Clarify CallWaveKit licensing for 0.4.1

CHANGELOG.md

@@ -4,6 +4,18 @@ All notable changes to CallWaveKit are recorded here. The project follows
 [Semantic Versioning](https://semver.org/spec/v2.0.0.html); until 1.0 a minor
 bump may contain breaking changes, and each one is listed below.
 
+## [0.4.1] - 2026-08-04
+
+### Licensing
+
+- Clarified that CallWaveKit source is MIT while the bundled public PJSIP
+  binary is GPL-2.0-or-later and remains separately licensed.
+- Added the CallWaveKit maintainer's copyright without removing the retained
+  copyright notice from earlier MIT-licensed work.
+- Updated the CocoaPods metadata and added `LICENSING.md` so package consumers
+  see both licences before distribution. This release contains no runtime or
+  public API changes.
+
 ## [0.4.0] - 2026-08-04
 
 ### Added

CallWaveKit.podspec

@@ -1,14 +1,17 @@
 Pod::Spec.new do |spec|
   spec.name = 'CallWaveKit'
-  spec.version = '0.4.0'
+  spec.version = '0.4.1'
   spec.summary = 'Incoming SIP SDK for iOS intercoms.'
   spec.description = <<-DESC
     CallWaveKit owns a PJSUA runtime, SIP registration, incoming audio calls,
     CallKit coordination, PushKit wake-up handling, two-way audio, RTP mute,
     DTMF, TURN, IPv6 and credential-free diagnostics.
   DESC
   spec.homepage = 'https://github.com/PetrShtuka/CallWaveKit'
-  spec.license = { type: 'MIT', file: 'LICENSE' }
+  spec.license = {
+    type: 'MIT AND GPL-2.0-or-later',
+    file: 'LICENSING.md'
+  }
   spec.author = { 'Petr Shtuka' => 'pitmailcom@gmail.com' }
   spec.source = {
     git: 'https://github.com/PetrShtuka/CallWaveKit.git',

LICENSE

@@ -1,6 +1,7 @@
 MIT License
 
 Copyright (c) 2019 Flavien SICARD
+Copyright (c) 2026 Petr Shtuka
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

LICENSING.md

@@ -0,0 +1,44 @@
+# Licensing CallWaveKit
+
+The CallWaveKit distribution contains components under separate licences. The
+MIT licence for CallWaveKit does not replace or override the licence of the
+bundled PJSIP binary or its third-party components.
+
+## CallWaveKit source
+
+The source code, documentation, examples and build scripts authored for
+CallWaveKit are available under the MIT License in `LICENSE`. Existing
+copyright notices from earlier MIT-licensed work are retained alongside the
+CallWaveKit maintainer's copyright.
+
+SPDX identifier: `MIT`.
+
+## PJSIP binary
+
+`Vendor/PJSIP.xcframework` and the checksum-pinned SwiftPM binary release are
+built from PJSIP 2.17. They are not covered by the CallWaveKit MIT License.
+PJSIP is offered by its authors under GPL version 2 or any later version, or
+under a separately arranged proprietary licence.
+
+The public binary distributed with CallWaveKit uses the GPL option. The full
+licence text is in `Vendor/PJSIP-COPYING`, build provenance is recorded in
+`Vendor/PJSIP-BUILD.txt`, and the upstream terms are documented at
+<https://www.pjsip.org/licensing.htm>.
+
+SPDX identifier: `GPL-2.0-or-later`.
+
+Distributing an application linked with this GPL binary requires compliance
+with the GPL for the resulting program. An application that cannot comply with
+the GPL must obtain an appropriate alternative PJSIP licence directly from
+Teluu. Installing CallWaveKit through SwiftPM or CocoaPods does not grant or
+transfer a proprietary PJSIP licence.
+
+## Other bundled software
+
+PJSIP includes third-party software under additional terms. The corresponding
+notices and licence texts are in `Vendor/ThirdPartyLicenses`. Applications must
+also comply with the terms of the components actually enabled in their build.
+
+This document describes the components shipped by this repository. The actual
+licence texts and any separately signed commercial agreement control if this
+summary conflicts with them.

README.md

@@ -15,14 +15,14 @@ deliberately narrow: **CallWaveKit does not place outgoing calls.**
 
 ## Licensing: read this before shipping
 
-CallWaveKit itself is MIT. **The PJSIP binary it bundles is not.** PJSIP is
-GPLv2 or a separate commercial licence from Teluu, and linking it into a
-closed-source application without that commercial licence puts you in breach of
-the GPL.
+CallWaveKit source is MIT. **The PJSIP binary it bundles is not.** The public
+binary is GPL-2.0-or-later. Applications distributing that binary must comply
+with the GPL for the resulting program or obtain an appropriate alternative
+PJSIP licence directly from Teluu.
 
