GPL and Related License Adoption Rates

Black Duck led the industry by introducing an accurate depiction of GPLv3, LGPLv3 project adoption and usage in graphical and tabular formats.

For those of you who may not have noticed Black Duck has expanded our Open Source License Resource Center by introducing AGPLv3 adoption and usage. Once again, the numbers displayed are accumulated month-to-month. The data is updated daily and the current month's statistics are to date only.

Tracking AGPL is important because it represents a separate platform for Web and Software-as-a-Service (SaaS) applications. It is relatively new, approximately half the age of the GPLv3, but if broadly adopted will expand the reach of FOSS licensing to many places it has not impacted before: Web and SaaS applications, portals, e-commerce and search sites, and others.

It’s worth watching.

What do you think about AGPL as an OSS license?

Today's software license landscape

Nine months after the introduction of GPL 3.0 and LGPL 3.0, what does the open source license landscape look like?

As of the end of last month, the number of GPL 3.0 licenses released is 1,574, and number of LGPL 3.0 licenses released is 219. That represents 2,817% and 4,280% growth, respectively, over nine months.

However, the rate of month-to-month growth has now slowed to 19% and 18% respectively. Most experts attribute the GPL adoption rate slowdown to three factors:

• GPL 2.0 being good enough and having support – for example, the Linux kernel continues to be licensed under GPL 2.0 due to the influence of Linux creator Linus Torvalds

• The patent termination issues are going away

• DRM is a non-issue for most open source projects

With the “bloom off the rose” on GPL 3.0, announcements with explicit references to GPL 3.0 are not occurring as often now as they did several months ago. Nevertheless, there are still software developers who intend to use the GPL 3.0 license or will eventually adopt it. Stay tuned.

v3 Check-in: First of the Year

One of the high points of the last year in technology was the introduction of GPLv3 and LGPLv3 back on July 28^th, 2007. I thought it was so important I wrote up a v3 status reports on adoption in August, September and October. By my last count in late October, there were 605 GPLv3 and 74 LGPLv3 projects.

The current status of GPL and LGPL v3 adoptions according to Black Duck is 1,191 GPLv3 and 171 LGPLv3 projects. This represents 97% and 131% growth respectively since that late October check-in posting. The current project-license adoption count also shows that GPL represents 87% of the v3 licenses; LGPL represents 13%. Thus, there has not been a discernible shift to LGPL. (Note: For a period of time the LGPL adoption rate superseded GPLv3 adoption. As I explained at the time this did not turn out to be a sustained trend.)

In my 2008 trends blog posting on 12/31/07, I indicated that “GPLv2 will continue to dominate, GPLv3 will grow steadily and the Affero license will be newsworthy”.

If one drills deeper in the data, it turns out that the v3 adoptions growth rate on a month-to-month basis has sharply fallen off. This is probably due to three reasons: (1) The novelty of v3 has worn off, (2) the GNU/Free Software zealots, as early adopters, have run their course, and (3) there is a seasonal factor; like software product introductions, few open source projects are introduced in November and December. Products introductions usually ramp-up in the first quarter of each year – especially in January – and peak in April and May, and September and October, during prime trade show season. But the falloff in v3 adoptions is worth monitoring.

I stand firm in the belief that GPLv3 adoptions will ramp up this year. I think the falloff is a natural part of the software introduction and adoption cycle paralleling product introductions.

Trends of 2008

Each year I summarize the trends for the coming year. These trends are derived from things I know something about and especially from watching Black Duck’s business; talking to customers, partners and analysts; listening to our sales force and reseller channel; and taking note of market feedback and suggestions from Black Duck and other executives, and many others. (Fashion and celebrity trends are not included; wrt these topics I plead ignorance.)

This year I have identified seven (7) trends, or eleven (11) trends – depending on how you count them. I think this is the year of the market segment, so I identify four markets which will emerge in 2008. If you regard them as sub-trends you get 7; if you see them as major trends, you get 11 trends. In either case, there is significant market maturity in the open source arena so trend spotting is being more complex:

1. An increase in the number and magnitude of lawsuits and legal actions. There is no question that the most significant event in the FOSS-world in 2007 was GPLv3. Second most significant is a series of events-- the lawsuits and legal actions brought by the Software Freedom Law Center (SFLC) on behalf of the BusyBox and other GPL software developers.

