Open source software history: from GPL to SSPL

Wetin open source software be, and where e come from

The history of open source software mostly na the history of the licences wey govern am, because na licence alone dey decide wetin you fit do with code wey another person write. People dey share code openly long before anybody write those licences down. The sharing stop when code turn product, and dem write the licences so sharing go stand for court.

Na the short version be that. The long version matter because the software wey you dey run for server today still carry the marks of those decisions. Some of those decisions happen for 1983. Some happen last year, and na dem make some applications for our self-hosting guides now come in two versions with different names.

Software bin dey share am before dem start sell am

For 1950s and 1960s, software dey come together with machine. IBM dey ship source code with its systems, and user groups like SHARE, wey dem found for 1955, dey pass programs around for tape. Two things stop this arrangement. IBM announce for 1969 say e go price software separately from hardware, and this create market for software by itself. Then law catch up. The Computer Software Copyright Act of 1980 confirm say programs fit be copyrightable works for United States. After 1980, code wey you no write dey closed by default, so to share am need written permission from the author.

The Homebrew Computer Club and the Open Letter to Hobbyists

The Homebrew Computer Club hold im first meeting for March 1975, for one garage for Menlo Park, California. Members bring hardware and paper tape, and copying na part of the meeting. Altair BASIC, wey Bill Gates and Paul Allen write, pass round the room for copied tape. For February 1976, Gates answer for the club newsletter with "An Open Letter to Hobbyists".

As the majority of hobbyists must be aware, most of you steal your software.

E write say fewer than one in ten Altair owners pay for BASIC, and say the computer time wey dem use write am get value pass 40,000 dollars. The whole modern argument don already dey inside that letter. Copying software no cost anything and e help everybody wey copy am. But writing am still cost somebody one year of im life. Every licence wey we describe below na attempt to answer both facts at the same time.

GNU for 1983, and GPL as legal invention

Richard Stallman announce GNU for September 1983 for Usenet, wey be newsgroup network wey people dey use before web come. GNU mean "GNU's Not Unix". The plan na complete Unix-compatible system wey anybody fit copy and change.

Free Unix! From this Thanksgiving, I go write complete Unix-compatible software system wey dem call GNU (for Gnu's Not Unix), and give am free to everybody wey fit use am.

Free Software Foundation (FSF) follow for 1985. E Free Software Definition list four freedoms, wey number start from zero: run the program for any purpose, study and change am, redistribute copies, and distribute your changed versions. Freedom 1 need the source code, because nobody fit study binary for any practical way. "Free" here mean freedom, no be price. FSF own phrase na free as in free speech, no be free beer.

The manifesto no be the invention. Na the licence be the invention. GNU General Public License (GPL) use copyright to require sharing instead of using am to prevent sharing. You receive the four freedoms under one condition: anybody wey you pass the software give must receive the freedoms too, together with the source. Stallman call this copyleft. E first ship with GNU Emacs for 1985, become GPL version 1 for 1989, and version 2 for June 1991.

GPL dey work because e stand on copyright law, no be against am. Without licence, you no get right to distribute another person code at all. GPL grant you that right and attach conditions to am. So vendor wey ships modified GPL code inside router and refuse to hand over the source no dey break promise. Dem dey infringe copyright, and copyright holder fit carry dem go court. Na why enforcement dey possible at all, from Harald Welte's gpl-violations.org cases for the 2000s reach Software Freedom Conservancy suit against Vizio, wey dem file for 2021. The suit argue say person wey buy the television fit demand the source too.

Linux complete the system

By 1991, GNU project don get the compiler, the C library, the shell, and most of the tools. E no get working kernel, because GNU own kernel, the Hurd, take far pass wetin dem plan. For August 1991, one student for Helsinki post for the comp.os.minix newsgroup:

I dey build one (free) operating system (na just hobby, e no go big and professional like gnu) for 386(486) AT clones.

Linux 0.01 show for September 1991 under one licence wey Linus Torvalds write by himself. The licence no allow people sell am. For early 1992, e replace am with GPLv2, and since then e don talk say na one of im best decisions. The licence na wetin make company contribution safe: company fit assign engineers to kernel, knowing say competitor no fit take those improvements keep private.

