boxkiteRelicensing boxkite from MIT to Apache 2.0
v0.2.2 changes exactly one thing: the license. The whole project moves from MIT to Apache 2.0, with no functional code change. Both are permissive and neither is copyleft, so day-to-day use is identical. The move buys one thing MIT is silent on — an explicit patent grant.
What doesn't change
Apache 2.0, like MIT, is permissive: use boxkite, modify it, embed it in a closed-source product, self-host it, or run a hosted service on top of it — including one that competes with anything we run — with no obligation to open-source your own code. No copyleft, no source-disclosure trigger, in either license. As the README puts it: Use, modify, self-host, or build a competing hosted service on top of boxkite; there's no restriction.
What Apache 2.0 adds
MIT is a copyright license and says nothing about patents. Under it, a contributor could contribute code and later assert a patent against the people using it. Apache 2.0 closes that gap: contributors grant an explicit, royalty-free patent license to their contributions (§3), plus a retaliation clause that terminates the grant for anyone who sues over the same code. Legal clarity, not a feature you'll see in the runtime.
| MIT | Apache 2.0 | |
|---|---|---|
| Permissive | Yes | Yes |
| Copyleft / source disclosure | No | No |
| Explicit patent grant | No — silent on patents | Yes (§3), with a retaliation-termination clause |
| Requires stating changes | No | Yes — keep license/notice, mark modified files |
What it means for you
Self-hosting:nothing to do — your running pods don't care what license the source shipped under. Where it helps is procurement: Apache 2.0 is one of the most pre-cleared licenses in enterprise OSS policies, and the patent grant is usually the exact thing those reviews look for, so the relicense makes boxkite easier to clear. Contributing: unchanged — still the Developer Certificate of Origin (git commit -s), no CLA. If you've contributed before, there's nothing to re-sign.
A relicense isn't real until it reaches what people install, so v0.2.2 republishes everything to carry the Apache-2.0 metadata: the three PyPI packages (boxkite-sandbox, the Python boxkite-client, boxkite-mcp), the npm and crates.io boxkite-client, the Go SDK, and the GHCR images. The repo's LICENSE file is the source of truth; the registries just mirror it.