docs: offer SolidSyslog under three alternative licences - #761
Conversation
PolyForm Internal Use 1.0.0 joins PolyForm Noncommercial 1.0.0 and a COSOSO commercial licence. The commercial gate moves to distribution, so a commercial organisation can evaluate, port and test on target at no cost. Both PolyForm texts are byte-identical to upstream (polyformproject.org repo at 76a278c) and carry no licensor substitution - there is no placeholder in the canonical text, and the licensor is identified by the Required Notice line in LICENSE.md instead. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
|
Warning Review limit reachedYou’ve reached a temporary PR review limit under our Fair Usage Limits Policy. Next review available in: 5 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Pro Run ID: 📒 Files selected for processing (2)
WalkthroughThe project now presents three licensing options, adds two complete PolyForm licence texts, publishes them in the documentation site, and updates SBOM and source-tree hash scopes to include ChangesLicensing and release metadata
Estimated code review effort: 2 (Simple) | ~15 minutes Mergeability Score: 🔵 Low · up to The PR updates licensing documentation and publication paths, but the footer should separately validate the VAT number and the README’s duplicated licence summary may drift from the canonical terms. It is mergeable with explicit owner awareness and follow-up on these bounded documentation and provenance risks. Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@CONTRIBUTING.md`:
- Around line 20-24: In CONTRIBUTING.md lines 20-24, preserve the local
contribution/licensing context but remove the duplicated three-licence summary
and link readers to LICENSE.md for licence choices and obligations. In
docs/security/sbom.md lines 21-24, retain the SBOM scope rationale while
replacing repeated licence choices and text inventory with a link to
../../LICENSE.md.
In `@LICENSE.md`:
- Around line 23-24: Update the licence 2 wording to explicitly state that it
permits noncommercial redistribution, while directing commercial
redistribution—including distribution as part of a product, firmware image, or
device—to licence 3.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro
Run ID: c4ce2fb3-b680-4d62-be2a-ac4681767e3b
📒 Files selected for processing (17)
.github/workflows/sbom.yml.markdownlint-cli2.jsoncCONTRIBUTING.mdLICENSE.mdLICENSES/PolyForm-Internal-Use-1.0.0.mdLICENSES/PolyForm-Noncommercial-1.0.0.mdREADME.mdSECURITY.mddocs/local-checks.mddocs/release-process.mddocs/security/release-verification.mddocs/security/sbom.mddocs/security/triage-runbook.mdhooks/page_descriptions.pyhooks/root_pages.pymkdocs.ymlsbom/sbom.cdx.json.template
Licence 2 grants a Distribution License for any noncommercial purpose, so a charity or university shipping hardware with SolidSyslog inside is covered by licence 2, not licence 3. LICENSE.md read as though distribution and commerce were the same event, in four places. Also states licence 2's Notices obligation on a redistributor, adds an ask-us line for the grey cases, and stops CONTRIBUTING.md and the SBOM scope note restating the licence model instead of linking it. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
There was a problem hiding this comment.
Actionable comments posted: 1
🔇 Additional comments (5)
LICENSE.md (2)
1-14: LGTM!Also applies to: 15-29, 30-44, 45-56, 57-70, 81-86
74-79: 🗄️ Data Integrity & IntegrationMake the custom licence references resolvable across the licensing documents and SBOM.
The same
LicenseRef-identifiers appear in both documents. Confirm that the generated SBOM maps each identifier to stable licence information.
LICENSE.md#L74-L79: define or link the corresponding Internal Use and Commercial licence information.docs/security/sbom.md#L82-L82: document the generated-BOM mapping or attached licence text for both references.Source: MCP tools
CONTRIBUTING.md (1)
20-23: LGTM!docs/security/sbom.md (2)
21-23: LGTM!
83-83: 🗄️ Data Integrity & Integration
⚠️ Unverified finding
Sandbox verification was unavailable.Keep the documented hash scope identical to the generator.
