GPL vs MIT vs Apache: Which Licence Fits You?

GPL vs MIT vs Apache: wetin each licence dey ask from you

GPL, MIT and Apache 2.0 dey answer the same question for different ways: wetin you owe other people when you pass the software give dem? MIT just ask for copyright notice, nothing more. Apache 2.0 ask for that notice plus patent agreement between everybody wey touch the code. GPL ask you to publish the source code of wetin you build on top, under the same licence wey you receive.

This one fit look like question for lawyers until the day project wey you dey run change licence and split into two. Then e become operations question. You get two package repositories to choose from, and client libraries wey stop to communicate with each other. This guide na about the licences and how dem work, not about the movement wey produce dem, so every section stop for where e concern you: the person wey gats run the upgrade.

Why GPL dey exist: printer wey nobody fit repair

Around 1980, MIT Artificial Intelligence Lab receive one Xerox 9700 laser printer. The lab don patch software for one earlier printer, so e fit tell you when your job jam. For the new one, source code no dey available, and dem refuse the request because of nondisclosure agreement. Richard Stallman, wey be programmer for the lab that time, see that refusal as the normal case, no be just one bad day. E announce GNU project on 27 September 1983.

Copyleft na copyright law wey dem use build am, no be something against copyright. By default, you no get right to copy another person code at all. GPL give you that right with one condition: if you give the program to another person, you must give the person the source under the same terms, so dem fit do wetin the lab no fit do. Dem fit enforce the condition because without the licence, you no get permission from the beginning.

Stallman first write licence for GNU Emacs, then generalise am into GPL version 1 on 25 February 1989. GPL version 2 follow for June 1991, and na still the licence for most system software wey you dey run. Lesser GPL come later for libraries, so program fit link to copyleft library under any licence without making that program enter GPL.

One detail dey decide how GPL go affect person wey dey host service by himself. The obligation start when distribution happen, no be when person use the software. You fit modify GPL program, run am for your own server, serve the public with am, and owe nobody anything, because you never give anybody a copy. Na this gap make AGPL come exist.

Permissive tradition: BSD, then MIT

Berkeley choose different way. Computer Systems Research Group release their Unix work under licence wey ask make people keep copyright notice and e no accept any warranty. The original version get four clauses. The fourth one, wey be the advertising clause, require acknowledgement of the University for every advertising material wey mention features of the software. This kind arrangement no fit scale. Stallman count 75 separate acknowledgements for 1997 version of NetBSD. UC Berkeley withdraw the clause on 22 July 1999, for letter wey William Hoskins from its Office of Technology Licensing write.

Wetin remain na the 3-clause BSD licence. E add ban on using contributors' names to endorse your product. The 2-clause version remove even that ban. MIT licence text come from MIT for the 1980s, where e cover the X Window System. For practical use, e do the same work as 2-clause BSD.

The reasons no be the same. Public money fund the university, so e want make companies and everybody use its work. GNU project want commons wey nobody fit close. Both positions dey honest, and both get failure mode. Person fit take permissive code private, and you no get anything back. Companies fit reject copyleft code because their lawyers no go accept the condition.

Berkeley teach another lesson, and na this post dey return to am again and again. AT&T's Unix System Laboratories sue Berkeley Software Design for 1992 over the BSD code, and the case settle for early 1994. For two years, nobody fit know for sure whether BSD safe to build on. Adoption slow down while Linux grow. Legal uncertainty dey stop adoption faster than missing feature.

Why Apache 2.0 add patent grant

The first licence wey Apache Group use na derivative of BSD 4-clause, and e get the same advertising problem. Version 1.1 for 2000 remove that clause. Version 2.0, wey dem publish for January 2004, na complete rewrite, no be small patch.

The important addition na patents. MIT and BSD no talk anything about patents at all. Contributor fit give you clear copyright permission for their code and still hold patent wey cover wetin the code dey do, then sue the people wey use am. Apache 2.0 close that gap: every contributor grant patent licence wey cover their contribution, and anybody wey sue claim say the work infringe their patents lose their own patent licence for that work. The threat dey mutual, so for practice nobody go fire lawsuit.

