Lee, I just read all of those documents too and it seems your understanding is right. The explanation PDF explicitly states this difference compared to the GPL.
Indeed as soon as you make your derivative work accessible (as in, a shopper visits your site which contains those modifications) this is seen under the OSL as a distribution. A distribution makes your modifications OSL. The OSL forces you to make the SOurce Code available in a machine readable format.
So as you say, once files made by Varien (the licensor) get edited by us, our edits become OSL and we become licensors ourselves who by giving public access to our shops, distribute this derivative work. At that point we are obliged to make a copy of our work accessible.
If, however, we do not edit Varien coded source files, it appears our code does not automatically inherit this OSL license and we are not required to publish our changes.
It would be interesting to know whether by merely editing a CSS file, we have to make everything OSL or just the CSS file. Or whether the database contents are part of the source code (perhaps in case of using sample DB content).
Also note the Licensor has a right to waive the need for those making modifications to disclose these but as can be seen in LICENSE.txt in the Magento distribution, Varien makes no statement as such.
Based on this, it is safe to say that the majority of those using Magento at this moment violate OSL.
Or putting it in clear terms… Anyone who as much as edited a single source file and has given access to this file over a network such as the internet (read: have a live shop) HAS to offer these changes in a readily accessible, machine readable format (i.e. not scribbled on a notepad). So all Magento shop owners who have changed as little as one character in the core files and who do not publish this change are in direct violation of the OSL.
I just saw your previous post - you are asking what constitutes derivative work right? First off, if you do not plan to distribute, then you are fine. If you do plan to distribute then here is a good resource - http://www.linuxjournal.com/article/6366
If you do plan to distribute and do not want to be restricted to the limitations of Magento’s open source license, we do offer commercial licenses for exactly this reason. Some companies would prefer to have more control and our dual-license policy ensure them an offering that can meet their objectives.
Also as a policy, we do not provide legal advice or interpretations so I hope this helps.
Even if we use Magento in such a way that we do not modify original files (like by making proper Modules) it appears we have an obligation to publish the Original Source Code (not our code).
http://www.rosenlaw.com/OSL3.0-explained.pdf
If linking (by whatever technical means) can be accomplished by making and using
unmodified copies of the Original Work, then 1(a) and 1(c) permit that; only the Source
Code of the Original Work must be disclosed.
So, regardless, we always have to make at least the base Varien code available (which seems a bit much to ask but a requirement nonetheless).
First off, if you do not plan to distribute, then you are fine. If you do plan to distribute....
But the point is we ARE distributing by merely installing Magento + our edits on a publicly accessible server. Visit any live shop and they are automatically distributing according the the External Deployment paragraph.
In other words, we can only avoid our obligation of publishing/disclosing source code if we only use our shop locally with no actual visitors other than our very own self. In other words, by having a pointless installation.
Either your are missing what I am talking about or your interpretation is wrong.
Regardless, If a developer edits any Magento source code in his/her quest to create a custom site for theselves or a customer, they have created a Derivative Work, as soon as they allow anyone other than themselves to access said work over a network, they have distributed it. So, in the case of an ecommerce store, when a customer uses the store, your are falling under §5.
Now, if you simply create Modules that do not edit the distributed Magento source code (Original Work), you are perfectly fine.
I understand not providing legal advice, but maybe you could be more explicit in the FAQ so developers understand this?
Having said all that, it’s a bit silly though. I’ve seen many shops showcased on the blog where I thought, wow, I wish I could have a copy of that. As it turns out, if they made their edits to the core files, It’s my right to have a copy of that. If they made the enhancements as a separate Module, I have no right to access those changes. But how the hell would I know? In the end of the day it comes down to the licensee honouring the license, sticking to their promise and obligation.
From my own perspective, I am not editing any core files but not for license reasons. I leave them alone for upgrading reasons.
As the author of OSL 3.0 and also as Varien’s attorney, let me clarify the situation regarding Magento modifications.
Magento software is open source. It is designed to be modified and enhanced. The Magento e-commerce system is contained in three folders:
Core – the location of the Magento system as distributed by Varien under OSL 3.0.
Community – the location of community-provided extensions (under various licenses)
Local – the folder for your local extensions or overrides to your version of Magento
Only if you make changes to the Core folder—and if you distribute those changes—must you license that code under OSL 3.0 and make its source available.