Simultaneously, Black Duck has seen a significant expansion in our business in 2007 for three reasons: (1) Companies have established and documented the controls necessary to comply with Sarbanes-Oxley (SOX) and have moved from "documentation" to "process improvements." Now they are figuring out how to automate those controls and reduce the cost of compliance. (Black Duck plays a role here as companies take control of their software assets); (2) the market for software compliance will evolve and expand over the coming years as more enforcement actions are taken, and (3) more corporations are thinking beyond compliance and realizing that Black Duck products are ideal for integration into new software development methodologies or the application development lifecycle.

The year 2008 will be the year of compliance and enforcement. It will also be another very strong year for Black Duck as we introduce a new product line expansion that will help software developers early in the application development lifecycle.

2. GPLv2 will continue to dominate, GPLv3 will grow steadily and the Affero license will be newsworthy. The introduction of GPLv3 was in many ways one of the defining events of 2007. In 2008 v3 adoption will continue to increase as more open source projects are released, but v2 will continue to be popular for projects involved with software distribution. It appears that v3 adoption is taking longer than expected because software developers and especially their attorneys have not warmed-up to v3’s new patent provisions.

We also believe that in 2008 the GPLv3 adoption numbers will not be as closely watched. Except for the first year anniversary of the introduction of v3 and lawsuit announcements, this issue will simply fade into the background. We believe that closer attention will be paid to the GNU AGPLv3 (so-called Affero) license, especially with respect to Google's and other on-line services' adoption.

3. VC funding for Open Source Vendors (OSVs) will decline. The US model for VC funding of FOSS projects was to identify an established project with a vibrant community and build the company from there. MySQL was the first big one; this year it will likely go public or be acquired. Many other OSVs followed in 2007 resulting in a significant industry. In 2008, there will be many fewer OSVs created from open source projects. Many of the ventures which were first funded in 2005-2006 will be sold or merged into other entities this year. Open source, however, will be a big part of the software development culture. It will continue to fuel the business models of innovative startups and new ventures, and will become the backbone of enterprise computing.

Another indication of market maturity is manifested on the marketing side as OSVs are finally learning to call themselves as market makers rather than relying on “open source” messaging as the primary go-to-market positioning vehicle. SugarCRM within the CRM market and EnterpriseDB in the database market are two examples of this trend. This will lead in stronger market differentiation for these players who mainstream their messages and result in more VC being invested in these OSV leaders.

4. FOSS use and OSV formations will soar in specific market segments in 2008:

a. Healthcare. A sector that has suffered from cost concerns from its inception will be receptive to open source adoption this year and significant growth in FOSS use. While there are quite a few open source projects in healthcare – such as IBM’s Interoperable Health Information Infrastructure (IHII) and Eclipse Open Healthcare Framework (EOHF), both built with an open source framework, and the Veterans Health Information Systems and Technology Architecture (VistA) – in 2008 there will be significantly more standalone projects and use of open source in healthcare applications. The issues of reliability and security which have previously stymied its adoption will become a thing of the past. In 2008, the US healthcare sector will become a hotbed of open source software development – albeit on a small scale. 2009 will witness more widespread development efforts.

In the developing world, open source will play a major role in healthcare information systems and will make a big difference.

b. The Worldwide Mobile and Telecommunications Industry. Open source has been used aggressively by ODMs since the mid-1990’s as a way of driving down the cost of development. Embedded Linux and databases were first, and then some open source applications and utilities (such as Log4j) formed the M/T open source stack. Asterisk, the leading open source telephony platform, has emerged as a momentum driver, in addition to legal actions involving alleged open source license violations against telecommunications market leaders BT and Verizon.

c. The Government Sector, including Government Contractors. I was amazed to find that at the AFEI (www.afei.gov) Open Source Conference on December 11^th and 12^th, all the attendees referred to open standards as open source. (Bernard Golden of Navica had the same observation.) There are increasingly more federal government software development managers and IT managers who plan to use or adopt open source in 2008. This will drive additional adoption downstream: Among the big contractors, sub-contractors, SMBs (see below), minority businesses, etc.

d. Small-and-Medium Businesses (SMBs) will increase their use of FOSS in large part because it will be integrated into their practice areas by value-added resellers/integrators. Open source projects will also mature to address vertical requirements of SMBs. For example, a point-of-sale solution for dry cleaners is based on the open source OpenBravo ERP.

e. Inter-corporate (multiple large scale enterprises) projects in the US. Corporations working together on open source projects will think about their industry problems and solutions in a much more expansive way. Last year some projects gained significant traction. For example, the pharmaceutical industry has launched Farmavita.net solutions. Going forward, look for more industry collaboration around open source. One vertical ripe for this type of initiative is the auto industry.

