From a “securities fraud” perspective, knowingly violating software licenses to form your core product without ever disclosing it in public filings may actually be worse than a disclosed risk of security vulnerabilities. And in case it’s not entirely clear, Trump is using this IPO to try to make bond on a $454M penalty…for committing fraud https://www.nytimes.com/2024/03/22/business/trump-media-merger-truth-social.html
As an update, Truth Social's posted Mastodon source code has not been updated since my initial post in this thread, and has seemingly not been updated since at least June of 2022 (compare: http://web.archive.org/web/20220614001551/https://opensource.truthsocial.com/mastodon-current.zip). So if they're still using and updating Mastodon internally, they're no longer complying with its AGPL license at that link.
Had a chance to look back at the SEC filings. Pleroma is not mentioned, and they continue to state that they use Mastodon and post the source code publicly for AGPLv3 compliance:
Also, if anyone has concrete information showing that Truth Social is actually using Pleroma in production now instead of Mastodon, please get in touch with compliance@sfconservancy.org via email
Any journalists interested in informing the public about the uncertainty and risks involved with this now publicly-traded social media corporation, feel free to reach out for inquiries! https://mastodon.social/@gbhnews/112162105752356614