Free Unix don already dey for Berkeley. The reason Linux, instead of BSD (Berkeley Software Distribution), become the default free Unix partly na lawsuit. Unix System Laboratories sue Berkeley Software Design for 1992, and the case continue until early 1994. During those two years, BSD systems carry legal risk, while Linux carry none. Na for that period users begin come. FSF dey ask people to call the combined system GNU/Linux, because Linux na the kernel and most of the tools around am come from GNU. Most people dey call am Linux. Both names point to the same collection of software.

1998: open source rebrand, and the split wey never heal

For January 1998, Netscape announce say e go publish source code of e browser. Na the biggest company wey don do this kind thing that time, and e expose one practical problem. The phrase "free software" for English sound like "software wey no cost anything", and executives understand am exactly like that. One group meet for Palo Alto for February 1998 to find better term, and Christine Peterson propose "open source". Within weeks, Eric Raymond and Bruce Perens set up Open Source Initiative (OSI). E adopt Open Source Definition, wey dem adapt from Debian Free Software Guidelines wey Perens write for 1997.

Open Source Definition get ten criteria. Two of dem dey decide most modern arguments: source must dey available, and licence no suppose restrict who fit use the program or wetin dem fit use am do. Licence wey talk say "you may not offer this as a commercial service" fail the test, no matter wetin else e allow. Hold this sentence well. Na the line wey today's source-available licences dey cross.

The split wey open for 1998 na about reasons, no be about which licences acceptable. FSF argument na ethical: user wey no fit change the program no control e own computer. OSI argument, wey Raymond explain to business for e essay "The Cathedral and the Bazaar", na practical: open development dey produce better software, and company fit act based on that. Stallman reply, "Why Open Source Misses the Point of Free Software", still dey published for gnu.org, and e never accept the newer term. Perens, wey help create am, resign from OSI board for 1999, say the movement don drift comot from free software.

E good make we precise about how small the practical gap be. FSF list of free licences and OSI list of approved licences agree on almost everything, including GPL, MIT, Apache 2.0 and BSD. Writers wey need both meanings together dey use FOSS (free and open source software) or FLOSS (free/libre and open source software).

How companies learn to release code

Red Hat listing for stock market for 1999 show say money dey for support and packaging, no be for selling copies. IBM commit one billion dollars to Linux for 2001. Microsoft's chief executive call Linux "a cancer" for 2001. But the same company join Linux Foundation as platinum member for 2016, then buy GitHub for 2018 for 7.5 billion dollars in stock. IBM buy Red Hat for 2019 for 34 billion dollars. None of these mean say dem change mind about licences. Na where money dey change. When operating system na shared cost, e expensive to maintain your own one. Every vendor prefer compete for the layer above am.

Corporate ownership fit also push things for the opposite direction. When Oracle buy Sun for 2010, e inherit MySQL and OpenOffice.org, and both communities comot. MariaDB grow from MySQL, while dem fork LibreOffice from OpenOffice.org for September 2010. Fork na the only real vote wey user community get, and na the licence make that vote possible.

Why some apps wey you self-host don get forks

From 2018 go, some companies change the terms for software wey dem don already release. The situation dey similar every time. One company employ almost all the developers, while one much bigger cloud provider sell the same software as managed service. The smaller company then decide say the licence na why e no fit compete.

