diff --git a/tools/cpm/format.sh b/tools/cpm/format.sh
index 6059077fe1..e636c402b4 100755
--- a/tools/cpm/format.sh
+++ b/tools/cpm/format.sh
@@ -1,5 +1,8 @@
 #!/bin/sh -e
 
+# SPDX-FileCopyrightText: 2025 crueter
+# SPDX-License-Identifier: GPL-3.0-or-later
+
 FILES=$(find . src -maxdepth 3 -name cpmfile.json)
 
 for file in $FILES; do
diff --git a/tools/cpm/hash.sh b/tools/cpm/hash.sh
index d9476e19c4..0c653e75c2 100755
--- a/tools/cpm/hash.sh
+++ b/tools/cpm/hash.sh
@@ -1,5 +1,8 @@
 #!/bin/sh -e
 
+# SPDX-FileCopyrightText: 2025 crueter
+# SPDX-License-Identifier: GPL-3.0-or-later
+
 # usage: hash.sh repo tag-or-sha
 # env vars: GIT_HOST, USE_TAG (use tag instead of sha), ARTIFACT (download artifact with that name instead of src archive)
 
diff --git a/tools/cpm/url-hash.sh b/tools/cpm/url-hash.sh
index 6709bb4a03..444b14b174 100755
--- a/tools/cpm/url-hash.sh
+++ b/tools/cpm/url-hash.sh
@@ -1,4 +1,7 @@
 #!/bin/sh
 
+# SPDX-FileCopyrightText: 2025 crueter
+# SPDX-License-Identifier: GPL-3.0-or-later
+
 SUM=$(wget -q $1 -O - | sha512sum)
 echo "$SUM" | cut -d " " -f1
diff --git a/tools/cpm/which.sh b/tools/cpm/which.sh
index d547bf879d..af12deb1b4 100755
--- a/tools/cpm/which.sh
+++ b/tools/cpm/which.sh
@@ -1,5 +1,8 @@
 #!/bin/sh -e
 
+# SPDX-FileCopyrightText: 2025 crueter
+# SPDX-License-Identifier: GPL-3.0-or-later
+
 # check which file a package is in
 
 JSON=$(find . src -maxdepth 3 -name cpmfile.json -exec grep -l "$1" {} \;)