# Contributing

Thank you for your interest in this project.

## Licensing model

This project is dual-licensed by CloudOver.io ltd.:

- as free software under the **GNU Affero General Public Licence v3 (AGPL-3.0)**, and
- under **commercial licence terms** for organisations that cannot or do not wish to comply with the AGPL.

Revenue from commercial licences funds the development of the open-source version. For this model to work, CloudOver must hold the rights necessary to ship every line of the project under both sets of terms. That is what the Contributor Licence Agreement is for.

## Contributor Licence Agreement

Before your first contribution can be merged, you need to accept a CLA:

- **[Individual CLA](CLA.md)** — if you are contributing on your own account.
- **[Entity CLA](CLA-ENTITY.md)** — if you are contributing as part of your job, or your employer may have a claim to your work. Ask whoever handles legal matters at your organisation to sign it.

Not sure which applies? If you wrote the code on company time, on company equipment, or it relates to what your employer does, assume the Entity CLA is needed and ask. In most countries rights in software written in the course of employment vest in the employer automatically, so a contribution made in good faith can still fail to carry the rights you think it does.

### What the CLA does

- You keep your copyright. You can reuse your own contributions however you like.
- You license those contributions to CloudOver broadly enough that CloudOver can ship them under the AGPL and under commercial terms.
- CloudOver commits to keeping a version of the project publicly available under an open-source licence.
- You confirm the work is yours to give, and you take on no warranty or liability for it.

### How to accept

Open a pull request. The CLA bot will comment with a link; follow it and confirm. You only need to do this once. If the CLA text is later revised, the version in force when you submitted a contribution is the one that governs it.

## Before you submit code

Please make sure that:

- **Everything in the patch is yours.** Do not paste in code from Stack Overflow answers, blog posts, other repositories, or your own work for a previous employer, unless you are certain of its provenance.
- **You have not copied code from GPL, AGPL, LGPL, MPL or EPL projects owned by someone else.** Even though this project is itself AGPL, CloudOver cannot relicense third-party copyleft code commercially. A single such fragment would have to be removed and rewritten from scratch.
- **If a patch does contain third-party material, you say so explicitly** in the pull request, naming the source, the author and the licence. Third-party material is not automatically rejected, but it has to be reviewed and it may need to be isolated or replaced.
- **Anything produced with a code-generation tool has been reviewed by you** for material that reproduces someone else's work.

Flagging a problem costs a review round. Not flagging one can mean an emergency release months later.

## Reporting security issues

Please do not open a public issue for a security vulnerability. Email contact@cloudover.io instead.