Record the operator's answer: Owl's pinned copy stays in the private artifact store (issue 345, ADR 0316)

2026-10-12 12:29:07 +02:00
parent 2059175b89
commit db92ca73ff
1 changed files with 4 additions and 2 deletions
@@ -67,8 +67,10 @@ Owl is an outside vendor's add-on under a proprietary licence: it may be loaded
 and may not be copied to anyone else. The vendor serves only its newest version, at one address.

 1. The manifest pins Owl by version and the sha256 of the vendor's xpi.
-2. The builder fetches it and keeps it in the artifact store, which reaches only the operator's own nodes. It is
-   never committed to a repository.
+2. The builder fetches it once and keeps it in the mesh's private artifact store, used only on the operator's own
+   machines. It is never committed to a repository, and a node never fetches it from the vendor. Whether such a
+   private copy is within the licence's ban on copying to third parties was the operator's call, made on
+   2026-10-12.
 3. The node-engine places it in the installation directory.
 4. The module's `policies.json` installs it through `ExtensionSettings`, as `force_installed`, from the placed
   file (a `file://` URL), with `updates_disabled`. Betterbird installs it into every profile, and the person