10, _SHA512_H10)
diff --git a/src/sig_stfl/xmss/sig_stfl_xmss_sha512_h16.c b/src/sig_stfl/xmss/sig_stfl_xmss_sha512_h16.c
index c1b5ed9150..2e8f87c026 100644
--- a/src/sig_stfl/xmss/sig_stfl_xmss_sha512_h16.c
+++ b/src/sig_stfl/xmss/sig_stfl_xmss_sha512_h16.c
@@ -1,4 +1,4 @@
-// SPDX-License-Identifier: Apache-2.0 AND MIT
+// SPDX-License-Identifier: (Apache-2.0 OR MIT) AND CC0-1.0
 
 #include "sig_stfl_xmss_xmssmt.c"
 
diff --git a/src/sig_stfl/xmss/sig_stfl_xmss_sha512_h20.c b/src/sig_stfl/xmss/sig_stfl_xmss_sha512_h20.c
index bf0a5b8d12..bc3827e3de 100644
--- a/src/sig_stfl/xmss/sig_stfl_xmss_sha512_h20.c
+++ b/src/sig_stfl/xmss/sig_stfl_xmss_sha512_h20.c
@@ -1,4 +1,4 @@
-// SPDX-License-Identifier: Apache-2.0 AND MIT
+// SPDX-License-Identifier: (Apache-2.0 OR MIT) AND CC0-1.0
 
 #include "sig_stfl_xmss_xmssmt.c"
 
diff --git a/src/sig_stfl/xmss/sig_stfl_xmss_shake128_h10.c b/src/sig_stfl/xmss/sig_stfl_xmss_shake128_h10.c
index 8c01394663..85fde8add4 100644
--- a/src/sig_stfl/xmss/sig_stfl_xmss_shake128_h10.c
+++ b/src/sig_stfl/xmss/sig_stfl_xmss_shake128_h10.c
@@ -1,6 +1,7 @@
-// SPDX-License-Identifier: Apache-2.0 AND MIT
+// SPDX-License-Identifier: (Apache-2.0 OR MIT) AND CC0-1.0
 
 #include "sig_stfl_xmss_xmssmt.c"
 
 // ======================== XMSS-SHAKE_10_256 ======================== //
+
 XMSS_ALG(, _shake128_h10, _SHAKE128_H10)
diff --git a/src/sig_stfl/xmss/sig_stfl_xmss_shake128_h16.c b/src/sig_stfl/xmss/sig_stfl_xmss_shake128_h16.c
index ff45fc0f5f..8b48276f45 100644
--- a/src/sig_stfl/xmss/sig_stfl_xmss_shake128_h16.c
+++ b/src/sig_stfl/xmss/sig_stfl_xmss_shake128_h16.c
@@ -1,6 +1,7 @@
-// SPDX-License-Identifier: Apache-2.0 AND MIT
+// SPDX-License-Identifier: (Apache-2.0 OR MIT) AND CC0-1.0
 
 #include "sig_stfl_xmss_xmssmt.c"
 
 // ======================== XMSS-SHAKE_10_256 ======================== //
+
 XMSS_ALG(, _shake128_h16, _SHAKE128_H16)
diff --git a/src/sig_stfl/xmss/sig_stfl_xmss_shake128_h20.c b/src/sig_stfl/xmss/sig_stfl_xmss_shake128_h20.c
index d566069a82..30d34b9633 100644
--- a/src/sig_stfl/xmss/sig_stfl_xmss_shake128_h20.c
+++ b/src/sig_stfl/xmss/sig_stfl_xmss_shake128_h20.c
@@ -1,6 +1,7 @@
-// SPDX-License-Identifier: Apache-2.0 AND MIT
+// SPDX-License-Identifier: (Apache-2.0 OR MIT) AND CC0-1.0
 
 #include "sig_stfl_xmss_xmssmt.c"
 
