Alfresco OSI/GPL compliance

[jerico_dev]

Hi Alfresco,

in order to better understand Alfresco's open source engagement I'd like to ask some very specific legal questions. It would be nice if one of Alfresco's lawyers could respond here. I'd hope for a response from somebody empowered to speak in the name of Alfresco as a company.

I've heard recently that Alfresco SI partnership contracts are quite restrictive when it comes to doing projects based on the community edition:

1) It seems that Alfresco SI partners have to sign a contract that denies them the right to support or distribute the community edition. Does this mean that partners are obliged to revoke the rights they were previously granted under GPL, §4 (Conveying Verbatim Copies)?

"You may convey verbatim copies of the Program's source code as you receive it, in any medium. […] You may charge any price or no price for each copy that you convey, and you may offer support or warranty protection for a fee."

Just to make it clear: I am not asking about the Enterprise Edition (which might not be released under GPL). I am asking about partners' right to make use of the GPLed Community Edition.

2) I also heard that Alfresco SI partners are denied the right to distribute derived versions (forks) of the community edition. Is it correct that partners are forced to revoke rights they gained under GPL, §5 (Conveying Modified Source Versions)?

"You may convey a work based on the Program, or the modifications to produce it from the Program […if you release it under GPL as well]"


Second I have questions concerning Alfresco's overall OSI compliance. These questions are specifically directed towards the Alfresco Enterprise Edition.

Alfresco employees have claimed several times in this forum that Alfresco's EE version is "open source". Alfresco themselves say all over their site that they are selling "open source" software. As only EE is /sold/ I guess that's what Alfresco is talking about here. There have even been employees here in this forum who claim that EE is released under GPL.

OSI's open source definition says:

1) Free Redistribution

"The license shall not restrict any party from selling or giving away the software as a component of an aggregate software distribution containing programs from several different sources. The license shall not require a royalty or other fee for such sale."

As far as I have heard this is not the case for the Alfresco EE product being sold by partners as they seem to be denied this exact right. Is it the case for other Alfresco products that may be sold by partners? If so: which?

2) Derived Works

"The license must allow modifications and derived works, and must allow them to be distributed under the same terms as the license of the original software."

Is this true for the EE version that may be sold by partners?

3) If you deviate from 1) or 2): How do you legitimate that Alfresco representatives are calling Alfresco EE "open source software" in this forum and on your website? Why not "shared software" or "proprietary version"? How do you make sure that customers or casual web site visitors are not mislead into believing that what they can buy from Alfresco is OSI compliant? Do you think that using the term "shared code" or "proprietary code" would reduce Alfresco's marketing appeal?

To summarize: Am I right in saying that…
1) Alfresco partners are forced to revoke rights that have been previously granted to them in the Community Edition GPL.
2) Only the Community Edition is OSI compliant - not the Enterprise Edition.
3) Your employees have been directed to use the term "open source" rather than "shared source" or "proprietary source" when referring to the Alfresco Enterprise Edition although you are aware that only the Community Edition is OSI compliant.

Jerico

[mjasay]

Is it just me, or this sound like "Our 100% clean water (with even more stuff mixed in, good and bad) is available to everyone. Our clean water is free for all!"

No, it just means that you now have a great opportunity to work with the Alfresco community to make it even better (cleaner).  We'd love to have your help.

[alexander]

Matt

Honestly, I admired what Alfresco did when it changed to GPL around 2.1. 2.1 Community release was great. I was really inspired spending my spare time writing addons and extensions to Alfresco. And… stopped it when there was no usable release for over a year and Community was renamed to Labs (just felt little bit deceived).

Recently when Luis confirmed that stable release is on the way I started it again. 

we publish 100% of our code, and 100% of our bug fixes. It *is* true that we delay some bug fixes going into Labs

I would not mind stable community release come out months later then enterprise. I also would not mind some features to be marked "not available" in binary release. It is better to have no Kerberos then Kerberos that does not work. But no stable releases at all… Do you know many open source projects that does not do stable (open source) releases after version 1?

We are writing a HECK of a lot of code, and quite frankly it's not easy to keep Labs, which is intended as our experimental place, perfectly stable all the time.

If you do not have time to do stable releases - community is there to help you. I think that is why Florian started these discussions.

Thanks
Alexander

[herve_quiroz]

Hello Matt,

I just discovered this topic through the post on Slashdot.

As a certified Alfresco trainer I often have to explain both the open source model and the business model of Alfresco when it comes to describing the various bundles and versions. I am glad to see these open source "issues" explained.


