From 58e9e91f3ec7d8463ccdf0403013a3b6456ccd7e Mon Sep 17 00:00:00 2001 From: Abdullah Ghani Date: Wed, 14 Oct 2026 17:10:10 +0400 Subject: [PATCH] Record AGPL for product firmware, add reporting links and disclosure timeline, add Dependabot Signed-off-by: Abdullah Ghani --- .github/dependabot.yml | 7 +++++++ LICENSING.md | 3 ++- SECURITY.md | 9 +++++++-- 3 files changed, 16 insertions(+), 3 deletions(-) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..eb7553e --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,7 @@ +# Keeps GitHub Actions used by this repository up to date. +version: 2 +updates: + - package-ecosystem: github-actions + directory: / + schedule: + interval: weekly diff --git a/LICENSING.md b/LICENSING.md index 2d99282..e397ef4 100644 --- a/LICENSING.md +++ b/LICENSING.md @@ -6,7 +6,8 @@ applies in its `LICENSE` file. | What | License | In plain words | |---|---|---| -| Software, firmware, tools, build layers | [Apache-2.0](https://www.apache.org/licenses/LICENSE-2.0) | Use it, change it, sell it. Keep the notices. Every contributor also grants the patent rights needed to use their work. | +| Product firmware and applications (for example [0700-AAM](https://github.com/MusicTribeOpenSource/0700-AAM)) | [AGPL-3.0-or-later](https://www.gnu.org/licenses/agpl-3.0.html) | Use it, change it, sell it. If you ship or serve a changed version, you publish your changes under the same license. It's also what the JUCE framework requires for open-source use. | +| Other software, tools, libraries and build layers | [Apache-2.0](https://www.apache.org/licenses/LICENSE-2.0) | Use it, change it, sell it. Keep the notices. Every contributor also grants the patent rights needed to use their work. | | Code built on GPL projects (for example Linux kernel patches, U-Boot) | [GPL-2.0](https://www.gnu.org/licenses/old-licenses/gpl-2.0.html) | Those projects require it. If you share a changed version, you share its source too. | | Hardware designs (schematics, circuit boards, enclosures) | [CERN-OHL-P-2.0](https://ohwr.org/cern_ohl_p_v2.txt) | Build it, change it, sell it. Keep the notices. | | Documentation, manuals, images | [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/) | Reuse it anywhere. Say where it came from. | diff --git a/SECURITY.md b/SECURITY.md index 97541d7..15397bd 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -6,14 +6,19 @@ Found a vulnerability? Thank you for looking out for everyone. Report it privately instead: -1. Go to the repository's **Security** tab. +1. Go to the repository's **Security** tab, for example + https://github.com/MusicTribeOpenSource/0700-AAM/security/advisories/new 2. Click **Report a vulnerability**. 3. Describe what you found and how to reproduce it. +GitHub explains the process here: +https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing-information-about-vulnerabilities/privately-reporting-a-security-vulnerability + Only the repository's maintainers and the organization's owners can see your report. ## What happens next - We aim to reply within 3 working days. -- We'll keep you updated while we work on a fix. +- We'll keep you updated while we work on a fix, and agree a disclosure date with you. +- We aim to fix confirmed vulnerabilities and publish an advisory within 90 days. - When it's fixed, we'll credit you in the advisory if you'd like.