[Agaba-derrick]

What & Why

Returns synkronus-cli to the MIT License by removing the GPL-licensed QR dependencies.

• Replaces yeqown/go-qrcode/writer/standard with a writer that uses only Go's standard library.
• Removes fogleman/gg, golang/freetype and golang.org/x/image from go.mod and go.sum.
• Builds the QR logo into the binary and keeps the old 1/5 logo size limit.
• Saves the QR image (which contains credentials) with mode 0600, never leaves a partial file, and reports write errors.
• Updates the license text in LICENSE, the READMEs, the docs, THIRD_PARTY_NOTICES and CONTRIBUTING.

License change: synkronus-cli GPL-2.0-or-later → MIT (approved by the governance council).

Closes #545.

Type of Change

• Refactor / cleanup
• Documentation

Component(s) Changed

• synkronus-cli (command-line client)

Testing

• Added/updated tests: exact FRMLS output, QR pixels, logo size rule, file permissions, no partial file on failure.
• No GPL, AGPL or LGPL licenses among the CLI's dependencies.

Checklist

• Pre-flight checks passed (lint / format / tests)
• Related issue linked: Closes [synkronus-cli] Make MIT license compliant #545

[najuna-brian]

Thanks @Agaba-derrick, nice work.
Before merge, could we please:

• Fix the GPL wording in CONTRIBUTING.md.
• Use only the built-in logo, with the old 1/5 size limit.
• Save the QR file as 0600 and report errors when the write fails.
• Add tests that check the image pixels.
• Regenerate the SBOM to back up the “no GPL” claim.

[Agaba-derrick]

Thanks for the thorough and helpful review! All 7 requested changes have been addressed in commit 0af5df4:

1. Use only the built-in logo: loadQRLogo() now decodes defaultQRLogoBytes directly without filesystem lookups or fallback logic. Removed logoPath from qr.go and deleted the duplicate synkronus-cli/qr_logo.png.
2. Restore logo size limit: Re-introduced const logoSizeMultiplier = 5 in renderQRImage, ensuring the logo is skipped on smaller QR codes (images under ~900 px) to preserve scannability.
3. Private atomic file write & error reporting: Rendered PNG into an in-memory buffer, written via a private temporary file (0600) in the destination directory, flushed/synced, closed, and atomically renamed. Exposed w.Err() and added error checks in qr.go.
4. Image content and permission tests: Added pixel-level checks in qr_test.go for:
   • Quiet zone and corner finder patterns
   • Logo rendering on large payloads vs. skipping on small payloads
   • Mode 0600 file permissions (skipped on Windows)
   • Atomicity on write failure (no partial files left behind)
   • Exact string comparison against Formulus generateQR.ts output (including passwords with ;, :, \, and non-ASCII UTF-8 characters)
5. SBOM regeneration & notice wording: Updated THIRD_PARTY_NOTICES.md wording. Regenerated the SBOM using node scripts/sbom/generate-sboms.mjs --out sbom-dist and confirmed synkronus-cli.cdx.json contains zero GPL, AGPL, or LGPL identifiers.
6. CONTRIBUTING.md: Updated the license section to reflect repo-wide MIT licensing without the former GPL exception.
7. PR description: Updated the description with the appropriate checkboxes, the governance council license approval note, and the SBOM audit summary.

[najuna-brian]

Thanks @Agaba-derrick, all requested changes are in!
Approving. 🎉