 // ======================== XMSS-SHAKE_10_256 ======================== //
+
 XMSS_ALG(, _shake128_h20, _SHAKE128_H20)
diff --git a/src/sig_stfl/xmss/sig_stfl_xmss_shake256_h10.c b/src/sig_stfl/xmss/sig_stfl_xmss_shake256_h10.c
index aea7ef0204..dde4f1d400 100644
--- a/src/sig_stfl/xmss/sig_stfl_xmss_shake256_h10.c
+++ b/src/sig_stfl/xmss/sig_stfl_xmss_shake256_h10.c
@@ -1,6 +1,7 @@
-// SPDX-License-Identifier: Apache-2.0 AND MIT
+// SPDX-License-Identifier: (Apache-2.0 OR MIT) AND CC0-1.0
 
 #include "sig_stfl_xmss_xmssmt.c"
 
 // ======================== XMSS-SHAKE_10_512 ======================== //
+
 XMSS_ALG(, _shake256_h10, _SHAKE256_H10)
diff --git a/src/sig_stfl/xmss/sig_stfl_xmss_shake256_h16.c b/src/sig_stfl/xmss/sig_stfl_xmss_shake256_h16.c
index d96e7644b3..1a41d0f172 100644
--- a/src/sig_stfl/xmss/sig_stfl_xmss_shake256_h16.c
+++ b/src/sig_stfl/xmss/sig_stfl_xmss_shake256_h16.c
@@ -1,6 +1,7 @@
-// SPDX-License-Identifier: Apache-2.0 AND MIT
+// SPDX-License-Identifier: (Apache-2.0 OR MIT) AND CC0-1.0
 
 #include "sig_stfl_xmss_xmssmt.c"
 
 // ======================== XMSS-SHAKE_16_512 ======================== //
+
 XMSS_ALG(, _shake256_h16, _SHAKE256_H16)
diff --git a/src/sig_stfl/xmss/sig_stfl_xmss_shake256_h20.c b/src/sig_stfl/xmss/sig_stfl_xmss_shake256_h20.c
index 5bf41b07f9..321876fb97 100644
--- a/src/sig_stfl/xmss/sig_stfl_xmss_shake256_h20.c
+++ b/src/sig_stfl/xmss/sig_stfl_xmss_shake256_h20.c
@@ -1,6 +1,7 @@
-// SPDX-License-Identifier: Apache-2.0 AND MIT
+// SPDX-License-Identifier: (Apache-2.0 OR MIT) AND CC0-1.0
 
 #include "sig_stfl_xmss_xmssmt.c"
 
 // ======================== XMSS-SHAKE_20_512 ======================== //
+
 XMSS_ALG(, _shake256_h20, _SHAKE256_H20)
diff --git a/src/sig_stfl/xmss/sig_stfl_xmss_xmssmt.c b/src/sig_stfl/xmss/sig_stfl_xmss_xmssmt.c
index 1b81bec309..7868d68c94 100644
--- a/src/sig_stfl/xmss/sig_stfl_xmss_xmssmt.c
+++ b/src/sig_stfl/xmss/sig_stfl_xmss_xmssmt.c
@@ -1,4 +1,4 @@
-// SPDX-License-Identifier: Apache-2.0 AND MIT
+// SPDX-License-Identifier: (Apache-2.0 OR MIT) AND CC0-1.0
 
 #include <string.h>
 #include <stdlib.h>
diff --git a/src/sig_stfl/xmss/sig_stfl_xmssmt_functions.c b/src/sig_stfl/xmss/sig_stfl_xmssmt_functions.c
index f5d99705d3..ec1143f1b8 100644
--- a/src/sig_stfl/xmss/sig_stfl_xmssmt_functions.c
+++ b/src/sig_stfl/xmss/sig_stfl_xmssmt_functions.c
@@ -1,4 +1,4 @@
-// SPDX-License-Identifier: Apache-2.0 AND MIT
+// SPDX-License-Identifier: (Apache-2.0 OR MIT) AND CC0-1.0
 
 #include <string.h>
 #include <stdlib.h>
diff --git a/src/sig_stfl/xmss/sig_stfl_xmssmt_sha256_h20_2.c b/src/sig_stfl/xmss/sig_stfl_xmssmt_sha256_h20_2.c
index 0c6057eef9..1ce98d95ff 100644
--- a/src/sig_stfl/xmss/sig_stfl_xmssmt_sha256_h20_2.c
+++ b/src/sig_stfl/xmss/sig_stfl_xmssmt_sha256_h20_2.c
@@ -1,6 +1,7 @@
-// SPDX-License-Identifier: Apache-2.0 AND MIT
+// SPDX-License-Identifier: (Apache-2.0 OR MIT) AND CC0-1.0
 
