Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
147 changes: 80 additions & 67 deletions LICENSE
Original file line number Diff line number Diff line change
@@ -1,21 +1,23 @@
GNU AFFERO GENERAL PUBLIC LICENSE
Version 3, 19 November 2007
GNU GENERAL PUBLIC LICENSE
Version 3, 29 June 2007

Copyright (C) 2007 Free Software Foundation, Inc. <https://fsf.org/>
Everyone is permitted to copy and distribute verbatim copies
of this license document, but changing it is not allowed.

Preamble

The GNU Affero General Public License is a free, copyleft license for
software and other kinds of works, specifically designed to ensure
cooperation with the community in the case of network server software.
The GNU General Public License is a free, copyleft license for
software and other kinds of works.

The licenses for most software and other practical works are designed
to take away your freedom to share and change the works. By contrast,
our General Public Licenses are intended to guarantee your freedom to
the GNU General Public License is intended to guarantee your freedom to
share and change all versions of a program--to make sure it remains free
software for all its users.
software for all its users. We, the Free Software Foundation, use the
GNU General Public License for most of our software; it applies also to
any other work released this way by its authors. You can apply it to
your programs, too.

When we speak of free software, we are referring to freedom, not
price. Our General Public Licenses are designed to make sure that you
Expand All @@ -24,34 +26,44 @@ them if you wish), that you receive source code or can get it if you
want it, that you can change the software or use pieces of it in new
free programs, and that you know you can do these things.

Developers that use our General Public Licenses protect your rights
with two steps: (1) assert copyright on the software, and (2) offer
you this License which gives you legal permission to copy, distribute
and/or modify the software.

A secondary benefit of defending all users' freedom is that
improvements made in alternate versions of the program, if they
receive widespread use, become available for other developers to
incorporate. Many developers of free software are heartened and
encouraged by the resulting cooperation. However, in the case of
software used on network servers, this result may fail to come about.
The GNU General Public License permits making a modified version and
letting the public access it on a server without ever releasing its
source code to the public.

The GNU Affero General Public License is designed specifically to
ensure that, in such cases, the modified source code becomes available
to the community. It requires the operator of a network server to
provide the source code of the modified version running there to the
users of that server. Therefore, public use of a modified version, on
a publicly accessible server, gives the public access to the source
code of the modified version.

An older license, called the Affero General Public License and
published by Affero, was designed to accomplish similar goals. This is
a different license, not a version of the Affero GPL, but Affero has
released a new version of the Affero GPL which permits relicensing under
this license.
To protect your rights, we need to prevent others from denying you
these rights or asking you to surrender the rights. Therefore, you have
certain responsibilities if you distribute copies of the software, or if
you modify it: responsibilities to respect the freedom of others.

For example, if you distribute copies of such a program, whether
gratis or for a fee, you must pass on to the recipients the same
freedoms that you received. You must make sure that they, too, receive
or can get the source code. And you must show them these terms so they
know their rights.

Developers that use the GNU GPL protect your rights with two steps:
(1) assert copyright on the software, and (2) offer you this License
giving you legal permission to copy, distribute and/or modify it.

For the developers' and authors' protection, the GPL clearly explains
that there is no warranty for this free software. For both users' and
authors' sake, the GPL requires that modified versions be marked as
changed, so that their problems will not be attributed erroneously to
authors of previous versions.

Some devices are designed to deny users access to install or run
modified versions of the software inside them, although the manufacturer
can do so. This is fundamentally incompatible with the aim of
protecting users' freedom to change the software. The systematic
pattern of such abuse occurs in the area of products for individuals to
use, which is precisely where it is most unacceptable. Therefore, we
have designed this version of the GPL to prohibit the practice for those
products. If such problems arise substantially in other domains, we
stand ready to extend this provision to those domains in future versions
of the GPL, as needed to protect the freedom of users.

