chore: add Contributor License Agreement and roll the BUSL Change Date per release - #211
Merged
Conversation
rss2msg is source-available under BUSL 1.1, and the maintainer offers separate commercial licenses on top of it. Contributions previously came in under "the same terms as the rest of the project", which licenses the contributor's copyright to the project under BUSL — including its own no-hosted-service carve-out. That leaves contributed code unusable in a commercial or hosted offering, and blocks the Apache-2.0 conversion each version is supposed to get on its Change Date. Add an Apache-ICLA-derived CLA granting the maintainer the right to license contributions under the project's current and future terms. Contributors keep their copyright. Signing is automated with contributor-assistant/github-action, which records signatures in a `cla-signatures` branch. Two manual setup steps are required before the check can pass and are documented in the workflow header: a CLA_SIGNATURES_TOKEN secret, and a branch-protection rule requiring the "CLA Assistant" status check on main. Also correct README and CONTRIBUTING to describe the project as source-available rather than implying it is open source: BUSL's field-of-use restriction is incompatible with the OSI definition. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CtBEGzKLXr9iBXibFVKJHx
LICENSE carried a single fixed Change Date (2030-06-01) and nothing in the release process touched it. BUSL applies "separately for each version" and the Change Date "may vary for each version", so a fixed date means every version converts on the same day: a release cut in 2029 would have gotten one year of protection instead of four, and any release after 2030-06-01 would have shipped already converted to Apache-2.0. Add a step to the release procedure that rewrites the Change Date line to four years out — the BUSL ceiling, since it also converts on "the fourth anniversary of the first publicly available distribution of a specific version" — and stages LICENSE alongside CHANGELOG.md. Because the tag captures the tree, each tag and each artifact built from it carries the Change Date belonging to that version. Wired into both the documented manual steps and the cut-release skill that /release drives. The legal text itself is untouched. Also fix a contradiction the new step exposed: releasing.md still told the maintainer to put [skip ci] in the changelog commit, which is what silently skipped the v0.3.0 release. The skill already forbids it. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CtBEGzKLXr9iBXibFVKJHx
The contact-address change landed on main via #204 while this branch was open; #204 didn't cover the CLA files, which are added here. Align them so a single address appears repo-wide. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015aZ5qHYBsde5ysgUrRmbwD
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Supersedes #195, which had gone
dirtyagainstmain. Same three files'worth of intent, rebased onto current
mainand de-conflicted.What changed during the rebase:
on
mainwhile this branch was open. Its one uncovered corner — the CLA docsadded by this branch — is fixed here instead, so
info@iambod.devis now theonly address in the repo (verified: no
randombullsh.itremains anywhere).more precise per-version wording ("on its Change Date, four years after that
version is released") with the new contact address.
Otherwise unchanged from #195:
CLA.md, thecontributor-assistantworkflow,CONTRIBUTING + docs updates, and rolling the BUSL Change Date on every release.
Before this can actually gate PRs
Two maintainer steps, neither of which this branch can do:
CLA_SIGNATURES_TOKENsecret. The repo currently has zero Actionssecrets, so as-is the CLA job will fail when it tries to commit a signature.
main— needs branch protection, whichneeds the repo to be public (or Pro).
Worth considering: the action is pinned to the tag
@v2.6.1. For apull_request_targetworkflow holdingcontents: write, pinning to a commitSHA is the safer habit.
Verification
scripts/check-doc-links.shpasses,actionlintclean on all workflows.