 #include "sig_stfl_xmss_xmssmt.c"
 
 // ======================== XMSSMT-SHA2_20/2_256 ======================== //
+
 XMSS_ALG(mt, mt_sha256_h20_2, MT_SHA256_H20_2)
diff --git a/src/sig_stfl/xmss/sig_stfl_xmssmt_sha256_h20_4.c b/src/sig_stfl/xmss/sig_stfl_xmssmt_sha256_h20_4.c
index 867e0928b1..c914958bb1 100644
--- a/src/sig_stfl/xmss/sig_stfl_xmssmt_sha256_h20_4.c
+++ b/src/sig_stfl/xmss/sig_stfl_xmssmt_sha256_h20_4.c
@@ -1,6 +1,7 @@
-// SPDX-License-Identifier: Apache-2.0 AND MIT
+// SPDX-License-Identifier: (Apache-2.0 OR MIT) AND CC0-1.0
 
 #include "sig_stfl_xmss_xmssmt.c"
 
 // ======================== XMSSMT-SHA2_20/4_256 ======================== //
+
 XMSS_ALG(mt, mt_sha256_h20_4, MT_SHA256_H20_4)
diff --git a/src/sig_stfl/xmss/sig_stfl_xmssmt_sha256_h40_2.c b/src/sig_stfl/xmss/sig_stfl_xmssmt_sha256_h40_2.c
index e972df04ee..187292a29e 100644
--- a/src/sig_stfl/xmss/sig_stfl_xmssmt_sha256_h40_2.c
+++ b/src/sig_stfl/xmss/sig_stfl_xmssmt_sha256_h40_2.c
@@ -1,6 +1,7 @@
-// SPDX-License-Identifier: Apache-2.0 AND MIT
+// SPDX-License-Identifier: (Apache-2.0 OR MIT) AND CC0-1.0
 
 #include "sig_stfl_xmss_xmssmt.c"
 
 // ======================== XMSSMT-SHA2_40/2_256 ======================== //
+
 XMSS_ALG(mt, mt_sha256_h40_2, MT_SHA256_H40_2)
diff --git a/src/sig_stfl/xmss/sig_stfl_xmssmt_sha256_h40_4.c b/src/sig_stfl/xmss/sig_stfl_xmssmt_sha256_h40_4.c
index 63c9af0bc8..db6ac22a05 100644
--- a/src/sig_stfl/xmss/sig_stfl_xmssmt_sha256_h40_4.c
+++ b/src/sig_stfl/xmss/sig_stfl_xmssmt_sha256_h40_4.c
@@ -1,6 +1,7 @@
-// SPDX-License-Identifier: Apache-2.0 AND MIT
+// SPDX-License-Identifier: (Apache-2.0 OR MIT) AND CC0-1.0
 
 #include "sig_stfl_xmss_xmssmt.c"
 
 // ======================== XMSSMT-SHA2_40/4_256 ======================== //
+
 XMSS_ALG(mt, mt_sha256_h40_4, MT_SHA256_H40_4)
diff --git a/src/sig_stfl/xmss/sig_stfl_xmssmt_sha256_h40_8.c b/src/sig_stfl/xmss/sig_stfl_xmssmt_sha256_h40_8.c
index 156c2e3fd6..293810cc19 100644
--- a/src/sig_stfl/xmss/sig_stfl_xmssmt_sha256_h40_8.c
+++ b/src/sig_stfl/xmss/sig_stfl_xmssmt_sha256_h40_8.c
@@ -1,7 +1,7 @@
-// SPDX-License-Identifier: Apache-2.0 AND MIT
+// SPDX-License-Identifier: (Apache-2.0 OR MIT) AND CC0-1.0
 
 #include "sig_stfl_xmss_xmssmt.c"
 
 // ======================== XMSSMT-SHA2_40/8_256 ======================== //
-XMSS_ALG(mt, mt_sha256_h40_8, MT_SHA256_H40_8)
 