This line states that
LICENSES/is included insource-tree-sha256. Verify that the workflow, the release-verification instructions, and the hash command use the same path set and ordering. Otherwise, signature verification can cover a hash that omits the licence texts.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@README.md`:
- Around line 131-132: Update the README licensing section to remove the
detailed commercial-licence summary and direct readers to LICENSE.md for the
three licence choices and permitted purposes. Keep LICENSE.md as the sole
authoritative source so the commercial boundary includes shipping, supplying, or
distributing commercial products, devices, firmware, and services.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro
Run ID: 7db5c2ee-e01b-420d-9239-1fac16255180
📒 Files selected for processing (4)
CONTRIBUTING.mdLICENSE.mdREADME.mddocs/security/sbom.md
The bullet said "ship a commercial product", but licence 3 also covers supplying a commercial device, firmware or service. The README was narrower than the licence it summarises, which is the wrong direction to be imprecise in - a commercial service reader would have concluded they needed nothing. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
docs.cososo.co.uk is a separate website trading under the same brand as cososo.co.uk, so it owes the same particulars under the Companies (Trading Disclosures) Regulations and the Electronic Commerce (EC Directive) Regulations 2002: registered name and trading name, company number, VAT number and registered office. The year comes from build_date_utc rather than a literal, so it cannot go stale. The block declares no colour, size or family, so it inherits .md-copyright and cannot drift into a second typeface. No email address yet - one is likely still owed under the e-commerce regulations, and a dedicated address is being set up first. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@overrides/partials/copyright.html`:
- Around line 9-10: Update the footer attribution text around the Companies
House statement so only the registered name, company number, and registered
office are attributed to Companies House for 09856828. Separately validate VAT
number GB 226 5336 15 with HMRC, and publish it in the footer only after that
validation.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro
Run ID: b6d24c67-d2a4-4c97-bd8f-248c2ab3b120
⛔ Files ignored due to path filters (1)
docs/assets/stylesheets/brand.cssis excluded by!docs/assets/**
📒 Files selected for processing (3)
README.mdmkdocs.ymloverrides/partials/copyright.html
Companies House does not hold VAT numbers - VAT registration is HMRC's - so the partial's comment pointed a future maintainer at a register that cannot confirm one of the four particulars. Comment only; the rendered footer is unchanged. The README bullet omitted "or otherwise make available", so it was still narrower than the licence 3 trigger it summarises. The two now read the same. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
☀️ Quality Summary Created by Quality Monitor v4.15.0 (#82d77af). More details are shown in the GitHub Checks Result. |
1 participant
Purpose
SolidSyslog moves from a single PolyForm Noncommercial licence to three
alternative licences, ahead of cutting 0.1.0.
The commercial gate becomes distribution rather than commercial identity. The
Noncommercial-only licence did not permit a commercial organisation to evaluate
the library at all, which was blocking prospects. PolyForm Internal Use 1.0.0
closes that: free, no time limit, for evaluation, porting, integration and
testing on target inside any organisation.
No issue — a licensing change with no acceptance criteria to agree.
Change Description
The three licences
operations of any organisation. Does not permit distribution.
not yet drafted.
Licence texts are verbatim.
LICENSES/holds both, byte-identical to thePolyForm project repo at
76a278c(
3a4a1539…andc0ea4a89…). No reformatting, and no licensor substitution —the canonical text has no placeholder for it, so the licensor is identified by the
Required Notice:line inLICENSE.md, which is the mechanism PolyForm intends.Editing the text would break licence-scanner matching for no gain.
Worth noting for review: the
LICENSE.mdbeing replaced was not canonicalPolyForm text. It had the Definitions compressed to a bullet list (losing the
definition of Control), the bold-italic dropped from the warranty disclaimer
along with its closing clause, and the
Required Notice:example and canonicalURL removed. Replacing it with a pristine copy is a net correction.
Continuity is now stated once.
LICENSE.mdis the single home;SECURITY.mdand the triage runbook link it instead of restating it indifferent words.