5. Open Source adoption, OSV formation and Proprietary/Closed Source Software Maintain Market Share Balance. Many open source projects originated in Europe, such as SuSE in German; Linux and MySQL in Sweden; Mandriva, Zope and Plone in France; Drupal in Belgium; Alfresco in the UK, and others. Several countries like Spain, Belgium, the Netherlands, Italy and others did not witness growth in open source adoption. This was due in part to the strong local base that Microsoft has established in these countries. In 2008, open source projects and adoption, and new OSVs, will grow substantially in Europe, especially in the smaller countries of Europe (i.e., countries other than Germany, France, and the UK).

Asian open source projects and adoption will continue to expand. However, the difference maker will be OSVs. European OSV growth is slow in the last 2-3 years than the US, but will catch up as VC funding turns down.

In 2008 proprietary/closed source software will not be impacted by this growth. In most cases proprietary/closed source software will maintain market share. In cases or segments where market share is lost (DB, CRM, etc.), overall market will be maintained by other segments where established product in very large numbers or new products (Windows, Office, point solutions, etc.) lead to a net-zero change.

6. Outsourcers will Use More OSS and Publish Code Contents. While many outsourcers have used open source aggressively since the year 2000, mainstream outsourcers, mainly in India, have been in a state of denial about their use of open source. As outsourcers in Eastern Europe, Vietnam and China pose significant competition to Indian outsourcers, the fierce, new competitors are using open source to gain competitive advantage.

In 2008, outsourcers worldwide will increasingly publish the contents of their code to their clients. They have enjoyed a honeymoon in recent years because enterprises have focused on project delivery as opposed to the contents of the deliverable. Enforcement actions and lawsuits by the SFLC will lead technology companies and enterprises to pressure outsourcers to provide complete reports of code contents with great specificity.

7. The final decline of LinuxWorld. In the early years (2002-3) LinuxWorld was an important incubator of LAMP stack projects and OSV formation. In those times, foundations were a major vehicle for involvement in the FOSS community, and the attendees were mostly hobbyists and small developers. The 2007 LinuxWorld was dominated by hardware vendors and maturing and established OSVs.

In the US in 2008, OSBC and vertical software shows will emerge as the new center of gravity for visionary business people and developers and LinuxWorld will further decline in significance. LinuxWorlds outside the US will continue to prosper as these markets gear-up in OSS adoption.

--- ooo ---

One of the fun parts of writing a blog is that you can actively and accurately refer back to your predictions, in a self-criticism mode, and monitor how you are doing. I will be interested to see how these trends play out. Another fun part of writing a blog is soliciting feedback.

Gentle Reader: What do you think of the trends outlined above?

Mark Radcliffe's “Top Ten” List of FOSS Legal Developments in 2007

According to Mark Radcliffe, senior partner at DLA Piper and 25-year veteran of practicing law in Silicon Valley, the year 2007 was “the most active year for legal developments in the history of free and open source (‘FOSS’).” It was also a year of many “firsts”, including many important legal and industry developments.

Mark’s “top ten” list of FOSS legal developments in 2007 is as follows:

1. Publication of GPLv3

2. SCO’s Attack on Linux Collapses

3. First Legal Opinion on Enforcing a FOSS License

4. First US Lawsuit to Enforce GPLv2

5. First Patent Infringement Lawsuit by Patent Trolls against FOSS Vendors

6. First Patent Lawsuit by a Commercial Competitor against a FOSS Vendor

7. Microsoft Obtains Approval of Two Licenses by OSI

8. German Court Finds that Skype Violates GPLv2

9. New License Options

10. Creation of Linux Foundation

I would strongly recommend reading the details in Mark’s list at the link above.

