- Is the README text below compatible with the GPL?
Yes, that text is compatible with the GPL license.
However, I would recommended to use the notice that the GPL license itself advises you to use:
This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.
This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
You should have received a copy of the GNU General Public License along with this program. If not, see https://www.gnu.org/licenses/.
The advantage is that it also states that you are not providing any warranties on the software.
- Does the "Licensed" in the README text below refer to just the source code or the full built package with dependencies?
Creating a binary from source code does not create something new as far as copyright is concerned. It is a mechanical transformation and all the copyrights and licenses that apply to the source code apply equally to the binary.
The GPL license states that if any part of the project is subject to the GPL license, then the entire project needs to be distributed under the terms of the GPL license. That applies equally to the built package.
- Is it possible to add permissively licensed (like MIT) code later on?
As the GPL dictates a license for the "project as a whole", any code you add, either from a third party or written by yourself, must have a license that is compatible with the GPL.
Fortunately, most permissive licenses are compatible with the GPL. The MIT license definitely is.
If you want to add MIT-licensed code, for which you do not own the copyrights, one of the conditions imposed by the MIT license is that you keep the copyright and license notices intact. Doing so does not go against the GPL license.
It is a different question if someone can download your project (under the GPL license), strip everything except the part you got under the MIT license and then redistribute that again under the MIT license.
- Where and how do I attach the copyright notice (that MIT licenses would place on the top of the LICENSE file), if I don't want to add it to every file? Is it really necessary to add it to every file?
Copyright notices are not required to gain copyright protection on the code you write, but they are a very useful tool to indicate to others who owns the copyrights on the code.
For that reason, I strongly advise to add them to every file (or at least every file that supports metadata or comments) along with a license indication. That greatly helps to clarify the legal status if a file ever gets sent around without the rest of the repository.
What if I added code from another source; would the new copyright notice clash?
If you add code written by someone else, you should not add a copyright notice of your own (unless you also made changes to that code) and you should keep any existing copyright notices and license notices intact.
Should I add the year? (See how the new Rust copyright notice doesn't have it, LF against it)
From a legal viewpoint, a valid copyright notice must include the year (of publication). On the other hand, the LF article you linked also makes a good argument for leaving the year off.
- Who to attribute? (Rust removing attribution and adding it back) What if the project doesn't have a name or it may change in the future? Can/should I add my own name? (e.g. "Copyright Axel Karjalainen and contributors")
If there is no organization behind the project that you assign the copyrights to, then you as a person own the copyrights of the code you write. That makes it entirely proper to write a copyright notice in your own name (e.g. "Copyright Axel Karjalainen").
As long as there are only a few contributors to the project, it is easily manageable if every contributor adds a copyright notice of their own. By the time this becomes unmanageable, your project will probably have an established name and you can start attributing to "the XXX project developers".
- What protection does the DCO provide compared to and combined with the README text below?
When making a contribution to GPL-licensed code, the GPL license itself already requires that the contribution is made under the GPL license.
A DCO, along with signed commits, gives you a level of legal protection against people claiming that you stole their code. With the DCO, a developer states in a legally significant way that they have the right to make the contribution. With the signed commit you have proof that it is really them making the commit.
