Legal Problem: Open Software License - Section 5: External Deployment

[MrKris]

PrestaShop is licensed under the Open Software License (OSL v3.0).

The OSL isn't a popular choice, especially in web applications, due to the fact that it takes a sledgehammer approach to closing the so-called "ASP loophole" of other open-source licenses, and brings all visitors of websites powered by OSL code within the scope of the license.

From what I understand, the implication of Section 5 (External Deployment) is that our customers - who merely browse our website, add items to the cart, place orders, etc - are classed as users of the software and as such, they must agree to the terms and conditions of the Open Software License (including the Disclaimer of Warranty, Limitation of Liability, and Attorneys' Fees sections, not just the license grants).

Furthermore, the implication of Section 9 (Acceptance and Termination) is that if you use PrestaShop as your online store, you are effectively "communicating" the software by "making it available as an application intended for use over a network" and must make a "reasonable effort under the circumstances to obtain the express assent of recipients to the terms of this License". So we have to make sure our visitors and prospective customers EXPRESSLY AGREE to the terms and conditions of the Open Software License before letting them browse our store!

Obviously, we also have to make the full source code (including derivative works - even trivial changes) available to anyone who visits our online store, as that's the main reason for clause 5.

Under other open-source licenses, only the person/business running the PHP code on their server is classed as a user; as long as they don't distribute the PHP, they don't have to share the source code. Website visitors - using network services or the output of PHP web applications - are completely unaffected by other licenses.

Does anyone know why PrestaShop chose this license of all the open-source licenses?

I understand the need for a license that would consider businesses using PrestaShop-powered stores as users of the software, so as to catch third-party hosted solution providers who would otherwise be able to take the open-source code in-house and develop it but only offer hosted solutions and never release the source code. But adopting an unsuitable, unworkable license like the OSL for a web app and catching all website visitors is just ridiculous.

Are people aware of these licensing issues? How do you fulfil your obligations under the OSL without disrupting the user experience? Am I missing something?

[Kaihaku]

This is a valid point though I believe most businesses that use PrestaShop ignore the specifics. I have yet to see anyone distribute the source code for their store or force their customers to agree to terms of use. So it would seem that this is a case of businesses violating contract but that breach being ultimately unimportant as the terms of the contract are not enforced.

[MrKris]

Yeah, but I think it goes further than contract law. The thing that concerns me is the fact that Section 9 of the license says that using and communicating the software "without honoring these terms and conditions is prohibited by copyright law and international treaty" and that "this License shall terminate immediately and You may no longer exercise any of the rights granted to You by this License upon your failure to honor the conditions in Section 1(c.)".

Meaning that using PrestaShop as our online store, without making the source code for it and derivative works (including configuration?) available to all visitors, automatically and irrevocably voids the license. So the software is unlicensed and we don't have permission to use it, let alone communicate/distribute it.

In this situation, legally speaking, uploading PrestaShop to our server and communicating it to others is no different than uploading a copy of Microsoft Office to our site for anyone to download - both are equally copyright infringement; neither one is more or less serious than the other.

So technically, we're all hosting warez!?

[Kaihaku]

This is a very murky area. 1d) and 1e) seem to guarantee the right to "perform" and "display" applications publicly, which I would expect to cover web applications externally deployed. But then 5 seems to shoot that to hell.

If you want an answer from the PrestaShop team, I would recommend translating your post into French and posting it on the French speaking boards that the developers frequent. Or, better, commissioning a French friend to pass on your query with proper grammar. I'm not certain that anyone who frequents the English boards has an answer to this question.

Regardless, I'm surprised by how poorly the OSL is written but not especially concern with the letter of the law in this instance. In the unlikely event that someone does start taking legal action on this matter, it wouldn't be difficult to temporarily share source code and add a pop-up with the terms while using cart2cart to rapidly switch to a new platform - granted even that disruption could have a significant impact on business. Caveat Emptor.

[Damainman]

Thank you for pointing this out... I'm starting to lose hope as to which store to use to develop with lol

[Kaihaku]

I noticed that Magento also uses OSL 3.0, I really don't think that this will ever become an issue unless someone makes a branch of PrestaShop that isn't distributed under the OSL.