FOSSology

HP's has launched the "FOSSology" project with a "soft" launch yesterday. In late January, they will do a larger public announcement. To learn more about FOSSology, this is the site: http://www.fossology.org/

FOSSology is, as promised, an open source project released under GPL v2 and offered for free. We can now officially welcome HP to our market. FOSSology is a nice tool for developers. It will result in software developers being better informed about their use of GPL. That makes it a very worthy tool.

Nice work HP. Welcome.

A win for the good guys

The Software Freedom Law Center's (SFLC) court case against Verizon for BusyBox GPL violations might still be pending, but they just got Xterasys to settle. According to the SFLC's complaint, they informed Xterasys back in 2006 that they were violating the GPL, but Xterasys took no action to rectify the situation until this week. According to internetnews.com:

As part of the settlement Xterasys will cease distributing BusyBox code until the SFLC can verify that Xterasys is in compliance with the GPL. Xterasys will also appoint an internal person to ensure GPL compliance. There is also an undisclosed financial sum that Xterasys will pay.

Needless to say, this is a major victory for FOSS and the GPL. Keep it up, SLFC. You're on the side of the angels.

HP’s Open Source Code Analysis Solution

We have heard repeatedly over the last year that HP is about to announce a source code analysis tool that will be open sourced and given away for free. HP will open a Web site, a forge, where this tool will be offered. This tool is about to be announced, but no one outside of HP is sure when that will be.

As I have said before in this space, HP: We welcome you to the software compliance market! We think it's great that you are getting into our market. It’s a big, beautiful market with lots of enterprise, government and technology customers, and a free solution would be a great addition to Black Duck’s protexIP, exportIP and transactIP solutions. (One offering in our space is already offered on a practically free basis!)

Don’t fret, HP. Come on in. The water is fine.

Funambol takes the AGPLv3 plunge

Funambol might be known for what they call their “open source mobile email & PIM sync solution,” but now they're going to be celebrated as being the “first major open source software company” to adopt the AGPLv3 license. Designed to close the so-called ASP loophole, the AGPLv3 requires companies that modify open source software running over a network (as opposed to being delivered on a CD or DVD) to make the source code publicly available.

According to Benjamin Mako Hill of the Free Software Foundation,

The GNU GPL has been the most successful free software license because it makes a program's source available to its users. This enables massive collaboration between developers, since everyone gets the same benefits from this rule. The GNU AGPL will enable the same kind of cooperation around web services and other networked software.

Funambol says the AGPLv3 is consistent with the Honest Public License the company had been developing since late 2006, but it switched to the AGPLv3 to eliminate an unnecessary multiplication of free software licenses.

I think this is a bold decision. This decision reinforces Funambol’s position as a leader in the open source industry. As I wrote in this blog in May 2007: Man up Google! Only time will tell whether other open source companies in the SaaS space will follow suit.

SFLC to Verizon: Can you hear me now?

There's no question that the number of lawsuits involving Open Source licenses, especially the GPL, is increasing in number and scale. Verizon is the highest-profile target so far: this week the Software Freedom Law Center (SFLC) slapped the company with a GPL copyright lawsuit over its router software. SFLC says that the router software used with Verizon's new FiOS broadband service uses software based upon BusyBox, which the developers licensed under GPLv2. In such case, the SFLC contends, Verizon must make the source code available – something Verizon has steadfastly refused to do. Meanwhile, the SFPC has also filed three other lawsuits on behalf of BusyBox since the beginning of November.

As Mark Radcliffe first noted on his blog in November, the suits filed on behalf of BusyBox highlight the SFLC's aggressive new GPL enforcement strategy. For the SFLC, failure to release the source code for software based on GPLv2-licensed code is the trigger.

“SLFC consistently takes the position that the failure to comply with all of the terms of the GPL 'terminates' the permission in the license and the licensee becomes a copyright infringer,” Radcliffe writes. He goes on to give companies contacted by SFLC some advice: “The clear lesson from these suits is to respond quickly if SFLC contacts your company and try to resolve the issue promptly.”

For its part, Verizon has had no comment on the case. Now we wait to see what other companies run afoul SFLC and get the worst of all holiday presents – a lawsuit.

"The skinny on GNU GPLv3"

My discussion with Network World's Jason Meserve about GPLv3, what it means for software developers and the meaning of some licensing terms. Also, tracking GPLv3 trends and a question about the Monsoon lawsuit.

