6

What are good ways to handle software that has an ambiguous license version like 'AGPL'?

License Naming Background

FSF is considered the steward of AGPL version 3.0 (https://www.fsf.org/news/agplv3-pr , https://opensource.org/blog/steward/free-software-foundation) and provides interpretations around GNU licenses (https://www.fsf.org/blogs/executive-director/a-short-update-on-gnu-general-public-license-gpl-compatibility-questions).

GNU considers AGPLv1.0 non-open source while AGPLv3.0 is open source: https://www.gnu.org/licenses/license-list.en.html. GNU's page lists short forms for license names with AGPL and AGPLv3.0 both referring to version 3.0.

SPDX has four recognized short forms for AGPL that are all non-ambigous (https://spdx.org/licenses/): AGPL-1.0-only, AGPL-1.0-or-later, AGPL-3.0-only, AGPL-3.0-or-later.

OSI recognizes AGPL version 3.0 as open source but only recognizes the SPDX short form of AGPL-3.0-only apparently not extending its approval to AGPL-3.0-or-later. I guess it would be presumptuous to hold that another organization will always meet certain criteria when publishing a new version.

If I understand correctly from private communications, FSF and GNU do not subscribe to SPDX, in part because full license text is considered authoritative, not a short identifier.

Concrete Scenario

In an open source community around an AGPLv3.0 source code with an AFLv3.0 contribution policy (https://civicrm.org/about/license) there are a few thousand extensions. The extension system includes a parameter in an xml file for the license of the extension, but there is no validation of the value specified by a developer creating the xml file. Several dozen of these extensions specify AGPL as the license, and some of these do not include a LICENSE file in their repo. Is it reasonable to assume this software is legally AGPL version 3.0? Is it reasonable to consider it AGPL version 3.0 only, or AGPL version 3.0 or later?

Improve this question

2 Answers 2

Reset to default
8

The FSF is concerned (in my opinion, reasonably) about whether such a simple XML-based declaration of "AGPL" is sufficient to license under the AGPL -- i.e., can it reliably withstand the author retroactively claiming they did not intend to grant AGPL rights? But this case has the additional problem of which license is even referred to: the GNU Affero General Public License version 3, or the Affero General Public License version 1.

Fortunately, even if we resolve to the AGPLv1, we can upgrade to the AGPLv3 immediately. The AGPLv1 section 9 says:

If the Program does not specify a version number of this License, you may choose any version ever published by Affero, Inc.

This allows you to upgrade to the AGPLv3.

I wasn't sure, at first, if the Affero GPLv1 considered the GNU AGPLv3 as "any version ever published by Affero, Inc," but evidently Affero considers the GNU AGPLv3 as a version of the license published by Affero, so it is a valid option under this section. I arrive at this conclusion because the disused AGPLv2 explicitly says in its preamble that "It gives each licensee permission to distribute the Program... under the GNU Affero General Public License, version 3 or any later version." But the upgrade clause in AGPLv2 section 9 still only limits upgrades to versions "published by Affero, Inc" -- so I infer that the GNU AGPLv3 is such a kind of version.

Therefore, you may receive rights under any version of the AGPL based on this ambiguous "AGPL" grant.

Improve this answer
3
  • Thanks, @aspillers . Although AGPLv1.0 does not have a section 14, it has an equivalent section 8 (directory.fsf.org/wiki/License:AGPL-1.0-only). I should have looked more closely at our license's text. By not specifying a version, the author/publisher of the software allows those receiving the software to choose either AGPLv1.0 o AGPLv3.0, in other words, to treat it as either open source or not open source according to their inclination. Weird and wonderful from a legal perspective.
    – Joe Murray
    Commented Nov 29 at 18:10
  • 1
    @JoeMurray Ah, I see! I was confused about upgrades limited to versions "published by Affero Inc." but evidently that includes the GNU AGPLv3. A much happier outcome than unsolvable ambiguity!
    – apsillers ♦
    Commented Nov 29 at 18:55
  • it's unfortunate licensing is so complicated. Which is why I choose the WTFPL even if it's not broadly recognized - the intent is unambiguous
    – aaaaaa
    Commented Dec 2 at 1:38
5

What are good ways to handle software that has an ambiguous license version like 'AGPL'?

[...]

Is it reasonable to assume this software is legally AGPL version 3.0? Is it reasonable to consider it AGPL version 3.0 only, or AGPL version 3.0 or later?

It is reasonable to make those assumptions.

However, reasonable assumptions will not necessarily hold up in court; there is always a chance that the copyright holder may decide to claim that you are using their IP illegally and then sue you. Would they win? That's going to be very dependent on the circumstances of the individual case.

Or in other words: by using something which does not have clear licensing, you are taking on an unknown risk. You can attempt to quantify that risk, and the consequences of what happens if the risk does in fact occur, and weigh that up against the benefit of what you are gaining by using the unclearly licensed work(s) - but that's not something we can answer for you.

(Aside: even using a work which is clearly licensed presents a risk as there is chance the person releasing it did not have the right to do so)

Improve this answer
2
  • Thanks @Phillip Kendall. I'm a community leader trying to figure out policies and procedures to encourage our members who author and use these extensions to follow. I'm hearing it would be good to encourage clarity.
    – Joe Murray
    Commented Nov 29 at 18:13
  • 6
    I'd go further than "encourage" - if in the worst case one of your members did decide to take legal action based on an ambiguously licensed extension, the reputational damage to your community would be huge. Given that the cost of doing it right is literally minutes of work, consider rejecting any extensions which are not clearly licensed.
    – Philip Kendall
    Commented Nov 29 at 18:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.