Karti TripathiandClaude Opus 5
36b15ddcaf
Supersedes the Go + embed-Mox design. The Go tree is removed; its
architecture doc is preserved at docs/archive/ARCHITECTURE-go-embed-mox.md
because its competitive analysis and data model still hold.
Five decisions recorded as ADRs:
0001 Rust, not Go — accepting ~5,500 lines of protocol code that Mox
would have given us free, to get the first permissively licensed
Rust mail server. Costs stated plainly.
0002 Apache-2.0, not MIT or AGPL — patent grant, trademark, CLA-free
contribution. Public on GitHub; Gitea stays as the private fallback.
0003 Stalwart's primitive crates (Apache-2.0/MIT) yes; its AGPL server
crates never. DANE and MTA-STS sit on the AGPL side of that line,
which is why we write our own.
0004 Milestones, reordered: embedded inbound is required at launch.
0005 Oracle Cloud blocks outbound :25, so direct-to-MX is impossible on
the launch host. Split delivery is mandatory, not an on-ramp.
Twelve crates in three tiers. Tier 1 (mail-dane, mail-mta-sts, mail-dsn)
is standalone and publishable — no `dane` or `mta-sts` crate exists on
crates.io at all today.
openmail-relay ships the provider table as data, with SES and Oracle from
the start. Oracle's and Resend's SPF includes are deliberately None: a
guessed include turns the DNS check green against a mechanism the provider
does not honour, and mail still fails SPF silently.
cargo check/test/clippy/fmt all green; unsafe_code is forbidden workspace
wide; cargo-deny enforces the licence policy in CI.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JkyvfNJGTshJNE9FtwPLk7
47 lines
1.9 KiB
Markdown
47 lines
1.9 KiB
Markdown
# ADR 0002 — Apache-2.0
|
|
|
|
**Status:** Accepted, 2026-09-02. Supersedes the MIT choice in the archived
|
|
architecture (§8).
|
|
|
|
## Decision
|
|
|
|
**Apache-2.0**, and the repository is public on GitHub
|
|
(`karti-ai/openmail`). The Gitea mirror (`OSS/openmail`) stays as the fallback
|
|
if the project ever needs to go private.
|
|
|
|
## Why not MIT
|
|
|
|
Same freedoms, but Apache-2.0 adds three things that matter here:
|
|
|
|
- **§3, express patent grant.** Email authentication is a standards thicket —
|
|
DKIM, DKIM2, ARC, DMARC. MIT's patent grant is implicit at best, and that is
|
|
what enterprise legal review flags.
|
|
- **§6, trademark reservation.** "OpenMail" is a generic name with at least
|
|
three unrelated projects already using it. Apache-2.0 protects the name while
|
|
the code stays free.
|
|
- **§5, contributor terms.** Inbound contributions are licensed on the same
|
|
terms without a separate CLA.
|
|
|
|
Inbound compatibility is clean: every dependency is Apache-2.0 or MIT.
|
|
|
|
## Why not AGPL
|
|
|
|
AGPL + a commercial exception is the standard way to protect a future hosted
|
|
offering — it is exactly what Stalwart does (`AGPL-3.0-only OR
|
|
LicenseRef-SEL`). We reject it because it makes us unusable by the commercial
|
|
agent builders who are the intended audience, and because being *the*
|
|
permissive option is the entire competitive position. Stalwart's AGPL is the
|
|
reason its competitors must run it in a sidecar; we do not want to be that for
|
|
someone else.
|
|
|
|
## Consequences
|
|
|
|
- "No GPL/AGPL/LGPL anywhere" remains policy, but the *reason* changed. Under
|
|
MIT it was a compatibility fact; under Apache-2.0 it is a deliberate choice,
|
|
since Apache-2.0 is one-way-incompatible with GPL-2-only. Enforced in CI by
|
|
`cargo-deny`.
|
|
- Every source file gets no licence header (the `LICENSE` + `NOTICE` pair is
|
|
sufficient and headers rot); `NOTICE` must be shipped with any redistribution
|
|
and lists third-party attribution.
|
|
- Anyone may fork this closed. That is the intent, not a leak.
|