To hear podcast, click here. (14:26)

Black Duck’s “Free and Open Source License Resource Center” -- It's live!

Today we introduce the first accurate sizing of free and open source licenses in the development environment today.

Black Duck’s “Free and Open Source License Resource Center” went live today. This resource center is an online guide of particular interest to companies developing or deploying software that includes code governed by version three of the GNU General Public License (GPL) or Lesser General Public License (LGPL).

Kudos to the Black Duck marketing and engineering teams who that helped create this page; kudos to the spider and QA team who help maintain it.

Latest GPLv3 Stats

As of today Black Duck is tracking 605 GPLv3 projects – up 11% from 9/30 from 545 projects. LGPL3 projects have held steady at 74. This means that we have identified 679 total GPL and LGPL projects flying the V3 flag.

GPLv3 update

As expected, the latest data indicates more down-to-earth growth rates in deployed GPLv3 licenses.

As of today, GPLv3 exceeded the 500 project level (506), and this represents a 12 percent increase over last week. LGPLv3 hit the 74 project level, a 32 percent week-to-week growth rate. While we can expect variations in the coming weeks and months, these rates are showing more down-to-earth growth.

The total number of deployed GPLv3 and LGPLv3 projects has now reached 580 – a 15% increase over the September 7 level.

GPLv3 update

The latest data indicates steady growth in deployed GPLv3 licenses and a significant jump in deployed LGPLv3 licenses – but don’t focus too much on this latter data point.

As of September 7, GPLv3 reached the 450 project level, which is a growth of 48 percent since August 6.

Not to be outdone, LGPLv3 hit the 56 project level, a significant 87 percent growth from August 24. This may not be a sustainable trend, so we will monitor it in forthcoming blog entries.

Lastly, our crackerjack “Spider Team” at Black Duck reports that the total number of deployed GPLv3 and LGPLv3 projects reached 506 – an 18 percent increase over the August 24 level.

Overall, we're seeing steady growth in GPLv3 and LGPLv3 that we will continue to monitor.

Pinocchio doesn't live here

While adoption of GPLv3 is coming along slowly but surely, it's important not to inflate current adoption rates. In a recent blog post, Noah Clements from the Association for Competitive Technology took a vendor to task for doing just that:

Basically, what they did was to count all the projects licensed under version 2 “or later” as having converted to GPLv3. Furthermore they used unexplained estimates of “conversion rates” and “impact” to arrive at the “or later” figure in the first place. No matter how you slice it, that is dishonest.

Black Duck Software applies exacting standards to the harvesting, categorization, and analysis of licenses. Our enterprise customers and the open source community respect Black Duck Software because of the honesty and integrity that goes into everything we do.

v3 Growth

GPLv3 was a major change in many respects. I discussed this back in March in my post on the third draft of GPLv3, and Black Duck’s website has information about this as well.

On August 6, I reported in a blog entry that 305 projects have adopted GPLv3 since it was announced on June 29. As of August 17, that number had swelled to 335. That’s a 10 percent increase in two weeks! Meanwhile, 24 projects have adopted LGPLv3. That makes a grand total of 359 projects adopting either license.

Between these v3 licenses, GPL is chosen 9-out-of-10 times. This is the same ratio we had with v2 licenses. We have not seen a significant exodus to other licenses, nor have we seen a significant uptick in adoption of LGPLv3, which operates the same way as LGPLv2: reciprocity/copyleft is limited to the original work itself (i.e., it doesn't extend to code that is linked to).

It seems that with v3 licensing, the more things change, the more things remain the same.

Welcome to Open Source 3.0

On June 29, the Free Software Foundation (FSF) concluded a community-based drafting, editing, and commentary process and released its GNU General Public License (GPL), version 3. Since then Black Duck is tracking more than 305 (as of today) free and open source software projects that have already published code under the new license. (Be aware of counts based on announced intentions, blog entries or less than rigorous spidering.)

If Open Source 1.0 started in 1989, when the original GPL was written by Richard Stallman, and the Open Source 2.0 period stretched from 1991 to mid-2007 when GPL 2.0 was dominant, then GPLv3 has ushered in a new era. I call it Open Source 3.0.

