Open Source Stack Exchange is a question and answer site for people organizing, marketing or licensing open source development projects. It only takes a minute to sign up.
Sign up to join this community
The nmap project uses a custom license called the "Nmap Public Source License" based on the GPLv2 but with additional terms. They provide the text of the license with annotations on their changes here: https://nmap.org/npsl/npsl-annotated.html
Do the modifications to this license qualify it as:
It is probably not free.
Going through the points that concern me:
To avoid any misunderstandings, we consider software to constitute a "derivative work" of Covered Software for the purposes of this license if it does any of the following:
In the GPL, "derivative work" is intentionally undefined. It is a term of art in copyright law, and if you are offering a bare license (i.e. not an EULA), then it's not clear to me how you would be able to expand the scope of "derivative work" beyond its normal meaning under the applicable copyright law. If a judge holds that some particular work is not, legally, a derivative work, then they might further rule that the license is inapplicable to that work, because permission was never required in the first place. If that happened, then this part of the license would not be considered at all.
I don't think this necessarily puts it outside of the scope of "free software," but it does mean that they appear to have broken GPLv2 compatibility for no meaningful benefit.
- Is designed specifically to execute Covered Software and parse the results (as opposed to typical shell or execution-menu apps, which will execute anything you tell them to).
The trouble with this argument is that there are quite a few open source drivers and other pieces of software which have been developed by reverse-engineering proprietary software or hardware. If any and all intentional parsing automatically creates a derivative work, then much of that open source code would actually be proprietary.
By purporting to restrict the use of parsing in this manner, I think they may be in violation of freedom 0 (freedom to run the software for any purpose), but it's debatable.
- Includes Covered Software in a proprietary executable installer. The installers produced by InstallShield are an example of this. Including Nmap with other software in compressed or archival form does not trigger this provision, provided appropriate open source decompression or de-archiving software is widely available for no charge. For the purposes of this license, an installer is considered to include Covered Software even if it actually retrieves a copy of Covered Software from another source during runtime (such as by downloading it from the Internet).
I think the boldfaced part is questionable. It appears to say that, if I build a proprietary installer which downloads the latest tarball from their website, my installer is a derivative work of their software, despite the fact that I am neither hosting nor distributing any of their software myself. I very much doubt such an interpretation would be legally enforceable, as described in greater detail above.
Regardless, the whole bullet probably violates OSD/DFSG #9 (license must not restrict other software) because an installer counts as "other software" within the meaning of that rule.
- Executes a helper program, module, or script to do any of the above.
Unlike the first (quoted) bullet, this one doesn't exempt shells. I sincerely hope that this is an oversight, but regardless, it needs to be much more specific, or else this is getting perilously close to the Server-Side Public License's infamous "Service Source Code" clause, which is widely regarded as non-free in part because it is extraordinarily vague and expansive. This bullet has the same problem. It could conceivably apply to anything in the same technology stack.
It is certainly not GPLv2-compatible.
In addition to all of the issues identified above, section 8 (Termination for Patent Action) is a "further restriction" within the meaning of GPL section 6. This is the same problem GPLv2 has with the Apache License.