Finally, every program is threatened constantly by software patents.
States should not allow patents to restrict development and use of
software on general-purpose computers, but in those that do, we wish to
avoid the special danger that patents applied to a free program could
make it effectively proprietary. To prevent this, the GPL assures that
patents cannot be used to render the program non-free.

The precise terms and conditions for copying, distribution and
modification follow.
Expand All @@ -60,7 +72,7 @@ modification follow.

0. Definitions.

"This License" refers to version 3 of the GNU Affero General Public License.
"This License" refers to version 3 of the GNU General Public License.

"Copyright" also means copyright-like laws that apply to other kinds of
works, such as semiconductor masks.
Expand Down Expand Up @@ -537,45 +549,35 @@ to collect a royalty for further conveying from those to whom you convey
the Program, the only way you could satisfy both those terms and this
License would be to refrain entirely from conveying the Program.

13. Remote Network Interaction; Use with the GNU General Public License.

Notwithstanding any other provision of this License, if you modify the
Program, your modified version must prominently offer all users
interacting with it remotely through a computer network (if your version
supports such interaction) an opportunity to receive the Corresponding
Source of your version by providing access to the Corresponding Source
from a network server at no charge, through some standard or customary
means of facilitating copying of software. This Corresponding Source
shall include the Corresponding Source for any work covered by version 3
of the GNU General Public License that is incorporated pursuant to the
following paragraph.
13. Use with the GNU Affero General Public License.

Notwithstanding any other provision of this License, you have
permission to link or combine any covered work with a work licensed
under version 3 of the GNU General Public License into a single
under version 3 of the GNU Affero General Public License into a single
combined work, and to convey the resulting work. The terms of this
License will continue to apply to the part which is the covered work,
but the work with which it is combined will remain governed by version
3 of the GNU General Public License.
but the special requirements of the GNU Affero General Public License,
section 13, concerning interaction through a network will apply to the
combination as such.

14. Revised Versions of this License.

The Free Software Foundation may publish revised and/or new versions of
the GNU Affero General Public License from time to time. Such new versions
will be similar in spirit to the present version, but may differ in detail to
the GNU General Public License from time to time. Such new versions will
be similar in spirit to the present version, but may differ in detail to
address new problems or concerns.

Each version is given a distinguishing version number. If the
Program specifies that a certain numbered version of the GNU Affero General
Program specifies that a certain numbered version of the GNU General
Public License "or any later version" applies to it, you have the
option of following the terms and conditions either of that numbered
version or of any later version published by the Free Software
Foundation. If the Program does not specify a version number of the
GNU Affero General Public License, you may choose any version ever published
GNU General Public License, you may choose any version ever published
by the Free Software Foundation.

If the Program specifies that a proxy can decide which future
versions of the GNU Affero General Public License can be used, that proxy's
versions of the GNU General Public License can be used, that proxy's
public statement of acceptance of a version permanently authorizes you
to choose that version for the Program.

Expand Down Expand Up @@ -633,29 +635,40 @@ the "copyright" line and a pointer to where the full notice is found.
Copyright (C) 2026 Nils Lehnen

This program is free software: you can redistribute it and/or modify
it under the terms of the GNU Affero General Public License as published by
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.

This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU Affero General Public License for more details.
GNU General Public License for more details.

You should have received a copy of the GNU Affero General Public License
You should have received a copy of the GNU General Public License
along with this program. If not, see <https://www.gnu.org/licenses/>.

Also add information on how to contact you by electronic and paper mail.

If your software can interact with users remotely through a computer
network, you should also make sure that it provides a way for users to
get its source. For example, if your program is a web application, its
interface could display a "Source" link that leads users to an archive
of the code. There are many ways you could offer source, and different
solutions will be better for different programs; see section 13 for the
specific requirements.
If the program does terminal interaction, make it output a short
notice like this when it starts in an interactive mode:

<program> Copyright (C) <year> <name of author>
This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
This is free software, and you are welcome to redistribute it
under certain conditions; type `show c' for details.