Still, one question comes to my mind:

we publish 100% of our code, and 100% of our bug fixes

I could not find any GPLed (or open source) release of Alfresco 2.2.x. From your statement above, it is clear that it is available somewhere but all I could find was the "community" versions (2.1 and 3.0 labs) as well as the SVN repository itself. And as far as i can tell, you may only retrieve the latest "HEAD" version from the Subversion repository, which means that you don't have access to any particular branch or tag (e.g. 2.2.0).

As a partner, I get access to Enterprise SDK bundles which contain the source code. Anyway, although there are GPL headers in the files, I understand that it cannot be redistributed.

Could you please tell me where to get the GPL source code for Alfresco 2.2 or any version of Alfresco other than 2.1 and 3.0 labs? Again, I ask this not to start doing business with the community versions but just to be able to answer these questions when asked during a training session.

[jerico_dev]

Matt,

I think that my initial questions have now all been answered. Thank you!

That's what I understood:

1) You prefer that your partners support only enterprise. That's why (probably most) partners sign a contract in which they renounce to some rights that they had under GPL (i.e. sell/fork the community product). I accept that as a legitimate though IMO unusual business model where you forego valuable opportunities in the SME market. But that's really none of my business now that you no longer obscure the fact.

Btw: I never said that your partner agreements violated GPL. I always said that you make partners renounce to rights that they gained under GPL. That's something completely different. And you known very well that I am right with that. You are a lawyer, how can you be so imprecise?

2) Enterprise Edition is not conforming to OSI. That was really a surprise to me as you are so clearly stating elsewhere that your enterprise edition is "100% open source" [1]. This kind of marketing certainly is 100% legal but IMO it is 0% ethical. In my eyes you are abusing a (non-protected) brand that others have made credible. This is not in line with the kind of business code of conduct that you as an "open source" company should be complying to. All other open source companies you cited so far do subscribe to such high ethical standards.

It is not a problem in itself that your EE is not conforming to OSI, but it's a problem that you call it "open source". You have been an OSI board member. You should know that OSI issued an open source definition to (among other things) make the business of "copycats" more difficult. It's a pity that nowadays you do exactly what you once fought.

I am aware that there is a myriad of different open source approaches out there that are all legitimate. Where did you get that idea from that I could question Apache's legitimacy? I am personally much closer to Apache than to GPL. Where did I question the legitimacy of a commercial open source model? I am not at all fitting this cliché. Open source cannot survive without a supporting business model. Nobody wants you to not feed your children. Huu, I've cried so many tears when you wrote that. But is there any high profile open source business model that questions the OSI definition? I am not aware of any one (except Alfresco's)… though there might be others. You know others?

You and your management colleagues like bashing Microsoft. But in this (and only this) respect you behave worse than Microsoft does. They at least admit that they sell "shared code" and not "open source". I think that to remain credible you should state on your product presentation website ([1], [3]) and in your marketing material that only your community edition is 100% open source and that enterprise edition is not. Currently even your own management peers are mislead by your marketing in believing that EE is GPL. Call EE something like "100% shared code" or "100% visible code". That's what it is, not more, not less. If you were as creative with naming as you are with contract conditions then inventing a less ambivalent name should not be a problem for you at all.

3) I think that in your last post the open source model that you are currently after has become reasonably clear. You are however again inconsistent and misleading in that on your website you say that only "enterprise edition" is production ready [2], not community edition. Here in this thread you want to make us believe that every community download (you have 50.000+, drupal has 2.000.000+) is a production installation and that therefore the "community edition" is fully production ready.

You are obviously trying to give a completely different "spin" to your forum communication than to your website communication. Different target groups, different truths? Hey, we are not dumb!

My point 3) never was about what you did, but about what you said. If your marketing or venture capital people are a little too ambitious and not too aware of the subtleties of open source then you, Matt, should educate them. They are no longer at Documentum or Business Objects where nobody cared. You should know it better.

To answer your questions:

Has it ever occurred to you that one reason the Labs release is occasionally unstable is because of the frenetic pace of development, and not out of any devious design to thwart the community?

You do it again… So this time you want to insinuate that it is not a conscious business trade-off that keeps you from publishing stable versions but development speed? Has it ever occurred to you that subversion let's you maintain branches? Sorry, this is ridiculous.

would you prefer that Alfresco completely open 95% of its code and make a few extensions proprietary (maybe 5%)?

