Alfresco OSI/GPL compliance

[jerico_dev]

Hi Alfresco,

in order to better understand Alfresco's open source engagement I'd like to ask some very specific legal questions. It would be nice if one of Alfresco's lawyers could respond here. I'd hope for a response from somebody empowered to speak in the name of Alfresco as a company.

I've heard recently that Alfresco SI partnership contracts are quite restrictive when it comes to doing projects based on the community edition:

1) It seems that Alfresco SI partners have to sign a contract that denies them the right to support or distribute the community edition. Does this mean that partners are obliged to revoke the rights they were previously granted under GPL, §4 (Conveying Verbatim Copies)?

"You may convey verbatim copies of the Program's source code as you receive it, in any medium. […] You may charge any price or no price for each copy that you convey, and you may offer support or warranty protection for a fee."

Just to make it clear: I am not asking about the Enterprise Edition (which might not be released under GPL). I am asking about partners' right to make use of the GPLed Community Edition.

2) I also heard that Alfresco SI partners are denied the right to distribute derived versions (forks) of the community edition. Is it correct that partners are forced to revoke rights they gained under GPL, §5 (Conveying Modified Source Versions)?

"You may convey a work based on the Program, or the modifications to produce it from the Program […if you release it under GPL as well]"


Second I have questions concerning Alfresco's overall OSI compliance. These questions are specifically directed towards the Alfresco Enterprise Edition.

Alfresco employees have claimed several times in this forum that Alfresco's EE version is "open source". Alfresco themselves say all over their site that they are selling "open source" software. As only EE is /sold/ I guess that's what Alfresco is talking about here. There have even been employees here in this forum who claim that EE is released under GPL.

OSI's open source definition says:

1) Free Redistribution

"The license shall not restrict any party from selling or giving away the software as a component of an aggregate software distribution containing programs from several different sources. The license shall not require a royalty or other fee for such sale."

As far as I have heard this is not the case for the Alfresco EE product being sold by partners as they seem to be denied this exact right. Is it the case for other Alfresco products that may be sold by partners? If so: which?

2) Derived Works

"The license must allow modifications and derived works, and must allow them to be distributed under the same terms as the license of the original software."

Is this true for the EE version that may be sold by partners?

3) If you deviate from 1) or 2): How do you legitimate that Alfresco representatives are calling Alfresco EE "open source software" in this forum and on your website? Why not "shared software" or "proprietary version"? How do you make sure that customers or casual web site visitors are not mislead into believing that what they can buy from Alfresco is OSI compliant? Do you think that using the term "shared code" or "proprietary code" would reduce Alfresco's marketing appeal?

To summarize: Am I right in saying that…
1) Alfresco partners are forced to revoke rights that have been previously granted to them in the Community Edition GPL.
2) Only the Community Edition is OSI compliant - not the Enterprise Edition.
3) Your employees have been directed to use the term "open source" rather than "shared source" or "proprietary source" when referring to the Alfresco Enterprise Edition although you are aware that only the Community Edition is OSI compliant.

Jerico

[mjasay]

Thanks for your question.  I am an emeritus board member of the Open Source Initiative and serve as inside counsel in the US for Alfresco.  My comments below.

I've heard recently that Alfresco SI partnership contracts are quite restrictive when it comes to doing projects based on the community edition:

1) It seems that Alfresco SI partners have to sign a contract that denies them the right to support or distribute the community edition. Does this mean that partners are obliged to revoke the rights they were previously granted under GPL, §4 (Conveying Verbatim Copies)?

"You may convey verbatim copies of the Program's source code as you receive it, in any medium. […] You may charge any price or no price for each copy that you convey, and you may offer support or warranty protection for a fee."

Just to make it clear: I am not asking about the Enterprise Edition (which might not be released under GPL). I am asking about partners' right to make use of the GPLed Community Edition.

It is true that we require in most cases that our partners provide services around Enterprise, not Community.  This is simply a way to help both our partners and us.  At times where it does neither, we waive the requirement.  I've never heard one of our partners complain about this, as it creates a close, symbiotic relationship between Alfresco and the partner, and hence a better experience for the customer. 

This is in clear compliance with the OSD (and the GPL).  We do not in any way encumber the source code itself, which is all that the OSD addresses. 

2) I also heard that Alfresco SI partners are denied the right to distribute derived versions (forks) of the community edition. Is it correct that partners are forced to revoke rights they gained under GPL, §5 (Conveying Modified Source Versions)?

