chore: choose the AGPL, and say what the table already does - #45
Conversation
The repository is about to become public, and public is not the same as open source. With no licence, default copyright applies: somebody may read this and nothing else. The README said so plainly rather than wearing a badge it had not earned, and that sentence has now been paid for. # Why the Affero variant For the one thing it adds over the GPL: running a modified version as a network service counts as distributing it. A messenger is used over a network and almost never installed by the person it serves, so the plain GPL would let somebody host a changed build — with the cryptography quietly weakened — and owe nobody the source. That is the same substitution the manifest, the release workflow and the browser extension exist to make detectable. A licence permitting in law what the code fights in practice would have been an odd pair. `publish = false` stays on every crate. The licence says what may be done with the source; it does not make any of this fit for a registry, and the status section is unchanged — no audit, and none coming. # The table was two features behind `README.md` listed neither Web Push nor the verifiable client, both of which landed today, nor `deploy/`. Somebody arriving at a public repository reads that table first, and it described a project from this morning.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 4f524aa99b
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| Because of the one thing it adds: **running a modified version as a network service counts as | ||
| distributing it**. A messenger is used over a network and almost never installed by the person it |
There was a problem hiding this comment.
The AGPL does not classify running a modified network service as distribution: LICENSE lines 87–89 explicitly say that network interaction without transferring a copy is not conveying. Section 13 instead creates a separate obligation to offer the modified Corresponding Source to remote users (LICENSE lines 542–548). This wording could mislead operators into believing that all distribution-related requirements are triggered by hosting; describe the source-offer obligation directly instead.
Useful? React with 👍 / 👎.
1 participant
Groundwork before the repository becomes public, because public and open source are not the same thing.
The licence
With none, default copyright applies: somebody may read this and do nothing else with it.
README.mdsaid exactly that rather than wearing a badge it had not earned — this pays for the sentence.AGPL-3.0-or-later, for the one thing the Affero variant adds over the GPL: running a modified version as a network service counts as distributing it. A messenger is used over a network and almost never installed by the person it serves, so the plain GPL would let somebody host a changed build — with the cryptography quietly weakened — and owe nobody the source.
That is the same substitution
scripts/release-web.sh,.github/workflows/release.ymlandextension/exist to make detectable. A licence permitting in law what the code fights in practice would have been an odd pair.publish = falsestays on every crate: the licence says what may be done with the source, not that any of this belongs on a registry. The status section is unchanged — no audit, and none coming.The README table was two features behind
It listed neither Web Push nor the verifiable client, both landed today, nor
deploy/. Somebody arriving at a public repository reads that table first, and it described a project from this morning.Also done outside the diff
Sixteen topics on the repository, which had none:
messaging,end-to-end-encryption,e2ee,mls,rfc9420,openmls,cryptography,privacy,rust,typescript,react,tauri,axum,postgresql,webassembly,self-hosted. The description was already accurate and is untouched.What was checked before proposing to publish
Going public exposes the history, not just the tip, so:
.env,.pem,.keyor credential file was ever added in any commit on any branchBEGIN PRIVATE KEY/BEGIN RSAblob anywhere in historyghp_,github_pat_,sk-…,AKIA…orxox…token in the treeevil.tldcases for the deceptive-URL parser) and a PNG filename.env.examplefiles carry only obvious placeholders —dev_only_not_a_secret,whispee.exampledocs/and*.mdlink in the README resolvescargo check --workspace --release,pnpm run typecheck,pnpm test(722) — greenWhat this does not fix
The release workflow still fails, and this is why it is worth publishing:
actions/attest-build-provenanceanswers "Feature not available for user-owned private repositories". The attestation is what makes GitHub the third party — binding the artefact to the commit and to the workflow, so not even the maintainer can forge one outside Actions. It starts working when the repository is public, and not before.