I personally prefer an open source approach like that of MySQL, Zimbra or SugarCRM. But don't try to twist my words. I prefer an approach where the core product is stable and open. Not an approach where a useless trial edition with severe restrictions is "open" just to give a taste of a proprietary enterprise edition. I consider you absolutely capable of explaining us in your next post that CIMS or Sharepoint is just a little addon while your marketing machinery is filling up blogs all over the world with the contrary. 😄  You can be sure that the open source community will continue to bash you even stronger when you try to do that (while maintaining your open source tag). If that's what you are after then I definitely prefer your current approach.

You asked me, so here is what I personally think: Red Hat makes 10-12 $ with support and 1 $ with licenses [4]. If I was a software company today I'd never try to build up a COTS business model around licenses. A market position based on software licenses is simply far too easy to be threatened by tomorrows competitors. Even the most intelligent license conditions will never give you a durable competitive edge. You have done it to Documentum, someone else will do it to you. All high volume COTS ultimately has a marginal cost very near 0$. Not so low volume custom additions. Simple economics in my opinion. Not something you can escape.

As Alexander, yourself, myself and many others agree: If the community really wants a stable edition then we could provide one ourselves. That's what we're definitely going to try. Whether we'll manage: no idea. We know that for us (other than for you) it's quite some work to be done… But it may well be worth trying even if you stop us at some point by doing the same. (I'd admittedly love to die that way.) And as I already said in another post: We'll contribute everything back that might be developed on our side! No interest whatsoever in getting out of sync…

Jerico


[1] http://www.alfresco.com/products/networks/enterprise/
[2] http://www.alfresco.com/products/networks/community/
[3] http://www.alfresco.com/products/networks/
[4] http://www.thevarguy.com/2008/08/18/where-red-hat-and-its-partners-profit-most/

[jerico_dev]

Hi Herve,

Could you please tell me where to get the GPL source code for Alfresco 2.2 or any version of Alfresco other than 2.1 and 3.0 labs? Again, I ask this not to start doing business with the community versions but just to be able to answer these questions when asked during a training session.

Thanks for that post, Herve, you perfectly make my point. Alfresco's communication is so confusing that even certified partners are unable to tell the facts. 😄

If you read closely what Matt explains above then you'll understand that every line of code that is developed for stable enterprise editions ultimately ends up in the community edition's HEAD. The subversion tags or branches that would let you identify stable "packages" of code however are deleted before code enters the community edition.

That was my point when I said above that packaging does matter and that it is misleading to say that you give 100% when really you don't give the same packaging. You have been mislead as many others.

Jerico

[mjasay]

It is not a problem in itself that your EE is not conforming to OSI, but it's a problem that you call it "open source". You have been an OSI board member. You should know that OSI issued an open source definition to (among other things) make the business of "copycats" more difficult. It's a pity that nowadays you do exactly what you once fought.

I also learned as an OSI board member that the world (including the open-source world) is not as binary as you think, and perhaps as binary as both you and I would like.  It would seem that you want "open source" to only apply to those that use support (and only support) as their business model.  I was once sympathetic to this, but I was wrong then, and if that's your argument now, then I respectfully disagree with you. 

Is SugarCRM an open-source company?  Of course it is.  Is MySQL?  Yes.  Is Red Hat?  Yes.  Is Alfresco?  Yes.  Yet each restricts use of the open-source code or introduces proprietary bits to complement the open-source code.  Yes, including Red Hat.  I used to wish that there was a magical, simple formula for identifying one company as open source and another as proprietary, but that formula disappeared, if it ever existed, and I'm not interested in trying to retrieve it.  I'm much more interested in seeing ever-greater amounts of code being released as open source, whether by Alfresco or Microsoft or Novell or Apache or Eclipse or … you name it.

I am aware that there is a myriad of different open source approaches out there that are all legitimate. Where did you get that idea from that I could question Apache's legitimacy? I am personally much closer to Apache than to GPL. Where did I question the legitimacy of a commercial open source model? I am not at all fitting this cliché. Open source cannot survive without a supporting business model. Nobody wants you to not feed your children. Huu, I've cried so many tears when you wrote that. [Matt note: I'm very sorry to have caused you tears.  🙂 ]  But is there any high profile open source business model that questions the OSI definition? I am not aware of any one (except Alfresco's)… though there might be others. You know others?

What you seem to not understand, or at least aren't articulating (or perhaps I'm just misunderstanding), is that Alfresco's model is very, very similar to Red Hat's, as well as MySQL's.  I think you need to spend a bit more time analyzing Red Hat's licensing before you accuse Alfresco of standing alone as the one bastard open-source company.

You and your management colleagues like bashing Microsoft. But in this (and only this) respect you behave worse than Microsoft does. They at least admit that they sell "shared code" and not "open source". I think that to remain credible you should state on your product presentation website and in your marketing material that only your community edition is 100% open source and that enterprise edition is not.

