The project is not protected from being incorporated in proprietary code

[mariha]

Suggested solution: change license to AGPL.

Things to consider

• reintegrating changes back to TR If we ever wanted to reintegrate our changes back to Trustroots, they would need to change their codebase to AGPL (or compatible) too, as MIT codebase can not contain AGPL licensed code.

• updating our codebase with upstream changes Seems like we can, on the other side, pull up changes from MIT codebase even if our license is AGPL.

How to do it?

Please read the Open Source Guides, Legal - section 6: What if I want to change the license of my project?

Switching to a new but compatible license for new releases and contributions is different from relicensing all existing contributions.

If your project’s existing license is compatible with the license you want to change to, you could just start using the new license. That’s because if license A is compatible with license B, you’ll comply with the terms of A while complying with the terms of B (but not necessarily vice versa). So if you’re currently using a permissive license (e.g., MIT), you could change to a license with more conditions, so long as you retain a copy of the MIT license and any associated copyright notices (i.e., continue to comply with the MIT license’s minimal conditions). But if your current license is not permissive (e.g., copyleft, or you don’t have a license) and you aren’t the sole copyright holder, you couldn’t just change your project’s license to MIT. Essentially, with a permissive license the project’s copyright holders have given permission in advance to change licenses.

[weex]

Thanks for posting the reasoning around switching to a less permissive license. Agree it's valuable for the project to solve this.

[mariha]

There is an organization Software Freedom Law Center which provides free legal services to free and open source projects, including licensing, copyrights, patents, trademarks, and nonprofit governance, as well as education, consulting, and training.

If anyone felt like consulting a lawyer.

[mariha]

Fixed with Trustroots/trustroots#2481 and an update/sych with the upstream repo.

See: a4afd0d6392b85ee4487f841a42f80d74dd934de