fix tests. new product advisories enhancements
This commit is contained in:
master
187
LICENSE-ADDENDUM-COMMUNITY-PLUGIN-GRANT.md
Normal file
187
LICENSE-ADDENDUM-COMMUNITY-PLUGIN-GRANT.md
Normal file
@@ -0,0 +1,187 @@
|
||||
# Additional Community Plugin Grant - StellaOps Addendum to BUSL-1.1
|
||||
|
||||
**Addendum Version:** 1.0.0
|
||||
**Effective Date:** 2026-01-25
|
||||
**Licensor:** stella-ops.org
|
||||
|
||||
This Addendum supplements the Business Source License 1.1 (BUSL-1.1) under which
|
||||
Stella Ops Suite is licensed. Where this Addendum conflicts with BUSL-1.1, this
|
||||
Addendum controls for the specific grants below.
|
||||
|
||||
---
|
||||
|
||||
## 1. Definitions
|
||||
|
||||
For purposes of this Addendum:
|
||||
|
||||
(a) **"Plugin"** means a separately packaged extension written to interface with the
|
||||
Licensed Work using documented public plugin APIs or integration points published
|
||||
by Licensor. A Plugin may include connectors, integrations, analyzers, formatters,
|
||||
or other extensions that extend the Licensed Work's functionality without modifying
|
||||
its core source code.
|
||||
|
||||
(b) **"Environment"** means an instance of the Licensed Work under the control of a
|
||||
single legal entity (customer/organization) and deployed to a unique production
|
||||
orchestration boundary. Examples include: a distinct on-premises cluster, a private
|
||||
cloud tenant, or a named cloud account. For avoidance of doubt, dev/staging/production
|
||||
deployments for the same organization each count as separate Environments.
|
||||
|
||||
(c) **"Scan"** means one completed execution of the Licensed Work's vulnerability or
|
||||
artifact analysis pipeline that produces a report or SBOM/VEX output and is billed
|
||||
or metered as a single unit by Licensor's published metrics. Cached or deduplicated
|
||||
results that do not trigger new analysis do not count as additional Scans.
|
||||
|
||||
---
|
||||
|
||||
## 2. Community Plugin Grant
|
||||
|
||||
Notwithstanding anything to the contrary in BUSL-1.1, Licensor hereby grants each
|
||||
Recipient a worldwide, non-exclusive, royalty-free license to:
|
||||
|
||||
(i) **Use, run, and reproduce** a Plugin in production solely for the Recipient's
|
||||
internal business operations in up to **three (3) Environments**; and
|
||||
|
||||
(ii) **Perform up to nine hundred ninety-nine (999) Scans per calendar day** across
|
||||
all such Environments.
|
||||
|
||||
This grant extends to modification and redistribution of the Plugin under the same
|
||||
terms, provided redistribution is not packaged with a commercial managed hosting
|
||||
offering in breach of Section 4 below.
|
||||
|
||||
**Commercial Plugin Development.** You may develop and sell Plugins commercially under
|
||||
license terms of your choosing, provided:
|
||||
- The Plugin does not include, copy, or modify the Licensed Work's source code; AND
|
||||
- Distribution complies with Section 3 below.
|
||||
|
||||
---
|
||||
|
||||
## 3. Distribution & Attribution
|
||||
|
||||
Recipients may distribute Plugin source or binaries under the same license terms as
|
||||
the Licensed Work (including this Addendum). Distributed copies must:
|
||||
|
||||
(a) **Retain conspicuous attribution** to Licensor, including the Licensor name and
|
||||
a link to the Licensed Work's source repository;
|
||||
|
||||
(b) **Include this Addendum verbatim** alongside any distribution of the Licensed Work
|
||||
or Plugins that incorporate portions of the Licensed Work;
|
||||
|
||||
(c) **Preserve the LICENSE and NOTICE files** from the original distribution.
|
||||
|
||||
**Competing Service Restriction.** Redistribution that embeds or repackages Licensor's
|
||||
core runtime binaries into a commercial product that functions as a competing managed
|
||||
service requires a separate commercial license from Licensor.
|
||||
|
||||
---
|
||||
|
||||
## 4. SaaS / Managed Offering Restriction
|
||||
|
||||
Recipients are **NOT** permitted to offer the Licensed Work or a Plugin (or a service
|
||||
that substantially replicates the Licensed Work's core features) as a commercial hosted
|
||||
service, SaaS, or managed/white-label hosting offering to third parties without a
|
||||
separate written commercial license from Licensor.
|
||||
|
||||
This restriction applies whether the service is offered:
|
||||
- Directly to end customers;
|
||||
- Via a reseller or channel partner; or
|
||||
- Embedded into a larger multi-tenant managed platform.