Under OSL 3.0, “distribution” includes “External Deployment”. If you distribute copies of your changed Core folder, or if you provide access to that software by placing your Magento store on the web for other people to buy things, that’s a distribution under OSL 3.0. So be careful to make your private changes to the Local or Community folders, not the Core folder, if you don’t want to disclose them.
Please note that distribution or external deployment doesn’t actually occur until you start offering that e-commerce site over the Internet. Test and deploy internally all you want, without disclosing anything.
The OSL 3.0 license supports Varien’s dual licensing open source business model. If you want to make private changes to your version of the Magento Core folder without disclosing the changes, Varien offers commercial licenses. Contact Varien for details.
/Larry Rosen
Lawrence Rosen
Rosenlaw & Einschlag, a technology law firm (www.rosenlaw.com)
3001 King Ranch Road, Ukiah, CA 95482
707-485-1242 * cell: 707-478-8932 * fax: 707-485-1243
Skype: LawrenceRosen
Author of “Open Source Licensing: Software Freedom and Intellectual Property Law” (Prentice Hall 2004)
Under OSL 3.0, “distribution” includes “External Deployment”. If you distribute copies of your changed Core folder, or if you provide access to that software by placing your Magento store on the web for other people to buy things, that’s a distribution under OSL 3.0. So be careful to make your private changes to the Local or Community folders, not the Core folder, if you don’t want to disclose them.
Define “Distribution” because if distribution means actual usage of Magento themes (which are OSL) then everyone is in violation…
Magento software is open source. It is designed to be modified and enhanced. The Magento e-commerce system is contained in three folders:
Core – the location of the Magento system as distributed by Varien under OSL 3.0.
Community – the location of community-provided extensions (under various licenses)
Local – the folder for your local extensions or overrides to your version of Magento
I somewhat disagree with this… Almost every part of Magento is licensed under OSL… What about the licensed blank theme intended for designers/developers to customize http://www.magentocommerce.com/extension/518/blank-theme or even any default demo template file? Modifications to those files would fall under OSL (as the license is indicated in the theme files) ...So any dev firm or even individual company that makes modifications must share those modifications?
I think distribution should be just that distribution… eg creating a clone of Magento, making modifications to the core and trying to sell the software itself as UltraCart $299.95 .. That I think should be a violation.. But applying customizations to OSL licensed blank or demo templates, for a client who’s paying you to integrate an existing or new design into Magento for their company’s use, then of course the Client launching those works and using them, should NOT be a violation… Or am I mistaken? Do I have the wrong interpretation of OSL?
Let’s make Magento to GNU GPL where ALL Open Source projects should be!!!
PS- - By the way Roy, we need a screencast to teach people how to change Default Store name lol (see the above google “default store view” ) query link .. Our project manager pointed this out.. I’m actually working on a Magento configuration checklist that we are using internally to help our Clients setup their stores properly (including changing this )
Thanks for posting Lawrence, couldn’t get a more qualified person to clarify this than the author!
It also seems both Lee and I were on the right track.
But Dakman / David has some valid points I was wondering myself.
The modify vs extend via Modules debates seems clear now.
But the design part of it seems ambiguous still. Many people indeed take the Varien produced default theme and modify it. According to the OSL, any modifications to originally OSLed work would automatically become OSL too. Where do we draw the line here?
And going back to the creation of modules, there are config.xml files and two strategies. 1. We add our Module config to the core XML (i.e. modify original Varien code) or 2. create a stand-alone xml config file which at run time will be merged with the main one and stored in cache. When reading the OSL literally, scenario 1 would cause the licensee to be obliged to share and scenario 2 not. But surely the OSL doesn’t expect us to publish changes we make to configuration files such as database users and passwords? That would seem fundamentally wrong but the case nonetheless.
Anyway, that’s all getting pedantic about the smallest bits, thanks for clearing up the bigger picture. It’s interesting to delve into it and work out what people’s obligations are.
I agree the OSL is less ambigious and more easy to read than GPL. But Varien would make many developers’ life easy to make their own in-depth explanation of how the license relates to developers. Especially those who work for clients could be risking a headache by causing their clients to break the law.
