43 lines
2.6 KiB
Markdown
43 lines
2.6 KiB
Markdown
# Public source boundary
|
|
|
|
## Publication decision
|
|
|
|
Do not make this canonical repository public in place. Its history contains real private network
|
|
addresses, deployment hostnames, storage paths, integration names and production verification
|
|
evidence. Those facts are useful to operators but unnecessary for users and increase disclosure
|
|
risk.
|
|
|
|
Create a new, parentless public repository from `scripts/export-public-source.mjs`. The exporter
|
|
selects reviewed source and documentation from `public-source.allowlist`, replaces private example
|
|
identifiers with stable synthetic ones, rejects remaining private indicators and writes a content
|
|
manifest. The canonical repository and all of its Git history remain private.
|
|
|
|
## Release checklist
|
|
|
|
1. Verify the canonical AGPL-3.0 `LICENSE` text and SPDX metadata are present.
|
|
2. Confirm `security@itworx.tech` is monitored for private vulnerability reports.
|
|
3. Generate the export into a new directory outside this repository.
|
|
4. Run `node scripts/validate-public-source.mjs` from the generated directory, then run Gitleaks
|
|
and all component tests there. The validator recomputes every declared SHA-256 digest and byte
|
|
count, rejects undeclared files, links, unsafe paths and case-insensitive path collisions.
|
|
5. Dispatch `public-candidate-acceptance.yml` for the exact canonical commit. It renders from the
|
|
clean export, builds and scans all four images, and clean-installs an isolated production-shaped
|
|
Compose project without touching production. See `docs/operations/RC_ACCEPTANCE.md`.
|
|
6. Review generated `PUBLIC_SOURCE_MANIFEST.json` and the final diff.
|
|
7. Create a new repository with one parentless initial commit; never push canonical refs or tags.
|
|
8. Configure protected branches. Pull requests from forks must not receive internal secrets or run
|
|
automatically on persistent private runners. The exporter therefore removes the automatic
|
|
`pull_request` trigger from the public copy of `managed-validation.yml` and leaves only explicit
|
|
owner dispatch. Keep public branch protection independent of private-runner status checks until
|
|
a public-safe CI runner is configured.
|
|
|
|
## License decision
|
|
|
|
The owner selected **AGPL-3.0-or-later** on 2026-09-01. ModelForge is a network-accessible,
|
|
self-hosted application; the AGPL keeps modifications made available over a network available to
|
|
those users and protects the platform from closed hosted forks.
|
|
|
|
The license covers ModelForge source and distributions. Downloaded model repositories, weights,
|
|
datasets and other third-party artifacts retain their own upstream terms. The exporter verifies the
|
|
approved canonical license digest before creating a public candidate.
|