The remaining parts of 2.0 na administrative matters, and na why companies like am. E define NOTICE file, so attribution get one place instead of scattering through the tree. You fit apply the licence by reference instead of pasting am inside every source file. Explicit terms cover contributions. Trademarks no dey included. When legal team review Apache 2.0 dependency, every question wey dem wan ask don already get answer for the text. So approval become routine, and na mostly this "corporate default" mean.

Wetin GPLv3 change, and why Linux remain for GPLv2

TiVo release one video recorder wey dey run Linux and publish the kernel source, exactly as GPLv2 require. The hardware then check cryptographic signature during boot and refuse to run kernel wey e no recognise. You fit read the source, change am, and compile am. But you no fit run am for the device wey e come from. The licence letter follow, but dem defeat the purpose, and people begin call this practice tivoisation.

GPL version 3, wey dem publish on 29 June 2007, answer this matter directly. When you convey the binary inside consumer device, you must also supply the "Installation Information": the keys or instructions wey person need to install modified version and make e run. Version 3 also add explicit patent grant, terms wey dem write in response to the Microsoft and Novell patent agreement of November 2006, and one-way compatibility with Apache 2.0.

Linux no follow. The kernel na GPL version 2 only, with no "or any later version" escape clause, and e COPYING file talk so. Linus Torvalds publicly object to the anti-tivoisation terms for signed hardware. The practical barrier pass the disagreement: the kernel get thousands of copyright holders, so nobody fit gather the permissions wey relicence need, even if everybody want am. That single fact na the strongest protection wey project fit get, and e good make you remember am when one company own project.

The other 2007 licence matter pass for your side. The GNU Affero GPL version 3, wey dem publish for November of the same year, extend the source obligation to people wey interact with the program through network. If you run modified AGPL service for public, you owe those users the source. Na why plenty self-hosted web software dey use AGPL. Nextcloud na one example, and if you dey compare self-hosted alternatives to Nextcloud, the licence line for each candidate repository go tell you more about the next five years than the feature list.

Which licences you fit actually combine?

Compatibility dey work one way, from permissive go copyleft.

• MIT and BSD code fit enter anything, including closed product.
• Apache 2.0 code fit enter GPLv3 project, and the combined work go be GPLv3.
• Apache 2.0 code no fit enter GPLv2-only project. Its patent termination and indemnity terms na extra conditions wey GPLv2 no allow you add. FSF and ASF both publish this conclusion.
• You no fit move GPL code go permissive licence by yourself. Na only copyright holders fit do am, and that one bring you back to the question of who dem be.

Di era relicensing: SSPL, BUSL, and wetin dem no be

The trigger na commercial matter. Company get copyright for one product, cloud provider dey sell am as managed service for large scale and contribute small or nothing back, then company change the licence to stop that. Redis Labs make the first clear move for August 2018 when e add Commons Clause on top of Apache 2.0 for some of its modules. MongoDB follow on 16 October 2018 by moving from AGPLv3 to the Server Side Public License.

SSPL na AGPL wey dem rewrite one section for. If you offer the program to third parties as a service, you must publish the source of everything wey you use to offer am, including the management and orchestration software around am. That obligation no get clear boundary, and no court don test am. OSI never approve the licence, and MongoDB withdraw its application for March 2019. Debian don already talk for December 2018 say SSPL software no belong for its archive, and Fedora rule for January 2019 say the licence no free. After that, Red Hat remove MongoDB from Fedora and from Red Hat Enterprise Linux. Na this be the direct result of relicensing: the distribution stop packaging the software, so your upgrades now dey come from vendor repository according to the vendor schedule.

Business Source License na different kind arrangement. E come from the MariaDB founders, and version 1.1 date from 2017. E no be copyleft and e no be open source. The source dey public, and use dey free except for the use wey vendor remove from the permission. Normally, na running competing hosted service. Every release automatically change to real open source licence on a change date wey no fit pass four years after that release. The licence wey e change to must dey compatible with GPLv2. HashiCorp move Terraform and its other products to BUSL 1.1 on 10 August 2023. Outline use am too, and this one important if you dey choose from self-hosted Notion alternatives: you fit run am for your own team, but you no fit build service on top of am.