The hypothetical commands `show w' and `show c' should show the appropriate
parts of the General Public License. Of course, your program's commands
might be different; for a GUI interface, you would use an "about box".

You should also get your employer (if you work as a programmer) or school,
if any, to sign a "copyright disclaimer" for the program, if necessary.
For more information on this, and how to apply and follow the GNU AGPL, see
For more information on this, and how to apply and follow the GNU GPL, see
<https://www.gnu.org/licenses/>.

The GNU General Public License does not permit incorporating your program
into proprietary programs. If your program is a subroutine library, you
may consider it more useful to permit linking proprietary applications with
the library. If this is what you want to do, use the GNU Lesser General
Public License instead of this License. But first, please read
<https://www.gnu.org/licenses/why-not-lgpl.html>.
2 changes: 1 addition & 1 deletion README.md
Original file line number Diff line number Diff line change
Expand Up @@ -58,6 +58,6 @@ does not cover.

## License

AGPL-3.0, copyright 2026 Nils Lehnen.
GPL-3.0, copyright 2026 Nils Lehnen.

The full text is in [LICENSE](LICENSE).
6 changes: 3 additions & 3 deletions SECURITY.md
Original file line number Diff line number Diff line change
Expand Up @@ -123,9 +123,9 @@ A refusal you disagree with is not a vulnerability, and neither is a check that
is too strict about a legitimate tree, nor a supply-chain score lower than you
expected, which `docs/supply-chain.md` already triages check by check. Those
are issues and they are welcome as issues. Nor is anything about the licence.
[LICENSE](LICENSE) at the root carries the GNU Affero General Public License
version 3, and what this repository declares to the checks that read a licence
is still empty and open on issue #47. Both of those are legal or housekeeping
[LICENSE](LICENSE) at the root carries the GNU General Public License version
3, which is the answer record 0018 writes down, and it is what this repository
declares to the checks that read a licence. Both of those are legal or housekeeping
questions rather than security ones.

## What a reporter gets
Expand Down
11 changes: 6 additions & 5 deletions docs/operator-guide.md
Original file line number Diff line number Diff line change
Expand Up @@ -201,11 +201,12 @@ is already on. Only the measurement is written down. Nothing here uploads,
phones home, or reports usage, and there is no telemetry to turn off because
there is none to turn on.

[LICENSE](../LICENSE) at the root of the checkout is the GNU Affero General
Public License version 3, and those are the terms this tree carries. What is
still open is the licence this repository declares to its own checks, which is
empty on issue #47, so a run here that says nothing about the licence is not
saying the file is absent.
[LICENSE](../LICENSE) at the root of the checkout is the GNU General Public
License version 3, and those are the terms this tree carries. The licence this
repository declares to its own checks is the same one, so a run here reports
what it compared the file against rather than reporting that it was not asked.
[docs/decisions/0018-the-licence-of-this-board.md](decisions/0018-the-licence-of-this-board.md)
is where the answer and what it costs are written down.

## The record format may change

Expand Down
9 changes: 5 additions & 4 deletions docs/promotion.md
Original file line number Diff line number Diff line change
Expand Up @@ -33,10 +33,11 @@ whether the result holds for their case, and the fastest way to answer that is
the list of cases it was never put to.

The licence the code carries out. [LICENSE](../LICENSE) at the root of this
board is the GNU Affero General Public License version 3, so that is what the
code carries out and the receiving side inherits terms rather than finding
none. Which licence this repository declares to the checks that read one is a
separate thing and is open on issue #47. Entry three of issue #46 asks who may
board is the GNU General Public License version 3, so that is what the code
carries out and the receiving side inherits terms rather than finding none.
This repository declares the same licence to the checks that read one, and
[docs/decisions/0018-the-licence-of-this-board.md](docs/decisions/0018-the-licence-of-this-board.md)
is the answer both of them come from. Entry three of issue #46 asks who may
place a contributor's work under another board's terms and carries no answer,
so a hand-over of somebody else's work still cannot be completed, and writing
anything else into this line would be inventing permission nobody gave.
Expand Down
21 changes: 14 additions & 7 deletions docs/supply-chain.md
Original file line number Diff line number Diff line change
Expand Up @@ -166,11 +166,15 @@ untrusted. Reopen this line when #61 lands rather than before.

