LICENSE
<!--
SPDX-FileCopyrightText: 2026 Vetra Automation AB and Ignalina ApS (Rickard Ernst Björn Lundin)
SPDX-License-Identifier: AGPL-3.0-only
-->
# Heimdall licensing
Heimdall uses a **dual-licensing model**. Read this file together with
[`NOTICE`](NOTICE) and [`COMMERCIAL-LICENSING.md`](COMMERCIAL-LICENSING.md).
## 1. Source code — AGPL-3.0-only
All original Heimdall **source code** is licensed under the **GNU Affero General Public
License, version 3 only** (`AGPL-3.0-only`). The complete license text is in
[`LICENSES/AGPL-3.0-only.txt`](LICENSES/AGPL-3.0-only.txt).
Heimdall — a defensive sandbox for inspecting untrusted content in pure Rust:
signed job results, a wasm host, container runners and generated allowlists.
Copyright (C) 2026 Vetra Automation AB and Ignalina ApS (Rickard Ernst Björn Lundin)
(jointly owned in equal shares, 50/50)
This program is free software: you can redistribute it and/or modify it
under the terms of the GNU Affero General Public License, version 3, as
published by the Free Software Foundation.
This program is distributed in the hope that it will be useful, but WITHOUT
ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
FITNESS FOR A PARTICULAR PURPOSE. See the GNU Affero General Public License
for more details.
You should have received a copy of the GNU Affero General Public License
along with this program. If not, see <https://www.gnu.org/licenses/>.
Because Heimdall is offered under AGPL-3.0-**only**, the "or (at your option) any
later version" clause does **not** apply.
## 2. Original documentation — CC-BY-4.0
Original Heimdall **documentation** (the prose and diagrams authored by the Heimdall
project, e.g. files under `docs/` and Markdown guides, unless a file's own header
says otherwise) is licensed under the **Creative Commons Attribution 4.0
International License** (`CC-BY-4.0`). The full text is in
[`LICENSES/CC-BY-4.0.txt`](LICENSES/CC-BY-4.0.txt).
CC-BY-4.0 applies to documentation **only**. It does **not** apply to source code.
Code embedded in documentation (examples, snippets) is offered under the code
license (AGPL-3.0-only) so it can be copied into programs.
## 3. Trademarks — not licensed here
Neither the AGPL nor CC-BY grants any rights in the **Heimdall** name, logo, or visual
identity. All such rights are reserved jointly by Vetra Automation AB and
Ignalina ApS.
## 4. Third-party components — their own licenses
Heimdall builds against third-party crates that remain under **their own licenses**.
Heimdall as a combined work is distributed under AGPL-3.0-only, but each third-party
component keeps its original license and copyright; `deny.toml` lists the
licenses allowed for dependencies and cargo-deny checks them in CI.
The Vetra Automation AB and Ignalina ApS copyright does **not** extend to third-party files.
## 5. Commercial licensing — available separately
The AGPL's network-copyleft obligations do not suit every organization. Vetra
Automation AB and Ignalina ApS, who own the original code jointly in equal shares
(50/50), can together offer the **same code under separate commercial terms**. This
is a possibility, not an automatic grant: no commercial license exists until both
co-owners and the licensee execute a written agreement. See
[`COMMERCIAL-LICENSING.md`](COMMERCIAL-LICENSING.md).
## 6. Not legal advice
This file and the accompanying legal documents are informational and are **not
legal advice**. AGPL-3.0-only imposes real obligations (including source-availability
for users who interact with the software over a network). Organizations should obtain
their own legal review before deploying, modifying, or redistributing Heimdall.
---
SPDX summary: `AGPL-3.0-only` (code) · `CC-BY-4.0` (original docs). Per-file
`SPDX-License-Identifier` headers are authoritative where present.