No, it is absolutely not correct that "partners are forced to revoke rights they gained under GPL (and, incidentally, this requirement of ours is followed by every open-source company I know, including those you would not remotely question as "open source").   I think you're confusing software licensing with the partner contract, only the former of which matters for the OSD.  The contracts that we sign with our partners have no bearing on GPL compliance.  I'd invite you to read Red Hat's Enterprise Linux license as an example of a contract mechanism to protect Red Hat's trademarks (and the binary distribution of RHEL), while still living within the spirit and letter of the GPL.

Alfresco employees have claimed several times in this forum that Alfresco's EE version is "open source". Alfresco themselves say all over their site that they are selling "open source" software….As far as I have heard this is not the case for the Alfresco EE product being sold by partners as they seem to be denied this exact right. Is it the case for other Alfresco products that may be sold by partners? If so: which?

If Alfresco employees have suggested that Alfresco Enterprise is open source, they spoke inaccurately, but not with the intent to mislead, and I don't fault them since 100% of our code is available as open source.  All of the Enterprise code is made available in Labs at present (though of course this might change in the future), and hence is made available as GPL software.

For the benefit of customers (nearly all of which do not want the redistribution/contribution requirement of the GPL, but like the ability to view and modify source code), we make our Enterprise code available under a commercial license, similar to MySQL and other open-source companies (Zimbra, SugarCRM, etc.).  It's called "dual licensing."  Customers get all the benefits of the GPL, plus the peace of mind for their legal teams that they need not worry about contributing back derivative works, added warranties and indemnification, and other benefits.

I think the Alfresco employees were simply suggesting that all of the underlying source code is made available as open source in Alfresco Labs.  In fact, more code is made available in Labs than in Enterprise.  However, when we distribute our code as Enterprise, it is under a commercial license, not the GPL, though that same code is made available under the GPL in Labs.  I apologize for the confusion.

Is this true for the EE version that may be sold by partners?

Actually, partners can redistribute to the end customer any modifications they make to the Alfresco software, and this is done on a daily basis.  Because of the commercial licensing of Enterprise, however, they are not required to contribute these changes back to Alfresco or the wider Alfresco community, though we encourage them to do so and have had some excellent contributions back from system integrators like Rivet Logic.

How do you legitimate that Alfresco representatives are calling Alfresco EE "open source software" in this forum and on your website? Why not "shared software" or "proprietary version"? How do you make sure that customers or casual web site visitors are not mislead into believing that what they can buy from Alfresco is OSI compliant? Do you think that using the term "shared code" or "proprietary code" would reduce Alfresco's marketing appeal?

Please see above.  I should also note that I've never actually heard a customer indicate the slightest concern on this.  It would seem that those outside the community care much more than those within the community, who are primarily focused on solving business problems, not attempting to unravel open-source riddles.  (I say this not as a rebuke of you, as I've long been one of the biggest "riddlers" in open source, but I'm just not sure that it really serves any useful purpose for customers.  I spoke to a group of 50 prominent CTOs recently and to a person they actually recommended mixing proprietary software (which we currently do not have) with open-source software, including a prominent representative from the Apache Software Foundation.  Go figure.

To summarize: Am I right in saying that…
1) Alfresco partners are forced to revoke rights that have been previously granted to them in the Community Edition GPL.
2) Only the Community Edition is OSI compliant - not the Enterprise Edition.
3) Your employees have been directed to use the term "open source" rather than "shared source" or "proprietary source" when referring to the Alfresco Enterprise Edition although you are aware that only the Community Edition is OSI compliant.

1.  No, this is 100% wrong.  Sorry.
2.  Yes, you are correct.
3.  No, this is 100% wrong.  Employees are not directed to say anything, misinformation or otherwise.  They say it because 100% of our code is made available under the GPL, including all of the code available under Enterprise.  We simply dual license at the point of sale at the request of our customers.

Thanks for taking the time to look into this.  Feel free to contact me directly if you have further questions.

[vsuarez]

Thank you very much for the clear explanation. I have tried to find the answer to this question for months.

Now, the "The Open Source Alternative for Enterprise Content Management" slogan must be removed asap from the web, or do you think Alfresco CE or Labs are a real alternative to ECM?

This information is very valuable for me and for my clients that are required to install open source products. Many of them can afford to pay licences and official support, but the product must be open source (OSI compliant).

Regards

[fselendic]

I really don't want to offend anyone,  but it would be great if key PR Alfresco people could get their stories together.

