chore: relicense to Apache-2.0 (Signetry goes open core) - #14
Merged
Conversation
Signetry moves to an open-core model. This repository is part of the integration surface, so it is now Apache-2.0: use it, fork it, ship it commercially, no permission needed. The engine (Signetry/core) is source-available under BUSL-1.1 and converts to Apache-2.0 on 2030-08-31. Until now every repo in the org was "All Rights Reserved" with no LICENSE file, which GitHub reports as no license at all. That is the strictest possible default: it blocks corporate evaluation outright and makes outside contribution legally murky. This fixes that. What changed: - LICENSE (Apache-2.0) added, so GitHub detects and displays it. - README, CONTRIBUTING, CLA, CONTRIBUTORS and the CLA bot comment no longer claim the project is "not open source" or withhold usage rights. - The CLA is kept, because open core means code moves across the licence line and relicensing needs those rights. Its fallback licence grant is now non-exclusive: the previous *exclusive* grant would have stripped contributors of the right to use their own contribution, contradicting the rights the LICENSE grants everyone. The CLA text is now identical across all Signetry repos so the legal terms cannot drift per-repo again. - Community health files (SECURITY.md, CODE_OF_CONDUCT.md, issue templates) where they were missing. No functional or API change.
Signetry Reviewer — 🟣 Escalate to a designated reviewerEscalate to a designated reviewer — this PR touches security-sensitive surface (.github/workflows/cla.yml, .github/workflows/reviewer.yml). No blocking issue was found automatically, but a human owner should sign off. Deterministic gates (the authority)
Findings (2, 0 blocking)
Sensitive surfaceThis PR changes security-sensitive paths that warrant a designated reviewer:
MergeA designated reviewer / code owner should sign off before merge (sensitive surface).
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Signetry goes open core — this repo becomes Apache-2.0
Every repository in the org was previously "All Rights Reserved" with no
LICENSEfile, which GitHub reports as no license at all. That is the most restrictive default there is: it blocks corporate evaluation outright (legal will not clear a dependency with no licence), and it makes outside contribution legally murky even thoughCONTRIBUTING.mdinvited it.This PR fixes that for the integration surface.
Signetry/core)The full map is in
LICENSING.md.What changed
LICENSE(Apache-2.0) added, so GitHub detects and displays it.README.md,CONTRIBUTING.md,CLA.md,CONTRIBUTORS.md, and the CLA bot's PR comment no longer claim the project is "not open source", and no longer tell contributors they gain no right to use their own work.SECURITY.md,CODE_OF_CONDUCT.md(Contributor Covenant v2.1), and GitHub issue templates.One substantive legal change, please read
The CLA is kept — open core means code moves across the licence line, and relicensing needs those rights.
But its fallback grant was wrong. Where copyright assignment is not permitted by law, it previously granted the Owner an exclusive licence. An exclusive grant strips the contributor of the right to use their own contribution — which directly contradicts the rights the
LICENSEgrants everyone, including them. It is now non-exclusive.The CLA text is also now byte-identical across all Signetry repositories (bar the engine/integration licence wording), so these terms cannot silently drift per-repo again.
LICENSING.mdnow also states plainly that the CLA is a copyright assignment, rather than the previous softer wording — a contributor deserves to know that before they start, not after.Risk
No functional or API change. Docs, licence metadata, and workflow comment strings only.