+XMSS_ALG(mt, mt_sha256_h40_8, MT_SHA256_H40_8)
diff --git a/src/sig_stfl/xmss/sig_stfl_xmssmt_sha256_h60_12.c b/src/sig_stfl/xmss/sig_stfl_xmssmt_sha256_h60_12.c
index 64f6576f82..eb80bd0f91 100644
--- a/src/sig_stfl/xmss/sig_stfl_xmssmt_sha256_h60_12.c
+++ b/src/sig_stfl/xmss/sig_stfl_xmssmt_sha256_h60_12.c
@@ -1,8 +1,7 @@
-// SPDX-License-Identifier: Apache-2.0 AND MIT
+// SPDX-License-Identifier: (Apache-2.0 OR MIT) AND CC0-1.0
 
 #include "sig_stfl_xmss_xmssmt.c"
 
-
 // ======================== XMSSMT-SHA2_60/12_256 ======================== //
 
 XMSS_ALG(mt, mt_sha256_h60_12, MT_SHA256_H60_12)
diff --git a/src/sig_stfl/xmss/sig_stfl_xmssmt_sha256_h60_3.c b/src/sig_stfl/xmss/sig_stfl_xmssmt_sha256_h60_3.c
index d37e1244ae..05a4cef584 100644
--- a/src/sig_stfl/xmss/sig_stfl_xmssmt_sha256_h60_3.c
+++ b/src/sig_stfl/xmss/sig_stfl_xmssmt_sha256_h60_3.c
@@ -1,6 +1,7 @@
-// SPDX-License-Identifier: Apache-2.0 AND MIT
+// SPDX-License-Identifier: (Apache-2.0 OR MIT) AND CC0-1.0
 
 #include "sig_stfl_xmss_xmssmt.c"
 
 // ======================== XMSSMT-SHA2_60/3_256 ======================== //
+
 XMSS_ALG(mt, mt_sha256_h60_3, MT_SHA256_H60_3)
diff --git a/src/sig_stfl/xmss/sig_stfl_xmssmt_sha256_h60_6.c b/src/sig_stfl/xmss/sig_stfl_xmssmt_sha256_h60_6.c
index d5992617c0..b0a552ca26 100644
--- a/src/sig_stfl/xmss/sig_stfl_xmssmt_sha256_h60_6.c
+++ b/src/sig_stfl/xmss/sig_stfl_xmssmt_sha256_h60_6.c
@@ -1,4 +1,4 @@
-// SPDX-License-Identifier: Apache-2.0 AND MIT
+// SPDX-License-Identifier: (Apache-2.0 OR MIT) AND CC0-1.0
 
 #include "sig_stfl_xmss_xmssmt.c"
 
diff --git a/src/sig_stfl/xmss/sig_stfl_xmssmt_shake128_h20_2.c b/src/sig_stfl/xmss/sig_stfl_xmssmt_shake128_h20_2.c
index 76c8523a80..682859a90c 100644
--- a/src/sig_stfl/xmss/sig_stfl_xmssmt_shake128_h20_2.c
+++ b/src/sig_stfl/xmss/sig_stfl_xmssmt_shake128_h20_2.c
@@ -1,4 +1,4 @@
-// SPDX-License-Identifier: Apache-2.0 AND MIT
+// SPDX-License-Identifier: (Apache-2.0 OR MIT) AND CC0-1.0
 
 #include "sig_stfl_xmss_xmssmt.c"
 
diff --git a/src/sig_stfl/xmss/sig_stfl_xmssmt_shake128_h20_4.c b/src/sig_stfl/xmss/sig_stfl_xmssmt_shake128_h20_4.c
index 0dec4743e6..9325b6b81d 100644
--- a/src/sig_stfl/xmss/sig_stfl_xmssmt_shake128_h20_4.c
+++ b/src/sig_stfl/xmss/sig_stfl_xmssmt_shake128_h20_4.c
@@ -1,4 +1,4 @@
-// SPDX-License-Identifier: Apache-2.0 AND MIT
+// SPDX-License-Identifier: (Apache-2.0 OR MIT) AND CC0-1.0
 