No be say either licence dey deceive anybody. Both talk plainly say dem be source available. Neither one be open source according to OSI definition, and na you go bear the difference, not the cloud provider wey the licence target.

OpenSearch: licence fork cost wey operator go bear

Elastic announce for 14 January 2021 say Elasticsearch and Kibana go comot from Apache 2.0 go use SSPL or Elastic License, starting from release 7.11. Version 7.10.2 na the last Apache 2.0 release. About one week later, AWS talk say e go create and maintain Apache 2.0 fork for both. Dem name the fork OpenSearch on 12 April 2021, and rename Kibana to OpenSearch Dashboards. OpenSearch 1.0 become generally available on 12 July 2021, built from Elasticsearch 7.10.2 and Kibana 7.10.2.

See wetin e cost the people wey dey run clusters. Package names and repositories change. Every Kibana reference for runbook become OpenSearch Dashboards. Plugin names move. Then the split enter application code: from version 7.13 of Elastic official client libraries, the client check wetin e connect to and refuse to continue if the thing no be Elasticsearch, while e report say the server na unknown product. Licence decision for company wey you no work for turn to failing call inside your own application.

The matter turn two more times after that. Elastic add AGPLv3 as third licence option on 29 August 2024, so current Elasticsearch don become OSI-approved open source again. On 16 September 2024, AWS transfer OpenSearch to OpenSearch Software Foundation, wey Linux Foundation host. This give the fork governance home wey no be one company. Five years after the split, both projects be open source, both dey maintained, and OpenSearch dey 3.x series as of August 2026.

The ending na the lesson. The licence come back, but the fork remain. Once ecosystem get two versions of everything, reversing the paperwork no go merge dem again.

The number wey decide how much relicence go pain na the gap between the announcement and stable fork wey you fit actually deploy.

[
  {
    "label": "Elasticsearch to OpenSearch 1.0",
    "gap_to_stable_fork": 179
  },
  {
    "label": "Terraform to OpenTofu 1.6.0",
    "gap_to_stable_fork": 153
  },
  {
    "label": "Redis to Valkey 7.2.5",
    "gap_to_stable_fork": 27
  }
]

Each gap dey count from vendor public announcement to the fork first stable release, using the dates wey dey below. OpenSearch 1.0 take 179 days, because dem need rename and rebuild the fork, and no earlier fork dey to copy from. OpenTofu take 153 days. Valkey take 27 days, because e fork Redis 7.2.4 and keep the protocol and on-disk format identical. The useful direction be say credible fork fit now arrive within weeks, with foundation and paid maintainers attached from the first day.

Valkey and OpenTofu: na same pattern, but faster

Redis Ltd move Redis from the 3-clause BSD licence go choice between RSALv2 or SSPLv1 on 20 March 2024. Eight days later, Linux Foundation announce Valkey, wey fork from Redis 7.2.4 and remain under BSD 3-clause. Valkey 7.2.5 show for 16 April 2024 with the same protocol and the same data files, so for most operators, na package name migration. Redis later add AGPLv3 as third option for Redis 8 in May 2025. This make am open source again according to OSI definition, while Valkey continue under im own governance. The pattern resemble Elasticsearch well.

Terraform follow the same path, but e get one extra chapter. OpenTofu fork the last Mozilla Public License 2.0 release, join Linux Foundation for September 2023, and release 1.6.0 on 10 January 2024. On 3 April 2024, HashiCorp lawyers send the project cease and desist letter. Dem claim say code from BUSL-licensed Terraform release enter the fork. OpenTofu publish detailed response on 11 April 2024 and deny the claim. E trace the disputed code go the MPL-licensed history wey both projects share. Nothing else follow publicly. The real risk for that matter na the one wey you suppose remember: accusation alone fit stop adoption for one quarter. Na the same effect Berkeley lawsuit get thirty years earlier.