The conclusion of GPLV3 process and its launch has ramped up interest and demand for open source -- not just GPL, but for other open source projects as well. The reason? The elimination of uncertainty.

While enterprises have changed over time -- being more cost conscious, reducing the number of vendors in the supply chain, reusing more code, and rejecting incumbent vendor licensing models while adopting new ones (such as subscriptions) -- they still react negatively to uncertainty. And it appears that the advent of GPLv3 has slain the dragon of uncertainty and unleashed demand for open source and Black Duck technologies.

Since GPLv3 was introduced, we have seen a significant expansion of our business. Proprietary companies who want to remain proprietary, enterprises who want to embrace open source, and other components in between are engaging with us with new levels of interest. We are also seeing a new wave of open source development in the form of projects and ventures.

This rush of new customers is clear evidence that GPLv3 is knocking down legal hurdles and warming cold feet. Companies are now focused on code reuse instead of lawsuits. Trepidation is making way for innovation.

So if you're a company that is still sitting on the sidelines, wanting to use open source code but still unsure, I say: Welcome to Open Source 3.0. Come on in. The water's fine.

SugarCRM makes a sweet choice

Today’s announcement by SugarCRM that their next major Sugar Community Edition release will adopt GPLv3 has generated lots of ink.

John Roberts, Sugar’s CEO, said the following as part of this announcement:

We are proud to adopt the GPLv3with our next major Sugar Community Edition release. We would like to thank the Free Software Foundation (FSF) for leading such an important effort to deliver the most modern FOSS license. The FSF undertook a very difficult process and incorporated many diverse developer and user needs and combined them into a fair and just representation of what FOSS means to our communities.

In a previous blog entry, I wrote I felt that the OSI did not do enough to communicate around the OSD with respect to other companies. John did the right thing by at first asserting and holding fast to his company’s position relative to the Gartner Group, OSI, and the open source community. But after considerable community commentary, his company has adopted a very rational and effective solution.

Bravo, John.

Samba already went GPLv3 in in early July, and GPLv3 will no doubt get a further boost from today's announcement by Sugar. GPLv3 seems destined to become the eventual standard for open source licensing and takes some momentum away from the Mozilla Public License (MPL) -- a northern California favorite -- that was gaining favor after the release of GPLv3 draft 2 because of the the patent, DRM, and other conditions in that draft. Now, because GPLv3 has sweetened the deal (so to speak), SugarCRM will be able to offer customers its Professional edition with a commercial license.

Chalk up another success for dual licensing and GPLv3.

GPL3: Time Will Tell

GPL3 and LGPL3 was released today.

The effort made around GPL3 has been unprecedented and extraordinary. In this distributed license creation, education and commentary effort, the FSF brought together so many technology companies, lawyers, developers, government representatives and others to contribute their time and expertise. These participants and the FSF had very different visions of GPL3 and how free and open source software (FOSS) should work and coexist. Bringing them all together to sort through the issues makes GPL3 a historic and remarkable achievement.

From the beginning, Black Duck has been involved in the process as a participant on Committee C, having both the company’s General Counsel, Kat McCabe, and a key advisor, Karen Copenhaver, attended meetings. Committee C was populated with attorneys and other representatives of large users from the U.S. and all over the world. The analysis of drafts provided by the Committee was rapid and rigorous. I found it energizing to read email reactions to the drafts and issues.

Eben Moglen did a supreme job driving the overall process, license, and the intellectual underpinnings of the new version as well as commentary of proposed changes. At some points over the last 18 months he looked totally worn out, carrying the weight of the process, his clients and community on his shoulders. He deserves a lot of credit for the realization of this achievement.

Through the long and very detail oriented process, attorneys for the FSF and the Software Freedom Law Center (SFLC) – especially Richard Fontana – did a tremendous job. They were clear, reasoned and helpful. And their openness, patience and diligence were remarkable. Taking in comments from all sides and trying to address as many concerns as possible was certainly challenging. The FSF showed a lot of willingness to respond to concerns and moved considerably on a number of issues, including patent retaliation and DRM. Whether that effort produced a license that companies will use or adopt – that will take some time to determine. Whether that effort produced a license that companies will use or adopt – that will take some time to determine.

Did the FSF fulfill their mission?