-Review `Vendor/PJSIP-COPYING` and `Vendor/ThirdPartyLicenses`, and settle the
-licence before you ship. This applies to every consumer of this package,
-however it is installed.
+Read [LICENSING.md](LICENSING.md), `Vendor/PJSIP-COPYING` and
+`Vendor/ThirdPartyLicenses` before distribution. Installing the package does
+not grant or transfer a proprietary PJSIP licence.
 
 ## Requirements
 
@@ -36,13 +36,13 @@ however it is installed.
 ### Swift Package Manager
 
 In Xcode: **File → Add Package Dependencies**, enter
-`https://github.com/PetrShtuka/CallWaveKit.git`, pick version `0.4.0` or later,
+`https://github.com/PetrShtuka/CallWaveKit.git`, pick version `0.4.1` or later,
 and add the `CallWaveKit` product to your application target.
 
 Or in a `Package.swift`:
 
 ```swift
-.package(url: "https://github.com/PetrShtuka/CallWaveKit.git", from: "0.4.0")
+.package(url: "https://github.com/PetrShtuka/CallWaveKit.git", from: "0.4.1")
 ```
 
 The product vends two modules: `CallWaveKit` (the Objective-C API) and
@@ -63,7 +63,7 @@ To track the repository directly instead of the published pod — an unreleased
 fix, say — point at the tag:
 
 ```ruby
-pod 'CallWaveKit', git: 'https://github.com/PetrShtuka/CallWaveKit.git', tag: '0.4.0'
+pod 'CallWaveKit', git: 'https://github.com/PetrShtuka/CallWaveKit.git', tag: '0.4.1'
 ```
 
 ## Host application settings
@@ -215,7 +215,7 @@ SwiftPM releases use an immutable binary asset so package consumers do not
 download the 21 MB framework through Git history. To package a rebuilt binary:
 
 ```sh
-./Scripts/package-pjsip-release.sh 0.4.0
+./Scripts/package-pjsip-release.sh 0.4.1
 ```
 
 The script prints the archive checksum and the `.binaryTarget(url:checksum:)`
@@ -224,5 +224,6 @@ bundled third-party licences.
 
 ## License
 
-CallWaveKit is MIT — see [LICENSE](LICENSE). The bundled PJSIP binary is not;
-see [Licensing](#licensing-read-this-before-shipping) above.
+CallWaveKit source is MIT — see [LICENSE](LICENSE). The bundled PJSIP binary is
+GPL-2.0-or-later or requires a separately arranged proprietary licence. See
+[LICENSING.md](LICENSING.md) for the component-by-component terms.

RELEASING.md

@@ -67,14 +67,14 @@ CocoaPods fail with a version mismatch, because `spec.source` resolves
 
 ```sh
 git checkout main && git pull
-git tag -a 0.4.0 -m "CallWaveKit 0.4.0"
-git push origin 0.4.0
+git tag -a 0.4.1 -m "CallWaveKit 0.4.1"
+git push origin 0.4.1
 ```
 
 Verify the tag and the podspec agree before going further:
 
 ```sh
-git show 0.4.0^{commit}:CallWaveKit.podspec | grep spec.version
+git show 0.4.1^{commit}:CallWaveKit.podspec | grep spec.version
 ```
 
 ### 4. Validate against the published tag
@@ -114,7 +114,7 @@ needs.
 it. To attach it to a release instead:
 
 ```sh
-./Scripts/package-pjsip-release.sh 0.4.0
+./Scripts/package-pjsip-release.sh 0.4.1
 ```
 
 The script prints the archive's checksum and the matching

SECURITY.md

@@ -16,6 +16,7 @@ SIP messages; do not enable them in App Store or TestFlight builds.
 
 ## PJSIP licence
 
-The repository bundles PJSIP under GPLv2. A closed-source application needs a
-commercial licence from Teluu. Each application team must verify its licence
-before distribution.
+The public PJSIP binary is GPL-2.0-or-later. Applications distributing it must
+comply with the GPL for the resulting program or obtain an appropriate
+alternative licence directly from Teluu. See `LICENSING.md` for the complete
+component-level notice.

Scripts/package-pjsip-release.sh

@@ -6,8 +6,8 @@
 # checkout pays for it, so a tagged release should attach the zip instead and
 # Package.swift should point at that URL:
 #
-#   ./Scripts/package-pjsip-release.sh 0.4.0
-#   gh release upload 0.4.0 build/PJSIP.xcframework.zip
+#   ./Scripts/package-pjsip-release.sh 0.4.1
+#   gh release upload 0.4.1 build/PJSIP.xcframework.zip
 #
 # Then replace the `path:` binary target in Package.swift with the printed
 # `url:`/`checksum:` pair. Keep the local `path:` variant on a branch you