May I ask why?  Would that actually convince you to contribute a single line of code, instead of comments on the forums?  I would love to have you contribute, since you are very fond of open source, as am I.  We've written an exceptional Enterprise Content Management system.  You're complaining because we release a binary distribution of our code under a commercial license?  I think you probably have better things to do.

I haven't found anyone but you that seems to care to try to make the distinction.  We call ourselves an open-source company, and so we are.  We make 100% of our code open source.  You can go download it now and see for yourself.  I understand that you want every line of code that we write to be open source at all times to be considered an open-source company, but this is foolish and, frankly, we just won't, just as Red Hat doesn't, MySQL doesn't, and no other open-source company does. 

I think that in your last post the open source model that you are currently after has become reasonably clear. You are however again inconsistent and misleading in that on your website you say that only "enterprise edition" is production ready, not community edition. Here in this thread you want to make us believe that every community download (you have 50.000+, drupal has 2.000.000+) is a production installation and that therefore the "community edition" is fully production ready.

Would I use Labs in production?  No.  But there are at least 30,000 companies on this planet that disagree with me.  As for Drupal's stats, they're fantastic!  But why should I care?

I personally prefer an open source approach like that of MySQL, Zimbra or SugarCRM. But don't try to twist my words. I prefer an approach where the core product is stable and open. Not an approach where a useless trial edition with severe restrictions is "open" just to give a taste of a proprietary enterprise edition.

Awesome!  We are in complete agreement.  You've just blessed three companies that have approaches very, very similar to ours.  You have also implied that in order to placate "community members" like yourself who contribute no code or cash to the project, we should ensure that the core is absolutely stable but introduce proprietary extensions so that we can get paid by someone (though I understand it won't be you). 

You can be sure that the open source community will continue to bash you even stronger when you try to do that (while maintaining your open source tag). If that's what you are after then I definitely prefer your current approach.

But the "open source community" has not bashed us.  You have.  As near as I can tell, given that you're not contributing anything to the project (including using it and submitting bug reports or anything else), we have lost little if you decide to focus on Drupal or another CMS.  I'd prefer to have you stick with Alfresco, but I will admit I'm now tired of the rhetorical riddling (you said you liked that word).  You know what our model is.  You know that you can get the code as open source.  You also know that if you want immediate bug fixes and more QA you are absolutely free to provide both.  In other words, you are free to be part of our community, rather than sitting on the outside, carping at problems you see.  I've never had an actual customer or serious user of Alfresco complain about the things you're complaining of.

You asked me, so here is what I personally think: Red Hat makes 10-12 $ with support and 1 $ with licenses.

And now who is the victim of clever marketing?  Read the license.  You cannot get support for RHEL without buying a license.  You cannot get a license without buying support for RHEL.  R0ml Lefkowitz once famously called Red Hat's model a subtle case of "Sharia" license-making years ago at OSCON.  I invite you to Google for it to read more. 

If I was a software company today I'd never try to build up a COTS business model around licenses. A market position based on software licenses is simply far too easy to be threatened by tomorrows competitors. Even the most intelligent license conditions will never give you a durable competitive edge. You have done it to Documentum, someone else will do it to you. All high volume COTS ultimately has a marginal cost very near 0$. Not so low volume custom additions. Simple economics in my opinion. Not something you can escape.

I would (sincerely) love to see you succeed with that model.

As Alexander, yourself, myself and many others agree: If the community really wants a stable edition then we could provide one ourselves. That's what we're definitely going to try. Whether we'll manage: no idea. We know that for us (other than for you) it's quite some work to be done… But it may well be worth trying even if you stop us at some point by doing the same. (I'd admittedly love to die that way.) And as I already said in another post: We'll contribute everything back that might be developed on our side! No interest whatsoever in getting out of sync…

This would be fantastic.  Seriously.  Now do me a favor: instead of looking for problems, I'd like you to try looking for solutions.  You think we're being deceitful.  I disagree.  But I want to hear what licensing model you would prefer.  You suggest above that a stable core is more important than whether we introduce proprietary extensions, which we have resisted.  The ironic and frustrating thing is that we have tried to avoid any proprietary software in order to appease "the community" like you while also creating a business model that will enable us to fund more great code development.

What I'm hearing, however, is that the tightrope we have to walk to do this doesn't work for you.  You want 100% open source, and then a clear statement that everything else (proprietary extensions, or whatever) is not open source.  I think that's a fair request, though I'd still call a "mostly" open source company "open source" because I firmly believe that MySQL, Red Hat, SugarCRM, Hyperic, etc. are open-source companies even though not all of their software is open source, or openly distributed.