That is incorrect… The Enterprise code is 100% GPL, you are free to release it to the entire world if you desire… Because we own the copyright for 100% of the core Alfresco code, we can do something that Red Hat and others can't do. We make paying customers exempt from releasing any modifications as open source/GPL code unless they desire it!

Elsewhere on this thread, I note that someone could do with Alfresco Enterprise as CentOS has done with Red Hat Enterprise Linux (RHEL).

From my post at: viewtopic.php?f=20&t=9932&st=0&sk=t&sd=a&start=15#p48600

   

In fact, that is exactly what CentOS Linux is. The CentOS guys have purchased a subscription to RHEL which permits them to access the code and they then strip out all the Red Hat branding (which is trademarked by Red Hat) then rebuild and distribute freely. One can, if they wish, do the same with Alfresco.

Doing this is perfectly allowed under our Enterprise license. Once again, the only thing we've done is exempt you from being forced to do so unless you want to.

Does that make sense?

To summarize:

Alfresco Enterprise is licensed under the GPL but as owners of the intellectual property and copyright we waive the requirement for our customers to release any modifications as GPL. They are welcome to comply with the GPL and release everything only if they wish to do so.

That's from Luis, Product Evangelist, one month ago. Now we have VP of business development (I think that it is you, Matt ) saying totally opposite.

[jerico_dev]

@vsuarez, fselendic: I laughed a lot when I read your posts. You made my day. 😄

@mjasay:

thank you for your quick answer. I do however not agree with your argument.

1) I think we both agree, that before joining the Alfresco partnership program all organizations have the following rights under the GPL:
- They are allowed to support and sell services based on the Alfresco community edition.
- They can freely redistribute software they derived (or "forked") from the community edition as long as they provide them under the terms of GPL themselves.

Can you please explicitly confirm that no partner has renounced to these exact rights that were granted to them through GPL. That was and is my question. I am not asking whether (some) partners do not care whether they renounced or not. I am asking whether they did or not.

I'll come back to you about that within a few weeks time either with more substantial (professionally backed) arguments or with an "official" excuse if I was wrong.

Maybe you should provide me with a copy of your partnership agreement? This would help me to verify your claims.

2) Ok, we agree on that point. Please make others at Alfresco (see the previous two posts) also agree on that. 😉

3) Unfortunately your own response is a good example of the superficial argumentation that "blurs" Alfresco's real business model. You just do some open source name-dropping (your own position at OSI, MySQL, Red Hat, Zimbra, SugarCRM). Sure the casual reader may be fooled that way. Not so the real riddlers. (I liked that word! :-D)

I cannot follow the point you make about the similarity between Red Hat's and Alfresco's partnership contract: Does Red Hat limit the re-distributability of their core enterprise product for partners or customers? Do they limit partners' ability to derive from software that is part of their enterprise product? They can't, even if they wanted to. Because GPL won't let them. So what exactly did you want to tell me?

Please don't tell me that Alfresco publishes all code. This argument is really lame and another good example of what I call "misleading". You may publish all code somehow but not in a marketable or usable form. If versioning and packaging didn't matter then why does it matter in Alfresco's customer brochures that stress the advantages of the "stable" enterprise code as compared to the "unusable" community code?

Sun has it right: "A project does not become open source simply by publishing its source code." [1]

In this context your comparison of Alfresco's Enterprise Edition to the products of MySQL/Sun, Zimbra and SugarCRM is really dangerous (for yourself). All whose names your dropped so imprudently may provide some proprietary add-ons to their community product. The big difference is that they all provide the core parts of their enterprise software unchanged to the community and they don't call their proprietary products "open source". That's not just "some" difference. Thats the difference.

If you start to publish a stable community edition I promise to never "riddle" again…

Jerico

[1] http://www.sun.com/software/opensource/benefits.jsp

[alexander]

They say it because 100% of our code is made available under the GPL, including all of the code available under Enterprise.

Is it just me, or this sound like "Our 100% clean water (with even more stuff mixed in, good and bad) is available to everyone. Our clean water is free for all!"

[jerico_dev]

Hi Matt,

I've asked the slashdot people what they think about the Alfresco partner agreement as I think that they are usually quite independant in their opinions.

http://ask.slashdot.org/article.pl?sid=08/11/22/175239

And they are mostly very clear about it (while not of my opinion). It's in their eyes legitimate and fair that partners have to renounce to certain rights they may have previously gained under GPL. I accept that!

