Contributing
tavrn is open source, and bug reports, fixes, translations, documentation, protocol reviews and accessibility
testing are all welcome. The rules that apply to every repository of the project are kept in the organization’s
.github repository:
- the contributing guide: where things live, how to propose a change and what a good pull request looks like;
- the code of conduct;
- the security policy: security problems are reported privately, never in a public issue;
- support: questions go to the Discussions, not to issues.
Where to start
Section titled “Where to start”Issues and pull requests belong in the repository that owns the code. Changes to what goes over the wire (the API, the message format, federation or the encryption) start in the protocol repository; the implementations follow. For anything larger than a small fix, open an issue first so the approach can be agreed before you spend time on it. If you are not sure where something belongs, open a discussion.
The contributor license agreement
Section titled “The contributor license agreement”Contributions are accepted under a short contributor license agreement. You sign it once, with a single comment on your first pull request, when the CLA bot asks for it. You keep the copyright of your work. The agreement confirms contributions under the existing project licenses; it grants no additional relicensing rights. Official development stays public in just-tavrn. Paid hosting by the project and independent providers is welcome. Existing public license grants remain in effect.
Licenses
Section titled “Licenses”Each repository has the license that fits its role:
| Repository | What it holds | License |
|---|---|---|
| tavrn | Overview, documentation, roadmap | CC-BY-4.0 |
| tavrn-protocol | The specification, openapi.json, test vectors | Apache-2.0 for the machine-readable parts, CC-BY-4.0 for the prose |
| tavrn-crypto | The encryption core and @tavrn/crypto | MPL-2.0 |
| tavrn-js | @tavrn/sdk, @tavrn/e2ee, @tavrn/bot | Apache-2.0; @tavrn/e2ee is MPL-2.0 |
| tavrn-node | The node server and its deployment | AGPL-3.0-only |
| tavrn-web | The web client and the desktop app | Apache-2.0 |
| tavrn-website | This website | Apache-2.0 for the code, CC-BY-4.0 for the texts |
| .github | Organization-wide documents and workflows | CC-BY-4.0 for the texts, Apache-2.0 for the code |
The node is AGPL-3.0-only so that improvements of a hosted node stay open. The clients, the SDK and the bot runtime are Apache-2.0, so anyone can build clients, bots and integrations. The encryption code is MPL-2.0: you can embed it anywhere, but distributed modifications to its MPL files must be made available in source form.
The pages of this wiki that are copied from other repositories keep the license of their source; each of them says which at the bottom.
The name and the logo
Section titled “The name and the logo”The name “tavrn” and the logo are not covered by these licenses. Independent providers may advertise “Managed hosting for tavrn by ExampleHost” and keep the original branding in unmodified deployments. Identify your own business clearly and do not imply official affiliation. Local operational and bug-fix patches are permitted as described in the trademark policy; separately marketed forks need their own product identity unless permission is granted.