 #include "sig_stfl_xmss_xmssmt.c"
 
diff --git a/src/sig_stfl/xmss/sig_stfl_xmssmt_shake128_h40_2.c b/src/sig_stfl/xmss/sig_stfl_xmssmt_shake128_h40_2.c
index 765694287d..9ef0fccb47 100644
--- a/src/sig_stfl/xmss/sig_stfl_xmssmt_shake128_h40_2.c
+++ b/src/sig_stfl/xmss/sig_stfl_xmssmt_shake128_h40_2.c
@@ -1,4 +1,4 @@
-// SPDX-License-Identifier: Apache-2.0 AND MIT
+// SPDX-License-Identifier: (Apache-2.0 OR MIT) AND CC0-1.0
 
 #include "sig_stfl_xmss_xmssmt.c"
 
diff --git a/src/sig_stfl/xmss/sig_stfl_xmssmt_shake128_h40_4.c b/src/sig_stfl/xmss/sig_stfl_xmssmt_shake128_h40_4.c
index 7ce156c659..2568826e85 100644
--- a/src/sig_stfl/xmss/sig_stfl_xmssmt_shake128_h40_4.c
+++ b/src/sig_stfl/xmss/sig_stfl_xmssmt_shake128_h40_4.c
@@ -1,4 +1,4 @@
-// SPDX-License-Identifier: Apache-2.0 AND MIT
+// SPDX-License-Identifier: (Apache-2.0 OR MIT) AND CC0-1.0
 
 #include "sig_stfl_xmss_xmssmt.c"
 
diff --git a/src/sig_stfl/xmss/sig_stfl_xmssmt_shake128_h40_8.c b/src/sig_stfl/xmss/sig_stfl_xmssmt_shake128_h40_8.c
index 1c3f9671c0..9605ef940c 100644
--- a/src/sig_stfl/xmss/sig_stfl_xmssmt_shake128_h40_8.c
+++ b/src/sig_stfl/xmss/sig_stfl_xmssmt_shake128_h40_8.c
@@ -1,4 +1,4 @@
-// SPDX-License-Identifier: Apache-2.0 AND MIT
+// SPDX-License-Identifier: (Apache-2.0 OR MIT) AND CC0-1.0
 
 #include "sig_stfl_xmss_xmssmt.c"
 
diff --git a/src/sig_stfl/xmss/sig_stfl_xmssmt_shake128_h60_12.c b/src/sig_stfl/xmss/sig_stfl_xmssmt_shake128_h60_12.c
index 793393eaf3..db71c1ca4f 100644
--- a/src/sig_stfl/xmss/sig_stfl_xmssmt_shake128_h60_12.c
+++ b/src/sig_stfl/xmss/sig_stfl_xmssmt_shake128_h60_12.c
@@ -1,4 +1,4 @@
-// SPDX-License-Identifier: Apache-2.0 AND MIT
+// SPDX-License-Identifier: (Apache-2.0 OR MIT) AND CC0-1.0
 
 #include "sig_stfl_xmss_xmssmt.c"
 
diff --git a/src/sig_stfl/xmss/sig_stfl_xmssmt_shake128_h60_3.c b/src/sig_stfl/xmss/sig_stfl_xmssmt_shake128_h60_3.c
index 09edd7ebd7..60dfeaf572 100644
--- a/src/sig_stfl/xmss/sig_stfl_xmssmt_shake128_h60_3.c
+++ b/src/sig_stfl/xmss/sig_stfl_xmssmt_shake128_h60_3.c
@@ -1,4 +1,4 @@
-// SPDX-License-Identifier: Apache-2.0 AND MIT
+// SPDX-License-Identifier: (Apache-2.0 OR MIT) AND CC0-1.0
 
 #include "sig_stfl_xmss_xmssmt.c"
 
diff --git a/src/sig_stfl/xmss/sig_stfl_xmssmt_shake128_h60_6.c b/src/sig_stfl/xmss/sig_stfl_xmssmt_shake128_h60_6.c
index aae4ca20a6..e658846d57 100644
--- a/src/sig_stfl/xmss/sig_stfl_xmssmt_shake128_h60_6.c
+++ b/src/sig_stfl/xmss/sig_stfl_xmssmt_shake128_h60_6.c
@@ -1,4 +1,4 @@
-// SPDX-License-Identifier: Apache-2.0 AND MIT
+// SPDX-License-Identifier: (Apache-2.0 OR MIT) AND CC0-1.0
 
 #include "sig_stfl_xmss_xmssmt.c"