So as to point 1) of my statement: I am making my "official excuse", as I promised. 😄

It would be nice if you could clear up things anyway by answering to the specific question I made in my last post.

Jerico

PS: Edited to avoid harvesting.

[mjasay]

Thank you very much for the clear explanation. I have tried to find the answer to this question for months.

Now, the "The Open Source Alternative for Enterprise Content Management" slogan must be removed asap from the web, or do you think Alfresco CE or Labs are a real alternative to ECM?

Let's put it this way: between 30,000 and 50,000 (I don't have the most current numbers, but it's 30,000 minimum and probably 50,000 maximum) companies actively deploy Alfresco Labs.  We have roughly 700 paid customers (growing 100+/quarter) using Enterprise.  But I think the number of Labs users suggests a) it's a fantastic product that works and b) yes, you can run Alfresco Labs as an "open source alternative for Enterprise Content Management."  Tens of thousands do.

[mjasay]

I really don't want to offend anyone,  but it would be great if key PR Alfresco people could get their stories together.

That is incorrect… The Enterprise code is 100% GPL, you are free to release it to the entire world if you desire… Because we own the copyright for 100% of the core Alfresco code, we can do something that Red Hat and others can't do. We make paying customers exempt from releasing any modifications as open source/GPL code unless they desire it!

That's from Luis, Product Evangelist, one month ago. Now we have VP of business development (I think that it is you, Matt ) saying totally opposite.

Unfortunately, Luis misspoke, but I know him well enough to know that he didn't intend to deceive.  He just got confused.  As I say above, 100% of the code that goes into Enterprise is open source at present BUT we release Enterprise under a commercial license (dual licensing, just like MySQL and others).

So, it is absolutely not the case that Alfresco Enterprise is GPL, and that you can distribute it under the GPL.  You can't (as we don't).  I'm very sorry for the confusion.

[mjasay]

Can you please explicitly confirm that no partner has renounced to these exact rights that were granted to them through GPL. That was and is my question. I am not asking whether (some) partners do not care whether they renounced or not. I am asking whether they did or not.

I'm sorry.  I thought I did answer that.  Yes, our partners agree to distribute Enterprise BUT, as I said, we also allow them to distribute/use Labs, when it makes sense for the customer (and them).  So, I can't give you the 100% binary answer that you want because there is no 100% binary answer.  I can tell you, however, that I would prefer to have our partners only work with Enterprise.  There are hundreds of system integrators that will gladly support/distribute Alfresco Labs. 

For those partners upon whom we build our services business (we do little to no services ourselves), we want to make sure that their interests are aligned with ours, and they want the same thing from us.  Our commitment to them is that we won't compete with them on services.  Their commitment to us is that they will focus on Enterprise.  Where the two commitments need to bend to accommodate real-world situations, we bend.

I'll come back to you about that within a few weeks time either with more substantial (professionally backed) arguments or with an "official" excuse if I was wrong.

I saw the Slashdot chatter, and your follow up post (above).  Thank you for acknowledging that the partner agreements don't violate the GPL, as the Slashdot community said.

3) Unfortunately your own response is a good example of the superficial argumentation that "blurs" Alfresco's real business model. You just do some open source name-dropping (your own position at OSI, MySQL, Red Hat, Zimbra, SugarCRM). Sure the casual reader may be fooled that way. Not so the real riddlers. (I liked that word! :-D)

I can see how it would look that way, but I'm really not trying to hide anything.  I just don't think that "open source" is as binary as some (maybe you?) think.  The OSI isn't binary on the issue, either.  Get a GPL advocate like myself in a room with an Apache advocate and you'll find that there are lots of shades of gray, even within the "pure" open source people. 

But I make no apology for feeling that open source gets better when it accommodates business, and that it is not pretend open source to mix business concerns with open source concerns.  I think the two get better when brought together.

I cannot follow the point you make about the similarity between Red Hat's and Alfresco's partnership contract: Does Red Hat limit the re-distributability of their core enterprise product for partners or customers? Do they limit partners' ability to derive from software that is part of their enterprise product? They can't, even if they wanted to. Because GPL won't let them. So what exactly did you want to tell me?

Red Hat is more than RHEL.  But even RHEL prohibits binary redistribution, and Red Hat has done some clever things to make it less-than-easy to pull out its trademarks such that RHEL-minus-trademarks is not quite RHEL.  But I'm not suggesting that Red Hat has done anything wrong: I think it is doing exactly what every open-source company seeks to do: find ways to be a good open-source citizen while also finding ways to make enough money that it can reinvest in open-source code.

