From 4a9c0c1c55d510612262e407f7dc8da3edde3f95 Mon Sep 17 00:00:00 2001 From: John Ellis Date: Tue, 25 Aug 2026 13:42:11 -0700 Subject: [PATCH] Make the AGPL's source offer point at the source being run Three things a licence audit turned up. None of them is a conflict -- every one of the 182 installed packages is permissive, and the relicence was within the copyright holder's gift -- but all three are ways the AGPL fails to stick. The offer was hard-coded to this repository. Section 13 asks whoever runs a modified version to offer *that* version's source, so every deployment with a patch in it was pointing at the wrong tree, and would have gone on doing so unless its operator noticed and edited the About page. SOURCE_URL now sets it, alongside APP_NAME, and both the sign-in page and About read it. The offer was also only visible after signing in. Whoever is looking at the sign-in form is interacting with the program over a network too, so the footer carries it now. And the two workspace packages declared no licence at all. Private, so npm never minded, but anything reading the tree saw a blank where the rest of the project says AGPL-3.0-or-later. Checked both ways round: with SOURCE_URL set to a fork, the sign-in page and About both point at the fork; with it unset, both fall back to this repository. --- .env.example | 6 ++++++ README.md | 5 +++++ docker-compose.yml | 1 + server/package.json | 1 + server/src/app.ts | 2 ++ server/src/config.ts | 8 ++++++++ web/package.json | 1 + web/src/jmap/types.ts | 2 ++ web/src/lib/source.ts | 8 ++++++++ web/src/views/Login.tsx | 17 ++++++++++++++++- web/src/views/settings/AboutSettings.tsx | 5 ++++- 11 files changed, 54 insertions(+), 2 deletions(-) create mode 100644 web/src/lib/source.ts diff --git a/.env.example b/.env.example index 140f19f..29f3bae 100644 --- a/.env.example +++ b/.env.example @@ -39,3 +39,9 @@ IMAGE_PROXY=1 # Branding APP_NAME=ihasmail + +# Where this instance's source can be had. ihasmail is AGPL-3.0-or-later, which +# asks whoever runs a modified version to offer *that* version's source -- so if +# you have patched it, point this at your own tree. Shown on the sign-in page +# and in Settings > About. +SOURCE_URL=https://github.com/LINUXexpert-org/ihasmail diff --git a/README.md b/README.md index 7855918..cd0e0f7 100644 --- a/README.md +++ b/README.md @@ -233,3 +233,8 @@ nearly always run as a network service rather than handed to anyone as a binary, and the AGPL's section 13 closes that gap: anyone running a modified ihasmail for other people has to offer them its source, which the GPL alone does not require. + +That offer has to point at *your* source, not this one. If you run a modified +ihasmail, set `SOURCE_URL` to your own repository: the sign-in page and +Settings › About both show it, so the people using your instance are told where +the code they are actually running can be found. diff --git a/docker-compose.yml b/docker-compose.yml index 753411f..c7768f9 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -9,6 +9,7 @@ services: STALWART_URL: ${STALWART_URL:?set STALWART_URL in .env} APP_SECRET: ${APP_SECRET:?set APP_SECRET in .env (openssl rand -base64 48)} APP_NAME: ${APP_NAME:-ihasmail} + SOURCE_URL: ${SOURCE_URL:-https://github.com/LINUXexpert-org/ihasmail} TRUST_PROXY: "1" IMAGE_PROXY: "1" volumes: diff --git a/server/package.json b/server/package.json index 949a4f8..c988ceb 100644 --- a/server/package.json +++ b/server/package.json @@ -2,6 +2,7 @@ "name": "@ihasmail/server", "version": "2.0.0", "private": true, + "license": "AGPL-3.0-or-later", "type": "module", "main": "dist/index.js", "scripts": { diff --git a/server/src/app.ts b/server/src/app.ts index 04e1ea1..026dd9b 100644 --- a/server/src/app.ts +++ b/server/src/app.ts @@ -148,6 +148,7 @@ export function createApp(): Hono { api.get("/config", (c) => c.json({ appName: config.appName, + sourceUrl: config.sourceUrl, imageProxy: config.imageProxy, maxUploadBytes: config.maxUploadBytes, }), @@ -581,6 +582,7 @@ function sessionExtras(session: LiveSession, info: AccountInfo = { locale: null, return { ihasmail: { appName: config.appName, + sourceUrl: config.sourceUrl, imageProxy: config.imageProxy, maxUploadBytes: config.maxUploadBytes, sessionId: session.id, diff --git