No be every fork dey start with licence. Forgejo fork from Gitea for 2022 after Gitea development move under company control. That one na governance dispute, no be licensing dispute. Forgejo remain under MIT through im version 8 series. Then e relicense to GPLv3 or later from version 9.0 for 2024, so nobody fit pull the work back into commercially controlled product. If you dey compare self-hosted Git server options, that pair na the clearest live example of one codebase and two different philosophies.

The test to run before you adopt anything

Make four questions before you install anything, no be after.

1. Who get the copyright? You need permission from every copyright holder before you fit change the licence, so project wey get hundreds of independent contributors and no assignment no fit realistically change licence. If one company own everything, dem fit change the licence for board meeting.
2. CLA dey, and wetin e grant? Contributor licence agreement wey allow the company change your contribution licence under any terms wey e like na the exact mechanism behind every relicence wey we mention above. DCO (developer certificate of origin), the sign-off line wey Linux kernel adopt for 2004, no transfer any rights at all. CLA wey foundation hold safer pass one wey company hold, because dem fit sell the company.
3. Who own the trademark? Elastic keep the Elasticsearch name, so the fork need change im name, and dem need rewrite every runbook wey mention Kibana.
4. How much relicence go cost you specifically? Count the data format, the client libraries, the configuration wey you go rewrite, and whether compatible fork dey already.

Two commands go answer part of this within seconds.

head -n 12 /usr/share/doc/bash/copyright
git log --oneline -- LICENSE COPYING LICENSE.md

Every Debian and Ubuntu package ship with file for /usr/share/doc/<package>/copyright. The file record the licence of the version wey you install, no be the licence wey the project dey use today. For bash on Ubuntu 24.04, that file name GNU General Public License version 3. Run the second command inside source checkout, and you go see the history of the licence file itself. If commit dey there within the last two years, e worth reading before you build anything on the project. If the command print nothing, the repository name im licence file another thing, so list the root directory and check.

No licence fit protect you from every outcome, and if you choose project by ideology, na so people dey end up surprised. Prefer projects wey copyright spread across many people or foundation hold am, and keep your data for format wey you fit export. Then find out which fork you go move to, and write the name down before you need am. If you apply this check to every candidate, e go cost less than one hour, and na this one separate upgrade from migration when you dey decide wetin to self-host for 2026.

FAQ

MIT licence na the same thing as BSD licence?

For practical purpose, MIT dey match 2-clause BSD licence: keep copyright notice and warranty disclaimer, then you fit do wetin you like, including building closed product. 3-clause BSD licence add one thing: e ban you from using contributors' names to endorse your product without permission. The older 4-clause version also require acknowledgement for advertising material, but UC Berkeley withdraw that clause on 22 July 1999, so almost nothing current still carry am.

I fit put Apache 2.0 code inside GPLv2 project?

No. Apache 2.0 add conditions wey GPLv2 no allow you add, especially the patent termination clause, so one combined work no fit satisfy both licences at the same time. FSF and ASF both publish this conclusion. The other direction dey work: you fit include Apache 2.0 code for GPLv3 project, and the result go be GPLv3. Na this same reason Apache 2.0 code no fit merge into Linux kernel, wey na GPL version 2 only.

SSPL na open source licence?

No, and this answer get practical consequences. OSI never approve am, and MongoDB withdraw its application for March 2019. Debian talk for December 2018 say SSPL software no belong for its archive, and Fedora rule for January 2019 say the licence no be free. After that, Red Hat remove MongoDB from Fedora and Red Hat Enterprise Linux. For you, this mean say package wey your distribution dey maintain before now dey come from vendor repository, according to vendor support timetable. Business Source License too na source available rather than open source, although each release convert to open source licence within four years.

Licence change apply to the version wey I dey run already?

No. Licence wey release grant no fit withdraw from copies wey dem don publish already, and na exactly why forks dey possible. OpenSearch build from Elasticsearch 7.10.2, the last release wey Elastic publish under Apache 2.0. Wetin you lose na the future, because the next security fix go come under the new terms. Pinning the last permissively licensed version fit buy you few months, but e no be plan.