Julius Joska
8081d98c67
Initial public release. Anonymous on-device identity (no phone number, e-mail, or password), Signal-protocol cryptography (X3DH + PQXDH, Double Ratchet, sealed sender) via libsignal, a metadata-minimizing relay, group chats, disappearing messages, encrypted local storage, optional Tor transport, and a UI localized into Czech, English, German, Russian, and Italian. Monorepo: Flutter client (app/), Rust relay + wire types (rust/), protobuf definitions (proto/), self-host deploy (deploy/). Licensed under AGPL-3.0 with an app-store distribution exception (§7).
2.7 KiB
Third-party components & license notices
Šepot links third-party components. This file documents their licenses and, where relevant, their status with respect to app-store distribution.
The cryptographic core is not implemented by Šepot; it is provided by Signal's
libsignal through a third-party Dart binding. Both are AGPL-3.0, which is why
their app-store status is documented in detail below.
Signal libsignal (AGPL-3.0)
-
Component: Signal's Rust
libsignal, used via FFI behind theSepotCryptofacade through thelibsignalDart binding on pub.dev. -
Copyright: Signal Messenger, LLC.
-
License: GNU Affero General Public License, version 3 (AGPL-3.0). Upstream: https://github.com/signalapp/libsignal
-
App-store distribution status: The current AGPL Rust
libsignaldoes not ship with an explicit "app store" additional permission in its LICENSE file. However, Signal has publicly stated that it has no objection to GPL-compliant open-source applications distributing its libraries through the Apple App Store, and it previously added an explicit app-store additional permission to the earlierlibsignal-protocol-c(https://signal.org/blog/license-update/). Precedent: several Signal-derived, GPL/AGPL-licensed messengers (e.g. Session) are distributed on the Apple App Store on this basis.Šepot relies on that stated position and, as an AGPL work, keeps its complete corresponding source available under the AGPL through channels without app-store restrictions (this public repository, F-Droid, direct APK). A written clarification for the current Rust
libsignalhas been requested from Signal (tracking: https://github.com/signalapp/libsignal/issues/684).
libsignal Dart binding (AGPL-3.0)
- Component: the
libsignalDart package on pub.dev, which wraps Signal's Rustlibsignaland ships the precompiled native binaries. - License: AGPL-3.0.
- App-store distribution status: in a public issue on the binding's
repository, its maintainer indicated an intent to add an explicit AGPL §7
app-store additional permission covering the binding layer and its
libsignal_frbcrate, conditioned on the application's complete source being publicly available under the AGPL — which this repository provides. That permission, once added, would cover only the binding's own code, not Signal's upstreamlibsignal.
Šepot's own App Store exception
Šepot's own code carries an additional permission under AGPL section 7 that
permits app-store distribution (see LICENSE). That permission covers only
the parts whose copyright is held by the Šepot contributors; it does not, and
cannot, grant permissions on behalf of Signal Messenger, LLC for libsignal.