CPAL Submitted to the OSI

Tonight I posted the following on the Socialtext Blog.  It may seem like a bit of inside baseball, but it could be a very big deal:

Today Socialtext submitted the Common Public Attribution License (CPAL) to the Open Source Initiative (OSI).  OSI is a community appointed body responsible for open source licensing.  OSI is the creator of the Open Source Definition (OSD), certifies licenses as OSI Certified, guards against license proliferation and gives meaning to the term open source. Socialtext is the first an only company with a Mozilla Public License (MPL) plus Attribution license (amongst 40+ commercial open source businesses) to seek OSI Certification.  We do not, however, consider ourselves open source until all our licenses are OSI Certified. We have been working through this process for some time.  Today the submitted CPAL can be found here and we look forward to the open conversation on OSI's license-discuss mailing list.  For those interested in a summary of our submission, here it is:

1. The Common Public Attribution License ("CPAL") is based on the MPL which has been approved and all of the new provisions are in Sections 14 and 15 (and Exhibit B) and  adding "Original Developer"  to certain disclaimers ("Original Developer" is a term defined in the new provisions for those who originally created the program who may be different from the "Initial Developer"). Section 14 provides for an attribution notice based on the Adaptive Public License and Section 15 provides for a network use provision based on the commonly used provision on "External Deployment" found in the Apple Public License, Real Network Public License and the Open Software License. We have used the Adaptive Public License, which is virtually the sames as the prior attribution provision which was in Exhibit B of the proposed Socialtext Public License,  as the basis for the attribution provision because it was approved after OSD 10 was adopted. We have limited the placement requirement for attribution notice to "prominent" rather than a specified size or location. We have also permitted the use of splash screens. The term "prominent" is frequently used in other OSI approved licenses such as the GPL and NASA Public License. Socialtext believes that the application software has special needs as compared
to operating systems because of the application software can be used anonymously in large distributions and can be used to provide services
through an ASP which does not provide modifications back to the community. None of the approved OSI approved licenses include both a network use provision and an attribution provision. We have limited the new provisions to those which are either the same or very close to provisions from existing licenses (see above).

2. The license can be used with any software which is licensed under the MPL and licenses compatible with the MPL. The CPAL will take precedence for combined works. Some licenses such as the GPL which are incompatible with the MPL are also incompatible to the CPAL.

The above is a summary of how CPAL is OSD Compliant, but you can also explore this points one through ten.  If the license is deemed compliant with OSD by the OSI Board, it should be OSI Certified, a mark that carries great meaning on both the community and market. Socialtext also uses other OSI-Certified Licenses within its products.  Primarily, Perl Modules licensed under the Perl Artistic License, some originated by others, some by Socialtext employees in an act of giving back to the community. While working on CPAL, we developed a new strategy for open source licensing.  Some core components will be licensed under both CPAL and the Perl Artistic License (PAL, I like to call it because of the nice ring and rhyme, although it is commonly referred to as the Artistic License).  With CPAL and PAL together we gain something in a greater community and commercial interest. Dan Bricklin highlights this aspect I'm not supposed to call triple-licensing in his post SocialCalc 1.1 released -- we now have a real Open Source project:

The SocialCalc Engine code is being released under the Artistic License 2.0. This license, written by the Perl Foundation, is basically the same as the Artistic License used for years for Perl and was apparently just approved as "Open Source" by the OSI. (Perl also has the option of being used under the GPL.) I understand that this is a pretty liberal license which allows proprietary modifications but also allows code licensed under it to be included in projects licensed under GPL. This should hopefully help this spreadsheet engine code become part of a wide variety of projects and get a large number of developers contributing to its maintenance and advancement.

Tomorrow we will post to the wiki an expanded FAQ and guide for applying the CPAL to your own project or product.  We don't recommend doing so until OSI approves it, as a disclaimer, and provide it for broad understanding of the potential of this license to serve community and commercial needs.  If not, heal a growing rift in the community overall.

Comments

[Finite]

How many lines of Covered Code may I borrow from your web app before the attribution clause kicks in? From my (admittedly quick) reading of the CPAL, the answer is "none".

If your web app displays your logo prominently on every page, and I want to borrow a little bit of your code for my app, would I then be required to put your logo on every page? IANAL, but from my reading of the CPAL, it sounds like "yes".

Am I mistaken in thinking that this could be very burdensome for people wanting to combine code from several different CPAL projects? Please advise...

[alexis]

Good job guys. Where do interested readers locate a redlined comparison of CPAL with MPL 1.1, and an accompanying analysis?

[Tony]

Alexis, you shouldn't need a redlined version: the extensions to the MPL all come at the end (section 14 onwards) - everything before that should be the same.

For analysis beyond what's in the submission (which is in the above post, albeit really hard to read because it stretches way off to the right of the browser), you'll need to wait for it to appear on the wiki (which is scheduled to happen today)

[Liz Henry]

Finite, I am not an expert or a lawyer, but have been working on this license and know how to answer part of your question.

The license doesn't specify number of lines of code. Though I think we can assume it is greater than zero, or else we are all in violation of it right now 8-)

It also does not specify that you would have to put a logo on every page. As I understand it, Exhibit B could be written so that it could require the UI attribution information in a way comparable to the way your own UI attribution information is applied.

So, Exhibit B could be set up to be very broad in its requirements of putting attribution on a UI over a network. Or it could be written to be very modest, only requiring a user to be able to access the logo and copyright and link to source from somewhere - like from an "about" page that is reasonably findable for a user, for example a user looking at web pages who can't see the source code on your server.

[Finite]

Liz, thanks for your answers. Unfortunately, they only raised more questions :)

First, when you said "or else we are all in violation of it right now" what are you talking about? I must be missing something there.

But more importantly, as to the flexibility of where the "prominent" Attribution Information must be put, section 14(b) says "if You include Attribution Information or similar information for other parties, You must ensure that the Attribution Information for the Original Developer shall be no less prominent than such Attribution Information or similar information for the other party." ... which is why I suspect that use of this CPAL would inhibit code sharing.

Here is a hypothetical situation: Lets say I have my own wiki software (FiniteWiki) that already has its own logo at the bottom of every page. One of FiniteWiki's goals is to combine features from many different wikis, so naturally code reuse from several sources is desirable. If I wanted to incorporate a small amount of code from SocialText's CPAL licensed wiki software, I would then be required to make FiniteWiki display SocialText's logo on every page too, right? UNLESS, if I am willing to remove my own Attribution Information (the "Powered by FiniteWiki" logo) from every page, THEN I can get away with merely having a single "About this software" page that attributes everyone as required. Is that correct?

Lastly, in Exhibit B it says "Display of Attribution Notice is ((required/not required)) in Larger Works which are defined in the CPAL as a work which combines Covered Code or portions thereof with code not governed by the terms of the CPAL." In the case that it is "not required", the lack of a firm definition of what constitutes a Larger Work seems like a recipe for trouble. What if my Larger Work is 95% based on your code? What if it's only 10%? I'm sure you can see there is potential for confusion here.

Due to the poor definition of Larger Work, as well as the "no less prominent" part of section 14(b), I don't believe that the CPAL in its current form is something worthy of OSI certification, but with a little improvement it could be. Asking "how much does this inhibit code reuse" is a very important litmus test when judging an open source license, and (unless I'm mistaken) this one clearly fails it.