Repository navigation
docs: add GPLv3 LICENSE - #9
Merged
Merged
Conversation
Matches the license dotCMS core carried before the move to the Business Source License: verbatim GPLv3, which is what core's LICENSE held from 2022 until commit 7189abf (Feb 2025). Chosen over a non-commercial license on purpose. The audience for an implant scanner is companies sweeping their own repositories, and a genuinely non-commercial license (PolyForm NC, CC BY-NC) would forbid exactly that use, as well as failing the OSI definition that many security teams check before running third-party code. GPLv3 keeps the tool free and usable by anyone while copyleft keeps improvements to the detection rules in the open. LICENSE is the verbatim FSF text so GitHub's license detection resolves it to GPL-3.0; the dotCMS copyright notice lives in the README. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
wezell
approved these changes
Sep 21, 2026
wezell
left a comment
wezell
left a comment
Member
There was a problem hiding this comment.
Why not Apache 2.0? Not asking for a change, just wondering about the thinking.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds the
LICENSEfile the repo is missing before it gets linked from a public engineering blog post.What core actually used before BSL
Checked rather than assumed —
dotCMS/core'sLICENSEhistory:9ceb691…b69a711enterprise/carve-out under the proprietary dotCMS Enterprise License7189abf$5MTotal Finances additional use grant)9125c53,1bb336d,0910e9dSo pre-BSL core was GPLv3. This PR matches that.
Why GPLv3 and not a non-commercial license
The brief was "community and free, but not monetizable, and contributions should have to come back to it." GPLv3 delivers three of those four literally, and the fourth needs stating plainly rather than silently resolving:
AGPLv3 was considered and rejected: its network clause only bites when a modified version is offered to users over a network, and this is a shell script run locally on a developer machine or CI runner. It buys close to nothing here, and blanket AGPL bans in corporate policy would cost real adoption. Open to revisiting if the hosted-scanning-service scenario is a concern worth the friction.
Contents
LICENSE— verbatim GPLv3 from the FSF text, unmodified, so GitHub's license detection resolves the repo toGPL-3.0and shows the badge.README.md— a License section carrying the dotCMS LLC copyright notice, the standard GPL warranty disclaimer, the reasoning above in short, and the third-party-components statement that core's own LICENSE preamble carried.Copyright line is
Copyright (C) 2026 dotCMS LLC— first commit in this repo is 2026-08-25.No code changes.
🤖 Generated with Claude Code