• MongoDB adopt the Server Side Public License (SSPL) for October 2018. SSPL talk say if you offer the software to other people as service, you must publish the source code of everything wey you use provide that service. OSI no accept am as open source, and MongoDB withdraw am from review for 2019.
• Redis add usage restrictions to some modules for 2018 and 2019. Later, for March 2024, e move the main server to dual source-available terms with version 7.4. A fork of the last BSD-licensed release show up some days later as Valkey, under the Linux Foundation, with backing from Amazon, Google and Oracle among others. For May 2025, Redis add the Affero General Public License version 3 (AGPLv3), wey OSI approve, as a third option for Redis 8.
• Elastic move Elasticsearch and Kibana comot from Apache 2.0 for January 2021, to dual SSPL and Elastic License terms. Amazon fork OpenSearch. Elastic add AGPLv3 as a third option for August 2024, and transfer OpenSearch go the Linux Foundation for September 2024 as the OpenSearch Software Foundation.
• HashiCorp move Terraform and its other tools go the Business Source License (BUSL) for August 2023. BUSL no be open source licence while e dey active, because e forbid competing production use. Each release go convert to open licence for one fixed date, four years later for Terraform. OpenTofu fork happen within weeks, and e dey under the Linux Foundation too now.

Both sides get valid points, and none of dem dey act in bad faith. Company wey dey pay fifty salaries while much bigger firm dey resell its work get problem wey goodwill no fit solve. User wey build on Apache 2.0 terms and wake up under new terms get problem too, and nobody ask the user first. Notice wetin happen next for two of these cases. After the forks take hold, Elastic and Redis both add strong copyleft back. Copyleft answer the original complaint, because AGPLv3 require service provider to publish the changes wey e dey run. As of August 2026, both projects and both forks still dey active. Na this kind outcome the licences design to allow.

Wetin fit change a licence

Project fit only change licence if one party control copyright for everything inside am. Companies dey get this control for two ways. Copyright assignment transfer ownership of every contribution go the company. Contributor licence agreement (CLA) leave you as the owner, but e give the company rights wey broad enough to change the licence for your work. Usually, person sign either one by clicking link wey bot post for your first pull request.

Linux no get CLA. Contributions dey come under GPLv2 with Developer Certificate of Origin, and copyright dey spread across thousands of people and companies. Nobody fit change Linux licence, because nobody fit ever gather all those signatures. This same protection apply to any project wey get plenty independent copyright holders. E stronger pass promise, because na fact about who own wetin.

So, the question to ask about software wey you plan depend on no be whether e be open source today. Na who fit change the licence, and whether dem fit do am alone.

Wetin foundation actually dey give you

Foundation dey hold the assets and fix the rules for how dem go dey make decisions. Apache Software Foundation, Linux Foundation, Cloud Native Computing Foundation wey dey inside am, and Software Freedom Conservancy each dey do one version of this work. Foundation no be neutral just because e be foundation. Members dey pay for their seats, and most people wey dey work full time on big foundation project, member companies dey pay dem. Wetin you get dey narrower, but e still get plenty value: trademark and release process no belong to one vendor, so no single company fit make the project private.

Trademark na the part wey people dey miss. Code dey under licence. Name na trademark, and code licence no cover trademark. You fit always fork the code. You usually no fit continue to use the name. Na why the forks for this story dey called Valkey, OpenSearch, OpenTofu and Forgejo.

Di maintainer problem

Modern infrastructure dey rest on projects wey get one or two maintainers wey no dey collect pay, and na when dem fail e dey show this matter clearly. The Heartbleed bug for OpenSSL in 2014 affect library wey carry big part of the web encrypted traffic, while only small number of people dey maintain am with almost no money. Log4Shell for December 2021 make incident response from all over the world pass through small volunteer team for Apache Log4j project.

The XZ Utils backdoor wey dem discover for March 2024 na the clearest example, because di attack target the maintainer instead of di code. One account spend roughly two years dey make useful contributions to compression library wey Linux distributions dey use across many systems. Other accounts pressure the tired sole maintainer to accept help. The new co-maintainer then plant backdoor inside the release archives. Di backdoor target systems wey SSH (secure shell) daemon link against liblzma. One developer find am while investigating why logins dey take about half second longer than expected. Na luck cause am, and everybody involved don talk so publicly.

Money don start to enter: GitHub Sponsors since 2019, Open Collective, Germany's Sovereign Tech Fund since 2022, and OpenSSF's Alpha-Omega project. The money dey come unevenly, and e mostly dey reach projects wey already famous. Regulation too dey come. European Union's Cyber Resilience Act enter force for December 2024, but most of the duties go start apply from December 2027. Early drafts for put manufacturer liability on volunteers wey no dey collect pay, so the final text create lighter category wey dem call "open source software steward" after foundations and distributions lobby for long time.

