From c25226a6a23fb8c913cdd1e8c91bd09f68a58c00 Mon Sep 17 00:00:00 2001 From: grumbach Date: Thu, 1 Oct 2026 14:23:21 +0900 Subject: [PATCH 1/4] chore(license): declare MIT OR Apache-2.0 across the nodejs packages The crate, the Python package and nodejs/package.json moved to MIT OR Apache-2.0, but two places that npm reads were left behind: - nodejs/package-lock.json still recorded GPL-3.0 for the root package. The new value is what `npm install --package-lock-only` writes from the current package.json; no dependency entry changes. - The four platform packages under nodejs/npm/ declared plain MIT. They carry the compiled self_encryption addon, so they now declare the same MIT OR Apache-2.0 as the main package. No code, version or dependency changes. --- nodejs/npm/darwin-arm64/package.json | 2 +- nodejs/npm/darwin-x64/package.json | 2 +- nodejs/npm/linux-x64-gnu/package.json | 2 +- nodejs/npm/win32-x64-msvc/package.json | 2 +- nodejs/package-lock.json | 2 +- 5 files changed, 5 insertions(+), 5 deletions(-) diff --git a/nodejs/npm/darwin-arm64/package.json b/nodejs/npm/darwin-arm64/package.json index 8e33b32d8..1968dadc4 100644 --- a/nodejs/npm/darwin-arm64/package.json +++ b/nodejs/npm/darwin-arm64/package.json @@ -16,7 +16,7 @@ "files": [ "self-encryption.darwin-arm64.node" ], - "license": "MIT", + "license": "MIT OR Apache-2.0", "engines": { "node": ">= 10" } diff --git a/nodejs/npm/darwin-x64/package.json b/nodejs/npm/darwin-x64/package.json index bcd9a4d69..7292cd497 100644 --- a/nodejs/npm/darwin-x64/package.json +++ b/nodejs/npm/darwin-x64/package.json @@ -16,7 +16,7 @@ "files": [ "self-encryption.darwin-x64.node" ], - "license": "MIT", + "license": "MIT OR Apache-2.0", "engines": { "node": ">= 10" } diff --git a/nodejs/npm/linux-x64-gnu/package.json b/nodejs/npm/linux-x64-gnu/package.json index fd2bab2db..43b98eebb 100644 --- a/nodejs/npm/linux-x64-gnu/package.json +++ b/nodejs/npm/linux-x64-gnu/package.json @@ -16,7 +16,7 @@ "files": [ "self-encryption.linux-x64-gnu.node" ], - "license": "MIT", + "license": "MIT OR Apache-2.0", "engines": { "node": ">= 10" }, diff --git a/nodejs/npm/win32-x64-msvc/package.json b/nodejs/npm/win32-x64-msvc/package.json index 5a0055f64..fab776525 100644 --- a/nodejs/npm/win32-x64-msvc/package.json +++ b/nodejs/npm/win32-x64-msvc/package.json @@ -16,7 +16,7 @@ "files": [ "self-encryption.win32-x64-msvc.node" ], - "license": "MIT", + "license": "MIT OR Apache-2.0", "engines": { "node": ">= 10" } diff --git a/nodejs/package-lock.json b/nodejs/package-lock.json index be1ee2d31..a15182b1b 100644 --- a/nodejs/package-lock.json +++ b/nodejs/package-lock.json @@ -7,7 +7,7 @@ "": { "name": "@withautonomi/self-encryption", "version": "0.1.1", - "license": "GPL-3.0", + "license": "MIT OR Apache-2.0", "devDependencies": { "@napi-rs/cli": "^2.18.4", "@types/node": "^22.13.10", From 5526c805c5c74add794b8effcb9a7b3b769bd4b3 Mon Sep 17 00:00:00 2001 From: grumbach Date: Fri, 2 Oct 2026 10:58:31 +0900 Subject: [PATCH 2/4] docs(changelog): record the relicense for the next release master relicensed self_encryption from GPL-3.0 with a linking exception to MIT OR Apache-2.0, but CHANGELOG.md, which ships in the crate, has no entry for it. The release that carries the relicense would therefore not tell anyone upgrading that the terms changed. Add an Unreleased entry recording the change and naming 0.36.0 as the last release under GPL-3.0 with the linking exception. The version number is left to whoever cuts the release; they rename the heading when they bump Cargo.toml. --- CHANGELOG.md | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index cba241699..18c0d4d1d 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,6 +7,14 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 *When editing this file, please respect a line length of 100.* +## [Unreleased] + +### Changed +- Relicensed from GPL-3.0 with a linking exception to MIT OR Apache-2.0, at your option. The + `LICENSE` file is replaced by `LICENSE-MIT` and `LICENSE-APACHE`, and the crate, Python and + Node.js package metadata declare `MIT OR Apache-2.0`. The last release under GPL-3.0 with the + linking exception is 0.36.0. + ## [0.36.0] - 2026-05-13 ### Added From d33b568234daa66c67cd0af59964ea341aa4c770 Mon Sep 17 00:00:00 2001 From: grumbach Date: Fri, 2 Oct 2026 11:09:07 +0900 Subject: [PATCH 3/4] build(nodejs): ship the licence texts in every npm package The npm packages declare MIT OR Apache-2.0 but would have carried no licence text if published: the main package directory has no licence file, and each platform package's `files` list names only its .node addon. The publish workflow now copies the repository's LICENSE-MIT and LICENSE-APACHE into the main package and every platform package after the addons are moved into place, and each platform package lists both files. The repository