|
||||
|
||||
**Limited Exceptions:**
|
||||
|
||||
(a) **Internal Hosting.** An organization may host the Licensed Work internally for
|
||||
its own employees, contractors, and affiliates without a commercial license,
|
||||
subject to the Environment and Scan limits in Section 2.
|
||||
|
||||
(b) **MSP Single-Tenant Hosting.** A Managed Service Provider (MSP) may host distinct
|
||||
single-tenant instances per customer only if:
|
||||
- Each hosted instance is covered by the MSP's commercial license; OR
|
||||
- The hosted instance remains fully isolated and used exclusively by the
|
||||
licensee's employees and affiliates.
|
||||
|
||||
(c) **Public multi-tenant paid hosting** that provides the Licensed Work's functionality
|
||||
to unrelated third parties is **prohibited** under this Addendum absent a commercial
|
||||
license.
|
||||
|
||||
(d) **Non-Commercial Community Hosting.** Non-commercial, free-of-charge hosting for
|
||||
community benefit (e.g., providing scanning services to open source projects) may
|
||||
be permitted under a separate community program. Organizations wishing to provide
|
||||
such services should contact Licensor at community@stella-ops.org for evaluation.
|
||||
Approval is not automatic and is subject to Licensor's community program terms.
|
||||
|
||||
For detailed guidance on MSP and SaaS scenarios, see `docs/legal/SAAS_MSP_GUIDANCE.md`.
|
||||
|
||||
---
|
||||
|
||||
## 5. Enforcement & Telemetry
|
||||
|
||||
Licensor may reasonably audit or require self-reporting to verify compliance with the
|
||||
Environment and Scan limits described in this Addendum.
|
||||
|
||||
**Audit Rights.** Licensor reserves the right to request compliance verification no
|
||||
more than once per calendar year, with reasonable notice (minimum 30 days). Any audit
|
||||
shall be:
|
||||
- Conducted during normal business hours;
|
||||
- Subject to standard confidentiality and data-protection safeguards; and
|
||||
- Limited in scope to verification of Environment count and Scan volume.
|
||||
|
||||
**Voluntary Telemetry.** Licensor may provide an optional, privacy-respecting metering
|
||||
endpoint for voluntary telemetry. Such telemetry:
|
||||
- Is strictly opt-in;
|
||||
- Collects only aggregate usage metrics (Environment count, Scan count);
|
||||
- Does not collect customer content, source code, or scan results; and
|
||||
- Is subject to Licensor's published privacy policy.
|
||||
|
||||
**Self-Attestation.** Recipients may provide annual self-attestation of compliance
|
||||
using the form at `docs/legal/templates/self-attestation-form.md`.
|
||||
|
||||
---
|
||||
|
||||
## 6. Term & Upgrade
|
||||
|
||||
This Addendum applies to releases of the Licensed Work that include it. Licensor may
|
||||
amend the numeric limits (Environments / Scans) by publishing a new Addendum version.
|
||||
|
||||
**Non-Retroactive Changes.** Such changes do not retroactively affect prior
|
||||
distributions. Recipients using a version of the Licensed Work with an earlier
|
||||
Addendum version may continue under those terms for that version.
|
||||
|
||||
**Version Identification.** Each Addendum version is identified by the version number
|
||||
in the header. The applicable Addendum version for any distribution is the version
|
||||
included with that distribution.
|
||||
|
||||
---
|
||||
|
||||
## 7. No Waiver of Other BUSL Rights
|
||||
|
||||
Except as explicitly modified by this Addendum, all terms of BUSL-1.1 remain in full
|
||||
force and effect, including but not limited to:
|
||||
- The Change Date and Change License provisions;
|
||||
- The requirement to preserve license and attribution notices;
|
||||
- The disclaimer of warranties and limitation of liability.
|
||||
|
||||
---
|
||||
|
||||
## 8. Legal & Compliance Notice
|
||||
|
||||
This Addendum is intended as a narrow community grant to encourage plugin ecosystems
|
||||
while protecting Licensor's commercial SaaS market. It is not legal advice and should
|
||||
be reviewed by counsel prior to publication or reliance.
|
||||
|
||||
**Governing Law.** This Addendum is governed by the same jurisdiction and governing
|
||||
law provisions as the underlying BUSL-1.1 license.
|
||||
|
||||
**Severability.** If any provision of this Addendum is held unenforceable, the
|
||||
remaining provisions continue in full force and effect.
|
||||
|
||||
---
|
||||
|
||||
## Change Log
|
||||
|
||||
| Version | Date | Notes |
|
||||
|---------|------|-------|
|
||||
| 1.0.0 | 2026-01-25 | Initial release of Community Plugin Grant Addendum. |
|
||||
|
||||
---
|
||||
|
||||
*Document maintained by: Legal + Security Guild*
|
||||
*For questions: legal@stella-ops.org*
|
||||
Reference in New Issue
Block a user