a/server/src/config.ts b/server/src/config.ts index abd942f..40e414d 100644 --- a/server/src/config.ts +++ b/server/src/config.ts @@ -60,6 +60,14 @@ const stalwartUrl = env("STALWART_URL", "https://mail.example.com").replace(/\/+ export const config = { isProd, appName: env("APP_NAME", "ihasmail"), + /** + * Where this instance's source can be had, shown to everyone who reaches it. + * + * The AGPL asks whoever *runs* a modified version to offer that version's + * source, not the one it was forked from -- so anyone deploying a patched + * ihasmail should point this at their own tree. + */ + sourceUrl: env("SOURCE_URL", "https://github.com/LINUXexpert-org/ihasmail"), host: env("HOST", "0.0.0.0"), port: int("PORT", 8080), stalwartUrl, diff --git a/web/package.json b/web/package.json index 06ba186..a751a82 100644 --- a/web/package.json +++ b/web/package.json @@ -2,6 +2,7 @@ "name": "@ihasmail/web", "version": "2.0.0", "private": true, + "license": "AGPL-3.0-or-later", "type": "module", "scripts": { "dev": "vite", diff --git a/web/src/jmap/types.ts b/web/src/jmap/types.ts index 16577f1..4055c39 100644 --- a/web/src/jmap/types.ts +++ b/web/src/jmap/types.ts @@ -25,6 +25,8 @@ export interface JmapSession { state: string; ihasmail?: { appName: string; + /** Where this instance's source can be had, for the AGPL's sake. */ + sourceUrl?: string; imageProxy: boolean; maxUploadBytes: number; sessionId: string; diff --git a/web/src/lib/source.ts b/web/src/lib/source.ts new file mode 100644 index 0000000..e153ebf --- /dev/null +++ b/web/src/lib/source.ts @@ -0,0 +1,8 @@ +/** + * Where to point someone who wants this instance's source. + * + * The AGPL asks whoever runs a modified version to offer *that* version's + * source. The server says where its own lives, via SOURCE_URL; this is only the + * fallback for when it has not been asked yet, or has nothing to say. + */ +export const DEFAULT_SOURCE_URL = "https://github.com/LINUXexpert-org/ihasmail"; diff --git a/web/src/views/Login.tsx b/web/src/views/Login.tsx index 68a14c7..d9da254 100644 --- a/web/src/views/Login.tsx +++ b/web/src/views/Login.tsx @@ -1,10 +1,23 @@ -import { useState, type FormEvent } from "react"; +import { useEffect, useState, type FormEvent } from "react"; import { Eye, EyeOff, LogIn, ShieldCheck } from "lucide-react"; import { useSession } from "@/store/session"; import { ApiError } from "@/jmap/client"; +import { DEFAULT_SOURCE_URL } from "@/lib/source"; export function LoginPage() { const login = useSession((s) => s.login); + // The AGPL's offer has to reach everyone who interacts with the app over the + // network, and that includes whoever is looking at this form. The server says + // where its own source lives, so a modified deployment points at its own. + const [sourceUrl, setSourceUrl] = useState(DEFAULT_SOURCE_URL); + useEffect(() => { + let live = true; + fetch("/api/config") + .then((r) => (r.ok ? r.json() : null)) + .then((c) => { if (live && c?.sourceUrl) setSourceUrl(c.sourceUrl as string); }) + .catch(() => { /* the default stands */ }); + return () => { live = false; }; + }, []); const [username, setUsername] = useState(() => localStorage.getItem("ihasmail:lastUser") ?? ""); const [password, setPassword] = useState(""); const [totp, setTotp] = useState(""); @@ -81,6 +94,8 @@ export function LoginPage() {

ihasmail by linuxexpert.org + {" · "} + AGPL-3.0 source

diff --git a/web/src/views/settings/AboutSettings.tsx b/web/src/views/settings/AboutSettings.tsx index edae726..210c345 100644 --- a/web/src/views/settings/AboutSettings.tsx +++ b/web/src/views/settings/AboutSettings.tsx @@ -1,9 +1,12 @@ import { useSession } from "@/store/session"; import { client } from "@/jmap/client"; +import { DEFAULT_SOURCE_URL } from "@/lib/source"; export function AboutSettings() { const session = useSession((s) => s.session); const caps = Object.keys(session?.capabilities ?? {}); + // A deployment running modified code should offer its own source, not ours. + const sourceUrl = session?.ihasmail?.sourceUrl ?? DEFAULT_SOURCE_URL; return (

About ihasmail

@@ -12,7 +15,7 @@ export function AboutSettings() { ihasmail
ihasmail 2.0
-
AGPL-3.0-or-later · github.com/LINUXexpert-org/ihasmail
+
AGPL-3.0-or-later · {sourceUrl.replace(/^https?:\/\//, "")}

Server