root stays the only copy of the texts. Checked by running the copy step on a copy of nodejs/ with stub addons: npm pack --dry-run then lists both files in all five packages. --- .github/workflows/nodejs-publish.yml | 6 ++++++ nodejs/npm/darwin-arm64/package.json | 4 +++- nodejs/npm/darwin-x64/package.json | 4 +++- nodejs/npm/linux-x64-gnu/package.json | 4 +++- nodejs/npm/win32-x64-msvc/package.json | 4 +++- 5 files changed, 18 insertions(+), 4 deletions(-) diff --git a/.github/workflows/nodejs-publish.yml b/.github/workflows/nodejs-publish.yml index a1c007004..a4ee8efb9 100644 --- a/.github/workflows/nodejs-publish.yml +++ b/.github/workflows/nodejs-publish.yml @@ -47,6 +47,12 @@ jobs: path: ./nodejs/artifacts - name: Move artifacts run: npm run artifacts + - name: Add the licence texts to every package + run: | + for dir in . npm/*/; do + cp ../LICENSE-MIT ../LICENSE-APACHE "$dir" + done + shell: bash - name: List packages run: ls -R ./npm shell: bash diff --git a/nodejs/npm/darwin-arm64/package.json b/nodejs/npm/darwin-arm64/package.json index 1968dadc4..1299150b4 100644 --- a/nodejs/npm/darwin-arm64/package.json +++ b/nodejs/npm/darwin-arm64/package.json @@ -14,7 +14,9 @@ ], "main": "self-encryption.darwin-arm64.node", "files": [ - "self-encryption.darwin-arm64.node" + "self-encryption.darwin-arm64.node", + "LICENSE-MIT", + "LICENSE-APACHE" ], "license": "MIT OR Apache-2.0", "engines": { diff --git a/nodejs/npm/darwin-x64/package.json b/nodejs/npm/darwin-x64/package.json index 7292cd497..ddbded05d 100644 --- a/nodejs/npm/darwin-x64/package.json +++ b/nodejs/npm/darwin-x64/package.json @@ -14,7 +14,9 @@ ], "main": "self-encryption.darwin-x64.node", "files": [ - "self-encryption.darwin-x64.node" + "self-encryption.darwin-x64.node", + "LICENSE-MIT", + "LICENSE-APACHE" ], "license": "MIT OR Apache-2.0", "engines": { diff --git a/nodejs/npm/linux-x64-gnu/package.json b/nodejs/npm/linux-x64-gnu/package.json index 43b98eebb..d0583e6a7 100644 --- a/nodejs/npm/linux-x64-gnu/package.json +++ b/nodejs/npm/linux-x64-gnu/package.json @@ -14,7 +14,9 @@ ], "main": "self-encryption.linux-x64-gnu.node", "files": [ - "self-encryption.linux-x64-gnu.node" + "self-encryption.linux-x64-gnu.node", + "LICENSE-MIT", + "LICENSE-APACHE" ], "license": "MIT OR Apache-2.0", "engines": { diff --git a/nodejs/npm/win32-x64-msvc/package.json b/nodejs/npm/win32-x64-msvc/package.json index fab776525..34277a37a 100644 --- a/nodejs/npm/win32-x64-msvc/package.json +++ b/nodejs/npm/win32-x64-msvc/package.json @@ -14,7 +14,9 @@ ], "main": "self-encryption.win32-x64-msvc.node", "files": [ - "self-encryption.win32-x64-msvc.node" + "self-encryption.win32-x64-msvc.node", + "LICENSE-MIT", + "LICENSE-APACHE" ], "license": "MIT OR Apache-2.0", "engines": { From 9d2737d6fad3196b4c44238a36c4b794d4c5bc91 Mon Sep 17 00:00:00 2001 From: grumbach Date: Tue, 6 Oct 2026 13:44:02 +0900 Subject: [PATCH 4/4] chore(release): bump to 0.36.1 so the relicense can be published Every release up to 0.36.0 is on crates.io under GPL-3.0 with the linking exception, and master still carried that version number, so merging the relicense alone gave consumers nothing to pick up. 0.36.1 is the version the release workflow will publish under MIT OR Apache-2.0. A patch bump is enough: the only changes since v0.36.0 are licence headers, licence files and package metadata, with no API change. It also means anything depending on `^0.36` reaches the relicensed crate with a plain `cargo update`. The Python package takes its version from the crate, so its next PyPI release is 0.36.1 too. --- CHANGELOG.md | 2 +- Cargo.toml | 2 +- nodejs/Cargo.toml | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 18c0d4d1d..869bdae1f 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,7 +7,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 *When editing this file, please respect a line length of 100.* -## [Unreleased] +## [0.36.1] - 2026-10-06 ### Changed - Relicensed from GPL-3.0 with a linking exception to MIT OR Apache-2.0, at your option. The diff --git a/Cargo.toml b/Cargo.toml index ff0813b1a..ad24aed2d 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -13,7 +13,7 @@ license = "MIT OR Apache-2.0" name = "self_encryption" readme = "README.md" repository = "https://github.com/WithAutonomi/self_encryption" -version = "0.36.0" +version = "0.36.1" [features] default = [] diff --git a/nodejs/Cargo.toml b/nodejs/Cargo.toml index 282623a6f..1b646bf30 100644 --- a/nodejs/Cargo.toml +++ b/nodejs/Cargo.toml @@ -12,7 +12,7 @@ crate-type = ["cdylib"] hex = "0.4.3" napi = { version = "2.12.2", default-features = false, features = ["napi4", "napi6", "tokio_rt", "serde-json"] } napi-derive = "2.12.2" -self_encryption = { version = "0.36.0", path = ".." } +self_encryption = { version = "0.36.1", path = ".." } [build-dependencies] napi-build = "2.0.1"