vulncheck
6740b44edb
Publishing under AGPL without a CLA closes the door on ever offering
commercial terms: every merged PR would be copyright we cannot relicense,
and asking dozens of contributors for permission after the fact does not
work. CLA.md section 2 grants the maintainer a license "under any license
terms, including proprietary" — that clause is the whole point.
LICENSING.md states the open-core boundary up front rather than carving
features out later, which is the move that has burned trust elsewhere. The
entire detection and enrichment engine stays AGPL; Enterprise is limited to
SSO, audit trail, compliance reporting, SIEM forwarding and multi-tenancy,
under a stated two-part rule for what may ever go there.
SECURITY.md gives a private disclosure path — a vulnerability scanner whose
own bugs land as public issues is a poor advertisement.
The CLA bot runs as a GitHub Action writing signatures to a cla-signatures
branch, so there is no third-party service to sign up for.
Placeholders {{LICENSOR}}, {{CONTACT}}, {{GH_OWNER}} and {{GH_REPO}} are
filled in once the legal entity and the GitHub location are settled.
4.7 KiB
TrueVuln Contributor License Agreement
Version 1.0
Thank you for your interest in contributing to TrueVuln (the "Project"), maintained by {{LICENSOR}} (the "Maintainer").
This Contributor License Agreement ("Agreement") clarifies the intellectual property license granted with Contributions from any person or entity. It protects You, the Maintainer, and every user of the Project. You keep the copyright to your work. This Agreement only grants the Maintainer the additional permissions needed to distribute the Project sustainably.
By submitting a Contribution to the Project, You accept and agree to the following terms for Your present and future Contributions.
1. Definitions
"You" means the copyright owner, or the legal entity authorized by the copyright owner, that is entering into this Agreement.
"Contribution" means any original work of authorship, including any modification of or addition to an existing work, that is intentionally submitted by You to the Maintainer for inclusion in the Project. "Submitted" means any form of electronic, verbal, or written communication sent to the Maintainer or its representatives, including but not limited to pull requests, patches, issues, and electronic mailing lists, excluding communication conspicuously marked in writing by You as "Not a Contribution".
2. Copyright License
You hereby grant to the Maintainer a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Your Contributions and such derivative works, under any license terms, including the GNU Affero General Public License v3.0, any later version thereof, and proprietary or commercial license terms.
This grant is what allows the Maintainer to offer the Project both as free and open
source software and under separate commercial terms. See LICENSING.md.
3. Patent License
You hereby grant to the Maintainer and to recipients of software distributed by the Maintainer a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable (except as stated in this section) patent license to make, have made, use, offer to sell, sell, import, and otherwise transfer the Project, where such license applies only to those patent claims licensable by You that are necessarily infringed by Your Contribution alone or by combination of Your Contribution with the Project.
If any entity institutes patent litigation against You or any other entity alleging that Your Contribution, or the Project to which You contributed, constitutes direct or contributory patent infringement, then any patent licenses granted to that entity under this Agreement terminate as of the date such litigation is filed.
4. You Retain Your Rights
You retain all right, title, and interest in and to Your Contributions. Nothing in this Agreement restricts Your ability to use, license, or distribute Your Contributions elsewhere, under any terms You choose.
5. Your Representations
You represent that:
- You are legally entitled to grant the above licenses.
- Each of Your Contributions is Your original creation, or You have the necessary rights to submit it.
- If Your employer has rights to intellectual property You create, You have either received permission to make Contributions on behalf of that employer, or Your employer has waived such rights for Your Contributions.
- Your Contributions do not knowingly include third-party code that would subject the Project to license terms incompatible with Section 2. If You submit any work that is not Your original creation, You will identify it clearly, along with its source and license.
6. No Obligation, No Warranty
You are not expected to provide support for Your Contributions. The Maintainer is under no obligation to accept or merge any Contribution.
Unless required by applicable law or agreed to in writing, You provide Your Contributions "AS IS", WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including any warranty of merchantability, fitness for a particular purpose, title, or non-infringement.
7. Notification
You agree to notify the Maintainer of any facts or circumstances of which You become aware that would make these representations inaccurate in any respect.
How to sign
You do not need to send anything by mail. When you open your first pull request, an automated bot will ask you to confirm this Agreement by posting a comment on the pull request. Your signature is recorded once and applies to all your future Contributions.
If you prefer not to sign the CLA, you are still very welcome to help: bug reports, reproduction steps, documentation feedback, and feature discussion in issues do not require a CLA.