Edit: To clarify, here are excerpts from a thread at the Magento forum on this exact issue. While the topic here received little attention, the topic there was answered by the author of OSL 3.0* who is also Varien's lawyer so hopefully it will provide adequate assurances. The thread becomes especially interesting on the second page.

*Quite a contrast to the response here.

This includes running a site and letting a customer purchase things from it as well. Not just running a hosting provider.

It would be interesting to know whether by merely editing a CSS file, we have to make everything OSL or just the CSS file. Or whether the database contents are part of the source code (perhaps in case of using sample DB content).

Based on this, it is safe to say that the majority of those using Magento at this moment violate OSL.

Or putting it in clear terms… Anyone who as much as edited a single source file and has given access to this file over a network such as the internet (read: have a live shop) HAS to offer these changes in a readily accessible, machine readable format (i.e. not scribbled on a notepad). So all Magento shop owners who have changed as little as one character in the core files and who do not publish this change are in direct violation of the OSL.

Even if we use Magento in such a way that we do not modify original files (like by making proper Modules) it appears we have an obligation to publish the Original Source Code (not our code).

http://www.rosenlaw.com/OSL3.0-explained.pdf

If linking (by whatever technical means) can be accomplished by making and using unmodified copies of the Original Work, then 1(a) and 1© permit that; only the Source Code of the Original Work must be disclosed.

So, regardless, we always have to make at least the base Varien code available (which seems a bit much to ask but a requirement nonetheless).

But the point is we ARE distributing by merely installing Magento + our edits on a publicly accessible server. Visit any live shop and they are automatically distributing according the the External Deployment paragraph.

In other words, we can only avoid our obligation of publishing/disclosing source code if we only use our shop locally with no actual visitors other than our very own self. In other words, by having a pointless installation.

Having said all that, it’s a bit silly though. I’ve seen many shops showcased on the blog where I thought, wow, I wish I could have a copy of that. As it turns out, if they made their edits to the core files, It’s my right to have a copy of that. If they made the enhancements as a separate Module, I have no right to access those changes. But how the hell would I know? In the end of the day it comes down to the licensee honouring the license, sticking to their promise and obligation.

From my own perspective, I am not editing any core files but not for license reasons. I leave them alone for upgrading reasons.

As the author of OSL 3.0 and also as Varien’s attorney, let me clarify the situation regarding Magento modifications.

Magento software is open source. It is designed to be modified and enhanced. The Magento e-commerce system is contained in three folders:

Core – the location of the Magento system as distributed by Varien under OSL 3.0.
Community – the location of community-provided extensions (under various licenses)
Local – the folder for your local extensions or overrides to your version of Magento

Only if you make changes to the Core folder—and if you distribute those changes—must you license that code under OSL 3.0 and make its source available.

Under OSL 3.0, “distribution” includes “External Deployment”. If you distribute copies of your changed Core folder, or if you provide access to that software by placing your Magento store on the web for other people to buy things, that’s a distribution under OSL 3.0. So be careful to make your private changes to the Local or Community folders, not the Core folder, if you don’t want to disclose them.

Please note that distribution or external deployment doesn’t actually occur until you start offering that e-commerce site over the Internet. Test and deploy internally all you want, without disclosing anything.

The OSL 3.0 license supports Varien’s dual licensing open source business model. If you want to make private changes to your version of the Magento Core folder without disclosing the changes, Varien offers commercial licenses. Contact Varien for details.

Lawrence Rosen
Rosenlaw & Einschlag, a technology law firm (www.rosenlaw.com)
3001 King Ranch Road, Ukiah, CA 95482
707-485-1242 * cell: 707-478-8932 * fax: 707-485-1243
Skype: LawrenceRosen
Author of “Open Source Licensing: Software Freedom and Intellectual Property Law” (Prentice Hall 2004)

There's more, including another response from the OSL author, but I'm out of characters for this post. Check out the thread. I don't quite understand 'how' but, judging from the OSL author's response, it sounds that running live shops of unmodified PrestaShop is legal.