One final question. By distributing Magento (giving public access to our shop) we are at the very minimum obliged to make the original work source code available. Would it be acceptable to merely link to the Magento repositories here on magentocommerce.com? Rather than all shop owners hosting their own straight copy of Magento, it seems better for the software, community and in terms of data redundancy to just link back to the official source for people to download there. What’s your take on this? Or does the OSL insist on everybody hosting their own downloadable copy of (at least) the original Magento code?
Ok, so it’s good to know we are on the same page regarding the core and modules. Now, as J.T. has so nicely pointed out for everyone, the themes are also under the OSL and that seems like a problem. Unless someone writes a theme from scratch they are subject to §1(c) and §5 which means they must release any changes to the theme files provided with Magento. Is it possible to get an Exemption added for the theme at least? I know the OSL has the ability to have an additional exemption for §5 in cases where the licensor adds the exemption.
And as far as the configuration goes… Well, the config.xml and more inportantly local.xml files include a statment about being under the OSL… should local.xml really be under the OSL? At the very least it seems like it should have the §5 exemption added.
Anyway, thank you, Lawrence, for taking the time to clarify the licensing issue for us. And thank you, Roy, for helping us address the issue.
We definitely have points but this is why I’m not concerned about this issue:
1. Every magento store owner would have to provide direct access to their entire app/design directory (and maybe even local.xml files with their encryption key hehehehe) which wouldn’t happen
2. Magento (varien) the company has a great deal of interest in protecting the contributions they made, and they want others that make contributions to share them as they have.. Which is understandably fair.. Magento is the finest piece of ecommerce software ever invented…
3. I think Magento is so new that it doesn’t know yet the license it should be under and Varien /Community is trying to protect the masterpiece.
However, I noticed Roy and Lawrence appear to have two different interpretations of distribution, so this is why I think some of us are still confused.
If a user is distributing the software via network (ie. on-demand, hosted), any derivative work must be licensed under the OSL license. - Roy
Under OSL 3.0, “distribution” includes “External Deployment”. If you distribute copies of your changed Core folder, or if you provide access to that software by placing your Magento store on the web for other people to buy things, that’s a distribution under OSL 3.0. So be careful to make your private changes to the Local or Community folders, not the Core folder, if you don’t want to disclose them. - Lawrence
Based on what Roy’s saying above it seems like he’s referring to distributing a different version of Magento Software as a Service” or “on-demand”
I agree with you Roy selling an SaaS (on-demand) solution with Variens/Communities blood sweat and tears and hiding customizations to the core should be a violation....
But Lawrence we need to then change Magento’s license to more clearly define distribution because what you are claiming, everyone appears to be in violation. Lawrence, as being part of their legal counsel I would understand you don’t look at source files/code often, but do understand that our concern here is almost all files in the Magento opensource package are OSL licensed (not just core file).... And the reason the template files shouldn’t be OSL is there is no way a company could develop/customize a Magento theme without using Magento default or blank default themes (since the XML files and template files) indirectly/directly reference helper classes and core files deep within the Magento core !! It would be like trying to guess an MD5 password…
So lets change the license completely or maybe for the next Magento release, remove the OSL statements from all folders except the core files.. eg app/design, app/skin - NO license
There is no need to remove the OSL from the themes to fix the problem. Varien just needs to have a §5 exclusion for themes and config files. This would make it so that if you edited the theme and used that for your site, you would not need to provide the source code to the community because it is no longer considered distribution. However, I you edited the base Magento theme and then made that theme available to a third party, you should still fall under the §1(c) conditions and be required to provide the source to the Magento community as a whole.
This would allow individual sites to use the base theme as a starting point, but prevent someone from using the theme as a starting for selling a new theme and not providing that work back to the Magento community.
If a designer chose to start from scratch with a theme and not use any of the Magento Original Work, they could license the theme any way they saw fit.
Personally, I like the choice of the OSL, I think it is much simpler to understand and follow than the GPL. It leaves no ambiguity, at least in my mind. If you don’t like §5, then you can add an exemption for that and still use the OSL. But, in this case, Varien would need to provide that exemption.
Is it even possible to retroactivly apply the exemption to the theme/config files?
Guys - point taken. We will be addressing these issues and clarifying our position with the goal of transparency. Look for a post in the next couple of weeks as well as a new forum to answer any questions that come up in regards to the licensing.