Consequential updates
sbom/sbom.cdx.json.template—licenses[0].license.idbecomes an SPDXexpression. CRA/SBOM-minded readers would notice a mismatch here..github/workflows/sbom.yml—LICENSES/added to the signed content-treehash scope, matching the existing rationale for
LICENSE.md..markdownlint-cli2.jsonc— ignore moves fromLICENSE.mdtoLICENSES/**.The verbatim texts must not be reformatted;
LICENSE.mdis now our own proseand should be linted.
hooks/root_pages.py,mkdocs.yml,hooks/page_descriptions.py— bothlicence texts are published to the docs site. Without this the
LICENSES/links on the published
license.mdpage resolve inside the docs tree,source_links.pyleaves them alone, andmkdocs build --strictfails.CONTRIBUTING.md,SECURITY.md,docs/security/sbom.md,docs/security/release-verification.md,docs/release-process.md,docs/local-checks.md— statements that said "dual-licensed","noncommercial tier", or listed the hash scope.
Test Evidence
No production code, so no TDD cycle. Gates run locally against the pinned CI
images:
mkdocs build --strictin themkdocs-mkdoxyimage — clean, no warnings.Verified the published
license.mdlinks resolve to../licenses/…and thethree pages render.
scripts/check_platform_docs.py— pass.markdownlint-cli2 v0.22.1over the whole tree (required, since the configchanged) — 64 files, 0 errors.
the
expressionform is schema-legal.cyclonedx-cliruns on release.PolyForm-Noncommercial-1.0.0is listed,PolyForm-Internal-Useis not — so theLicenseRef-is correct.GitHub licence detection: the repo API already reports
NOASSERTION/"Other" today, because the existing
LICENSE.mdwas a modified PolyForm text.This change causes no regression there. A three-way chooser cannot be
auto-detected.
Areas Affected
Repository metadata and documentation only. No
Core/,Platform/,Tests/orBdd/source is touched, and no build behaviour changes.Derived projects:
solid-syslog-example-make—third_party/README.mdstates "SolidSyslog isPolyForm Noncommercial 1.0.0" and will be stale. It carries the library as a
submodule, so
LICENSE.mdandLICENSES/travel with the pin; only the proseneeds a human.
solid-syslog-example— makes no statement about the SolidSyslog licence atall, so nothing is stale. Arguably a gap worth filling separately.
Follow-up
In-source
SPDX-License-Identifierheaders are deliberately not in this PR.The tree carries none today outside the vendored Apache-2.0 driver, and adding
them across
Core/andPlatform/needs aclang-formatreflow and amisra_renumber.pypass — enough mechanical churn to bury this change. SeparatePR so both get a genuine review.
Summary by CodeRabbit
LICENSES/.Also in this PR: UK trading disclosures in the docs footer
Rolled in deliberately rather than split out, because it lands in the same
review pass.
docs.cososo.co.ukis a separate website trading under the same brand ascososo.co.uk, so it owes the same particulars under the Companies (TradingDisclosures) Regulations and the Electronic Commerce (EC Directive) Regulations
2002. The cososo.co.uk footer is being updated in parallel, outside this repo.
The footer now reads:
overrides/partials/copyright.html— the disclosure as its own element. Theparticulars are byte-identical to the Companies House record for 09856828 and
to the wording going onto cososo.co.uk; they are legal particulars, not house
style, and must not be reflowed or abbreviated. The partial says so.
mkdocs.yml—copyright:gains the trading name. The year is not writtenhere: the partial renders
build_date_utc.year, so it tracks the build andcannot go stale the way a literal in a static site would.
docs/assets/stylesheets/brand.css—.ss-footer-legalsetsmarginandline-heightonly. It declares no colour, size or family, so it inherits.md-copyrightand cannot drift into a second typeface in a short footer.Decisions worth a reviewer's attention:
Plausible and has no privacy page of its own, so that was the real gap.
Contact is already reachable from
LICENSE.mdandSUPPORT.md, and thesecurity policy is already a Compliance nav page.
regulations — a contact form alone is generally held not to satisfy "direct
and effective communication" — but a dedicated address is being set up first,
and a placeholder would be worse than the gap. Follow-up.
mkdocs.ymlsets a single scheme, tomatch cososo.co.uk), so there is no dark palette to check the block against.
Verified:
mkdocs build --strictclean, and the three lines render byte-exact.