Wetín open source history mean for the software wey dey your VPS

Every application for our self-hosting guides dey depend on these decisions. Nextcloud exist because of one fork: for 2016, ownCloud founder and plenty of the team comot and restart the project under AGPLv3. The two products don dey run side by side since then. This history na the background to Nextcloud alternatives wey worth considering and self-hosted Dropbox alternatives wey dey compete with both of dem.

The same pattern dey happen for Git hosting. Gitea itself start for 2016 as fork of Gogs. For late 2022, the project trademark and domains move go one company. Codeberg fork Forgejo for December that year, and Forgejo move from MIT to GPLv3 with version 9 for 2024. Both dey covered for self-hosted Git server options, and the licence difference na major reason why dem continue to diverge. Meanwhile, most free software dey developed on GitHub, wey be closed platform owned by Microsoft. This na old argument wey get strong points for both sides: see wetin GitHub really be.

Before you commit server to any project, four checks worth ten minutes.

• Read the LICENSE file for the repository, no be the marketing page. Pages fit continue to call something "open source" long after the file don stop to agree.
• Find out whether CLA or copyright assignment dey. If one dey, one owner fit change the terms for future releases.
• Find out who hold the copyright: one company, many contributors, or a foundation.
• Count the active maintainers. Project wey get only one maintainer na risk to that person as much as e be to you.

None of this mean say you must avoid single-vendor software. Plenty of dem dey excellent, and payment often na why dem dey maintained at all. E just tell you wetin you dey exposed to. When you dey decide wetin worth self-hosting, put the licence for the comparison beside the memory requirement.

You fit read part of this history for the machine wey dey in front of you. Every package for Debian or Ubuntu system ship with its own terms:

ls /usr/share/doc | wc -l
head -n 20 /usr/share/doc/bash/copyright

The first number na how many installed packages get copyright file, usually a few hundred for small VPS. The second command print the top part of the one for bash, wey name GNU General Public License version 3. If file no dey, e mean say the package no build according to Debian policy. This one rare, and e worth make you check am again before you trust the package.

FAQ

Wetin be difference between free software and open source?

Dem cover almost the same set of licences, but dem no agree on why those licences matter. “Free software” na the older term, from Free Software Foundation for 1985, and the argument behind am na ethics: user wey no fit change the program no really control the computer. Dem coin “Open source” for February 1998 to make the same licences easier to explain to companies, and the argument behind am na practical benefit. GPL, MIT, BSD and Apache 2.0 licences dey for both official lists. Writers wey wan mean both together dey use FOSS or FLOSS.

Source-available software na the same thing as open source?

No. Source-available mean say you fit read the code. Open source, according to Open Source Definition, also mean say the licence no fit restrict who fit use the software or wetin dem fit use am do. SSPL and Business Source License both restrict competing commercial use, so neither of dem be open source under that definition, even though both publish their source. If na only you dey self-host am for yourself, the restriction fit never affect you. If you wan build product on top of am, read the licence text well first.

Company fit take back open source licence wey e don already grant?

No be for code wey e don already release. That version go remain under the licence wey e release am with. Na exactly why forks like Valkey and OpenTofu fit start from the last permissively licensed commit. Wetin company fit do na put future versions under new terms. But e fit do that only if e control copyright for the whole project through assignment or contributor licence agreement. Projects wey get many independent copyright holders, including Linux, nobody fit relicense dem.

Which licence I suppose look for inside self-hosted software?

For software wey you dey run yourself and you no dey resell, any OSI-approved licence like GPL, AGPL, MIT or Apache 2.0 go give you everything wey you need. The more useful check na who hold the copyright, because na that one decide whether the terms fit change later without your control. Project wey foundation or many independent contributors hold no fit relicense am against its users. Single-vendor project wey get contributor licence agreement fit do am. Both fit be good software. Na only one fit change the rules by itself.