Julius Joska
00739ac8a0
- SECURITY.md with the reporting address and expectations; README points to security@sepot.cz and security.txt - README: FCM is the Android default since 1.2.0 when no UnifiedPush distributor is installed; status reflects the Play release - the "F-Droid" channel is not available yet and is no longer listed - CHANGELOG: unreleased fixes and security hardening
52 lines
2.7 KiB
Markdown
52 lines
2.7 KiB
Markdown
# Third-party components & license notices
|
|
|
|
Šepot links third-party components. This file documents their licenses and,
|
|
where relevant, their status with respect to app-store distribution.
|
|
|
|
The cryptographic core is not implemented by Šepot; it is provided by Signal's
|
|
`libsignal` through a third-party Dart binding. Both are AGPL-3.0, which is why
|
|
their app-store status is documented in detail below.
|
|
|
|
## Signal `libsignal` (AGPL-3.0)
|
|
|
|
- **Component:** Signal's Rust `libsignal`, used via FFI behind the
|
|
`SepotCrypto` facade through the `libsignal` Dart binding on pub.dev.
|
|
- **Copyright:** Signal Messenger, LLC.
|
|
- **License:** GNU Affero General Public License, version 3 (AGPL-3.0).
|
|
Upstream: <https://github.com/signalapp/libsignal>
|
|
- **App-store distribution status:** The current AGPL Rust `libsignal` does
|
|
**not** ship with an explicit "app store" additional permission in its
|
|
LICENSE file. However, Signal has publicly stated that it has no objection
|
|
to GPL-compliant open-source applications distributing its libraries through
|
|
the Apple App Store, and it previously added an explicit app-store
|
|
additional permission to the earlier `libsignal-protocol-c`
|
|
(<https://signal.org/blog/license-update/>). Precedent: several
|
|
Signal-derived, GPL/AGPL-licensed messengers (e.g. Session) are distributed
|
|
on the Apple App Store on this basis.
|
|
|
|
Šepot relies on that stated position and, as an AGPL work, keeps its
|
|
complete corresponding source available under the AGPL through channels
|
|
without app-store restrictions (this public repository, direct
|
|
APK). A written clarification for the current Rust `libsignal` has been
|
|
requested from Signal (tracking: <https://github.com/signalapp/libsignal/issues/684>).
|
|
|
|
## `libsignal` Dart binding (AGPL-3.0)
|
|
|
|
- **Component:** the `libsignal` Dart package on pub.dev, which wraps Signal's
|
|
Rust `libsignal` and ships the precompiled native binaries.
|
|
- **License:** AGPL-3.0.
|
|
- **App-store distribution status:** in a public issue on the binding's
|
|
repository, its maintainer indicated an intent to add an explicit AGPL §7
|
|
app-store additional permission covering the binding layer and its
|
|
`libsignal_frb` crate, conditioned on the application's complete source being
|
|
publicly available under the AGPL — which this repository provides. That
|
|
permission, once added, would cover only the binding's own code, not Signal's
|
|
upstream `libsignal`.
|
|
|
|
## Šepot's own App Store exception
|
|
|
|
Šepot's own code carries an additional permission under AGPL section 7 that
|
|
permits app-store distribution (see `LICENSE`). That permission covers only
|
|
the parts whose copyright is held by the Šepot contributors; it does not, and
|
|
cannot, grant permissions on behalf of Signal Messenger, LLC for `libsignal`.
|