Clearing out code not licensed as AGPLv3?
tl;dr can we clean up our licensing to remove a PHP exception and potentially remove files cross-licensed between AFL-3.0 and AGPL-3.0 ?
CiviCRM v1 came out in 2005, which predates the advent of our current AGPLv3 license which came out in early 2008 (https://opensource.org/license/agpl-v3).
Our licensing page https://civicrm.org/about/license is a bit of a mess and more attention is being paid to licenses these days (https://chat.civicrm.org/civicrm/pl/c7io5cmkitnyfrpjw9mxssb9ga).
Our codebase and IP apparently was reviewed by Larry Rosen who was the CiviCRM project attorney at the time.
It is embarassing when PHP is no longer supporting PHP 8.0 (https://www.php.net/supported-versions.php) that our licensing has an exception "Permission is hereby granted to combine the Program with works licensed under the PHP License versions 2.01, 2.02, 3.0 and 3.01." Tim found when searching a vanilla install that 'i hadn't searched on "PHP License". but the phrase "PHP License" appears in PEAR DB and HTML_QuickForm'.
-
Review if PHP 8.1+ still requires this sort of a license exception.
Larry Rosen had been the general counsel to the Open Source Initiative and was the person who submitted the Academic Free License to it for approval (https://opensource.org/license/afl-3-0-php, https://en.wikipedia.org/wiki/Academic_Free_License).
It seems that previously new files submitted to the project that were not written by the core team sometimes had the AFL-3.0 added. For example, the subversion repository from version 4.2 just before the project moved to git shows 70 references to Academic: https://github.com/search?q=repo%3Acivicrm%2Fcivicrm-svn+Academic&type=code&p=1 . The current git repo has 24: https://github.com/search?q=repo%3Acivicrm%2Fcivicrm-core%20%20Academic&type=code . As described below, only 31 show up currently in a vanilla install, and only 24 in a search of civicrm-core repo.
What seems to have happened is people have stopped asserting copyright in their contributed files to CiviCRM, which is an option according to our contribution policy on the license page (https://civicrm.org/about/license): "If you place a copyright notice in anything you contribute to CiviCRM, you will also need to license those works (under the Academic Free License version 3.0) to CiviCRM before they will be acceptable for distribution to our users and customers."
Both Mongo and Redis changed to non-OSI licenses in recent memory. Currently it is conceivable that our project could be relicensed to something different than AGPL 3.0 by the core team. I can't imagine that they have any interest or intent on doing so, but using the AFL-3.0 on contributions on which copyright is asserted is one way to clear the way for contributions to be relicensed, because the AFL is so permissive. I'd like us to clean this up, remove the unfollowed advice to assert AFL-3.0 on contributed files when someone wants to assert copyright. That would clarify we have no intent to relicense.
My recollection is that there was a review after the first few years of the project to make sure the code project's repo met licensing requirements. IIRC there had not been any policy on contributions in the early years when there was no concern about the licenses on the code allowed in the repo. This led to concern that some code had incompatible licenses - I recall a file defining the interface to the Moneris payment processor had a proprietary license and got removed from our repo - and other code had no license specified.
After AGPLv3 came out in early 2008 (https://opensource.org/license/agpl-v3) Lobo decided to adopt it. I believe it was in the process of adopting it that the project code review occurred. I am speculating, but perhaps the code with no license was given an Academic Free License before being converted to AGPLv3 in order to ensure there would be no problem if the project decided to relicense later.
I propose that we try to remove the problematic files. Here are 31 files currently in a fairly vanilla install of Tim's that include the Academic License:
Academic Free License
- tools/extensions/civivolunteer/agpl-3.0.exception.txt
- header-afl.txt
- drupal/modules/views/civicrm.views.inc
- drupal/modules/views/civicrm/civicrm_handler_field_link_relationship.inc
- drupal/modules/views/civicrm/civicrm_handler_field_link_activity.inc
- drupal/modules/views/civicrm/civicrm_handler_field_link_contact.inc
- drupal/modules/views/civicrm/civicrm_handler_field_link_contribution.inc
- drupal/modules/views/civicrm/civicrm_handler_field_link_event.inc
- drupal/modules/views/civicrm/civicrm_handler_field_link_participant.inc
- ext/de.systopia.xcm/l10n/de_DE/LC_MESSAGES/xcm.po
- ext/elavon/CRM/Core/Payment/Elavon.php
- ext/payflowpro/CRM/Core/Payment/PayflowPro.php
- ext/ewaysingle/CRM/Core/Payment/eWAY.php
- ext/ewaysingle/lib/eWAY/eWAY_GatewayResponse.php
- ext/ewaysingle/lib/eWAY/eWAY_GatewayRequest.php
- CRM/Core/Payment/AuthorizeNet.php
- CRM/Core/Payment/Dummy.php
- CRM/Core/Payment/Realex.php
- CRM/Core/Payment/FirstData.php
- CRM/Core/Payment/PayJunction.php
- CRM/Event/Badge.php
- CRM/Event/Badge/NameTent.php
- CRM/Event/Badge/Simple.php
- agpl-3.0.exception.txt
- packages/PayJunction/pjClasses.php
- templates/CRM/Contact/Form/Task/Label.hlp
- templates/CRM/Contact/Form/Task/PDFLetterCommon.hlp
- templates/CRM/Admin/Page/LabelFormats.tpl
- templates/CRM/Admin/Page/PdfFormats.tpl
- templates/CRM/Admin/Form/LabelFormats.tpl
- templates/CRM/Admin/Form/PdfFormats.tpl
Only 24 showing up in a search of the civicrm-core github (https://github.com/search?q=repo%3Acivicrm%2Fcivicrm-core++Academic&type=code&p=2). There are others in other repos.
Note that several of these files are ones we have been wanting to take out of the core repo for some time: the payment processor integrations that should be extensions.
If some can't be easily removed, perhaps we can reimplement them, or maybe contact the original submitters like Eileen to see if they are okay with specifying they are licensed under AGPL-3.0 to CiviCRM, not AFL-3.0. We'd probably need a bit of legal advice first before doing that.