`license file not detected`, with `Warn: project does not have a license file`

Correct for the run above, and the tree has moved since. `LICENSE` is at the
root of the default branch carrying the GNU Affero General Public License
version 3, restored in `36442adad2d9dc66032cf3d29ab070697650db5c` and merged as
`bb0de9cbcc79015054e3da10cef44a8ae3669b01`, so the reasoning that stood here,
that default copyright applies and nobody may reuse anything, no longer follows.
Correct for the run above, and the tree has moved twice since. `LICENSE` is at
the root of the default branch carrying the GNU General Public License version
3, which is the answer record 0018 writes down. What stood there before it was
the GNU Affero General Public License version 3, restored in
`36442adad2d9dc66032cf3d29ab070697650db5c` and merged as
`bb0de9cbcc79015054e3da10cef44a8ae3669b01` and replaced by the change that
answered the licence question. Under either of them the reasoning that stood
here, that default copyright applies and nobody may reuse anything, no longer
follows.
The audit has not been re-run for this document and the score above is left as
the run reported it. What the platform holds today is a different reading and is
one command:
Expand All @@ -181,8 +185,11 @@ gh api 'repos/Flowfin/lab/code-scanning/alerts?tool_name=Scorecard&per_page=100'
fixed
```

What the file being there does not settle is the licence this repository
declares to its own checks, which is empty and open on issue #47.
What the file being there does not settle is whether its bytes are the
canonical text of the licence they claim to be. The licence this repository
declares to its own checks is set and is compared against the file, and that
comparison asks whether the file names the declared licence rather than whether
the text is canonical.

### Maintained, 0

Expand Down
27 changes: 19 additions & 8 deletions internal/invariants/invariants.go
Original file line number Diff line number Diff line change
Expand Up @@ -70,15 +70,26 @@ const (
gitDir = ".git"
)

// DeclaredLicence is the licence this repository has decided on, and it is
// empty because that question is open. Entry one of the maintainer question
// issue holds it, issue #47 lands the file and the decision record once it is
// answered, and setting this string is the last line of that change.
// DeclaredLicence is the licence this repository has decided on. Record 0018
// answers entry one of the maintainer question issue with GPL-3.0, one licence
// for the runner and the experiment content alike, and issue #47 is the change
// that lands the file and sets this string.
//
// While it is empty the licence leg reports that it was not asked rather than
// passing, so a run that could not check the licence is never read as one that
// checked and was satisfied.
const DeclaredLicence = ""
// IT IS SPELLED AS THE TITLE LINE RATHER THAN AS THE SPDX IDENTIFIER, and that
// is forced by what the leg below asks. The leg asks whether the licence file
// NAMES the declared licence, and the canonical text of this licence never
// writes an SPDX identifier anywhere in it, so a constant reading GPL-3.0
// would refuse the very file it is about. The identifier is what the platform
// reports and what README.md says; this is what the bytes at the root carry.
//
// WHAT IT SEPARATES AND WHAT IT DOES NOT. It separates this licence from the
// GNU Affero General Public License, which this repository carried until the
// change that set this string and whose text never writes this title. It does
// not separate version 3 from version 2, because both carry the same title,
// and no reading of the file below closes that gap while the comparison is a
// substring. What guards the version is whoever lands the file taking it from
// its canonical source, which is issue #47's sentence rather than this one.
const DeclaredLicence = "GNU GENERAL PUBLIC LICENSE"

// The properties this package can refuse. A property is the rule, named once
// here and nowhere else, so a case declaring what it expects and a refusal the
Expand Down
Loading