I won't pretend that we have cornered the market on perfection.  You have pointed out missteps that we've made.  I admit them, or defend them (in some cases).  But I want more than just criticism from you: I want some clear indication of what it would take to convince you to not sit on the sidelines and criticize, but instead join up and contribute (cash or code - I don't care which).  If that's a 100% commitment to a stable, completely up-to-date core, then that's what I'll take to our management meetings in December.  If it's something else, let me know.

[jerico_dev]

Hi Matt,

that's what I love so much about democracy and free speech. We both really had our fair chance to lay out our arguments in depth and now everybody is free to make up his or her own mind. Thank you that you provided the platform for such open discussion. I don't have any new or valuable arguments to add so I'll better leave it like it is.

But I'll try to answer your questions. You are completely right: It is not ok to sit at the sideline and just critisize. I started this discussion because I wanted to actually change something (see my contributions to the "Is Alfresco open source"). I wanted to stop the moaning that was going on in that thread and I wanted Alfresco to decide what kind of open or closed source model they are really after.

I am about to start a new business after I've sold my part in the last one. For the CM technology part I've got two choices left on my list: Nuxeo (+ some additions) vs. Alfresco. So I will contribute back to one of them as I have always contributed improvements and patches to the software I use. My previous business released a complete php port of the Spring IoC, AOP and Web frameworks as well as the Acegi security framework under Apache license. It's a central part of the upcoming Typo3 V5 infrastructure (with adaptations by Robert Lemke) and the full source code can be downloaded from sourceforge (though unfortunately without much documentation but who knows Spring can use it directly). Apart from that I've patched nearly all the Linux packages that I am using and contributed my patches back. That is quite a big contribution to the community I guess. 😉

I admit that feature-wise I'd prefer Alfresco over Nuxeo. If you become clear and reliable about your open source and SME strategy and keep your community edition open enough then I am all yours. In all your posts you've made assumptions about what I am or what I believe. I don't mind but I think this is dangerous. Especially as you have guessed wrong whenever you tried. Maybe you should just ask me next time rather than make assumptions?

Now these are my options:

1) Alfresco decides to go on with the same model: In this case I'll start a "CentCM" project and try to convince the community to provide a stable version of Alfresco. This is not a fork it's just a re-packaging of the existing code that will contribute all developments back. We've already built up some infrastructure to do this. As soon as we've our infrastructure completely up and running we'll invite the public to join (and contribute back to Alfresco). If it succeeds I'll use Alfresco otherwise I'll use Nuxeo.

2) Alfresco provides a stable community version but closes down important parts that I need for my project: I think I'd bore everybody if I'd post my requirements list here. But I can send it to you in private so you can identify the features that are show stoppers. In that case I'd choose Nuxeo over Alfresco and make my contributions there.

3) Alfresco provides a stable community version that releases all features important to me under GPL: This is my preferred option. In this case I'd simply sign your contribution agreement and/or open up a project on Alfresco forge and contribute everything I develop back to you. If you choose option 3) then the "CentCM" project will die as quickly as it started.

An EE/OEM license is currentyl not an option for two reasons: It's far too expensive for a small start-up business like mine. I don't want venture capital to dictate my strategy so I'd rather remain small but independent. You currently don't have an SME offer and you want it like that. Hope this changes. And second: Your EE and OEM licenses are not OSI compliant.

Does this answer your question?

Jerico

[mjasay]

Now that we're talking over email, I'm going to forbear from posting here, except to sincerely thank you, Jerico, for posting your concerns.  I/we take them seriously and will respond transparently.  However, as I told you over email, we're at the end of our quarter this month and have management meetings in the second week of December.  Realistically, I don't think anything will be able to happen until then.

[jerico_dev]

Hi Matt,

Yes, let's see what comes out of december's management meeting. Thanks for bringing some of my points up with your management peers.

Jerico

PS: I think the following blog entry fits in well with some of the topics we discussed…
http://www.funambol.com/blog/capo/2008/09/commercial-open-source-europe-vs-usa.html

[jerico_dev]

Hi Matt,

I guess your December management meeting is over. Any news?

Luis Sala says that he doesn't know why the public subversion repository doesn't replicate the internal branches and tags folders. see http://forums.alfresco.com/en/viewtopic.php?f=20&t=9932&st=0&sk=t&sd=a&start=75#p51695 I think you should really take the time and explain your community approach to him. Otherwise people on this forum will continue to be misinformed.

Jerico