Please don't tell me that Alfresco publishes all code. This argument is really lame and another good example of what I call "misleading". You may publish all code somehow but not in a marketable or usable form. If versioning and packaging didn't matter then why does it matter in Alfresco's customer brochures that stress the advantages of the "stable" enterprise code as compared to the "unusable" community code?

Because we like to get paid a salary as much as you do.  Because we charge for the service that goes into "baking" Enterprise.  Tens of thousands of enterprises would disagree with your contention that Alfresco Labs is not "marketable or usable."  Ask GE, The Hartford, and Fidelity, three massive companies that use Alfresco in significant ways, yet have never paid us a dime for Alfresco Enterprise.  They seem to think Alfresco Labs works quite well. 

The difference, of course, is that they prefer to invest time to save money (to use Marten Mickos' phrase).  Alfresco does extensive QA for its Enterprise release.  You seem to want us to save you all the time *and* money that our Enterprise customers give to us, and I frankly find that unfair. 

So, I come back to my original point: we publish 100% of our code, and 100% of our bug fixes.  It *is* true that we delay some bug fixes going into Labs, as do other open-source companies.  But this is because we want to create a differentiated experience for our Enterprise customers.  They contribute to our success.  So far, though I appreciate your help in making sure our marketing is clear, I haven't seen what you contribute to Alfresco.  Code?  I have not seen it, but I thought that was one of the cardinal virtues of open source. 

Perhaps we should discount Enterprise subscriptions for code contributors?  I think we'd probably be very happy to do that.  I'm certain that we'd be interested in keeping bug fixes made by the community always available in Labs.  Contribute something and let's make it work.  That's what a community is, right?

Sun has it right: "A project does not become open source simply by publishing its source code."

I agree with that.  But that's why I think it's a bit unfair of you to not look at all the things that Alfresco tries to do beyond the code itself.

In this context your comparison of Alfresco's Enterprise Edition to the products of MySQL/Sun, Zimbra and SugarCRM is really dangerous (for yourself). All whose names your dropped so imprudently may provide some proprietary add-ons to their community product. The big difference is that they all provide the core parts of their enterprise software unchanged to the community and they don't call their proprietary products "open source". That's not just "some" difference. Thats the difference.

This is a good point.  I don't think it's actually true.  Have you visited the websites of SugarCRM, Zimbra, etc. lately?

SugarCRM:  "SugarCRM is the world's leading provider of commercial open source customer relationship management (CRM) software for companies of all sizes."
Zimbra: "Zimbra, a Yahoo! company, is the leader in open source, next-generation messaging and collaboration software."
MySQL: Try going to its page today, and you'll be greeted with (that's right!) a promotion for its proprietary Query Analyzer. 
Etc.

But this obscures a larger point: would you prefer that Alfresco completely open 95% of its code and make a few extensions proprietary (maybe 5%)?  Maybe that 5%, as with Sugar and Zimbra, would only matter if you were running Alfresco with proprietary software (e.g., if you wanted to run Alfresco with Oracle DB, or perhaps if you wanted to connect it to Microsoft Office), or were in serious, large-scale production?

Would that be an interesting trade-off for you?  You would not have to worry about whether Labs was less stable than Enterprise.  You'd only need to worry about whether a few features were unavailable in Labs.  It's the model Alfresco had three years ago (but dropped because the community didn't like having to pay for anything :-), but it is one that has worked for Zimbra, SugarCRM, Hyperic, and others, and maybe we should try it out again?  Would that make a cleaner relationship for Alfresco with its open-source code, in your mind?  I'm genuinely very interested, as I happen to believe that a 100% open-source model tends to create the very tension you've identified.  See [a href="http://news.cnet.com/8301-13505_3-10067267-16.html"]my CNET post on it[/a]. 

If you start to publish a stable community edition I promise to never "riddle" again…

Already done!  See above.  🙂

(Actually, has it ever occurred to you that one reason the Labs release is occasionally unstable is because of the frenetic pace of development, and not out of any devious design to thwart the community?  We are writing a HECK of a lot of code, and quite frankly it's not easy to keep Labs, which is intended as our experimental place, perfectly stable all the time.  We're therefore trying to identify stable builds as we go along to help you invest in the right build.  If we're screwing up, I really do appreciate hearing about it, as does the Engineering team.)