From 0586599fc6020df996c4278230eeea99b9d070cb Mon Sep 17 00:00:00 2001 From: Lukasz Kasprzak Date: Tue, 28 Jul 2026 14:02:54 +0200 Subject: licence: relicense MIT -> AGPL-3.0-or-later lectio was MIT, which let anyone take it closed. The concern is not people selling it -- no licence stops that, and the AGPL does not try to -- but someone building a proprietary product on it and giving nothing back. Plain GPL would leave the obvious hole open: lectio-web is a network service, and hosting is not distribution, so a modified lectio-web could be run as a paid subscription API without ever publishing a line. AGPL section 13 closes exactly that. LICENSE is the verbatim FSF text. README carries the standard notice. Section 13 requires a modified network-reachable version to PROMINENTLY offer its source to the users interacting with it, so the offer ships with the code rather than living only in a file nobody fetches: - GET /source plain text, no template or config dependency, so it answers even when something else is broken - page footers every full page (fragments render inside one) - JSON envelope "source" / "license" - iCal header X-LECTIO-SOURCE / X-LECTIO-LICENSE The feed fields are not redundant: an /api/calendar.json consumer or an .ics subscriber never loads a page, so the footer alone would miss them. config.SourceURL is the single source of truth, and says in its comment that a fork running as a service must repoint it -- an offer that leads to someone else's code is not an offer. Tests pin all of it. This is a licence obligation, not a feature, so it should fail loudly if a later change drops it. --- internal/config/config.go | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) (limited to 'internal/config') diff --git a/internal/config/config.go b/internal/config/config.go index 31e9078..b6c9e0e 100644 --- a/internal/config/config.go +++ b/internal/config/config.go @@ -64,6 +64,23 @@ const configHeader = `# lectio configuration (INI). Full-line comments only (# o // -v/--version output (lectio, lectio-ui, lectio-web). const Version = "0.44.0" +// SourceURL is where lectio's corresponding source can be obtained. It is +// not decoration: lectio is AGPL-3.0-or-later, and section 13 requires a +// modified version reachable over a network to "prominently offer" its +// source to the users interacting with it. lectio-web therefore surfaces +// this on every page (footer -> GET /source) and inside both machine feeds +// (JSON envelope, iCal X-LECTIO-SOURCE), so an API consumer who never sees +// the HTML still gets the offer. +// +// If you fork lectio and run it as a service, point this at YOUR source. +// Leaving it aimed here while serving modified code does not satisfy §13 -- +// the offer must lead to the version actually running. +const SourceURL = "https://github.com/lukaszkasprzak/lectio" + +// License is the SPDX identifier lectio ships under, paired with SourceURL +// wherever the §13 offer is made. +const License = "AGPL-3.0-or-later" + // validVersions are the scripture versions lectio understands. All are // embedded corpora; the former "bt" (the niedziela.pl modern scrape) is gone // and a legacy config carrying it is migrated to "wuj" on load (see Load). -- cgit v1.3