FAQ

Complying

Can I really give nothing?

Yes. Publish a declaration saying you gave nothing and why, and you are fully compliant. Not grudgingly tolerated, not on a watchlist. Compliant.

This is not a loophole that will be closed later. Section 10.2 promises that no future version can impose an obligation beyond publication, and that promise is in the binding text precisely so it cannot be quietly withdrawn. The reasoning is here.

What actually happens if I do not publish?

Your permissions are suspended until you do. If you fix it within thirty days of noticing, they come back automatically and retroactively, whether or not anyone told you. If a licensor formally notifies you and you fix it within thirty days, they come back permanently. The machinery is lifted from GPL-3.0 section 8, which exists because this exact concern was raised about GPL-2.0 and was solved twenty years ago.

How much work is this?

The first year, realistically a day or two, most of it spent looking at the tree rather than writing the file. After that, a couple of hours, because the method is written down and last year’s file is a template. If it is taking longer than that, something has gone wrong: the format is deliberately small and the full component enumeration is optional.

We use forty things under this licence. Forty declarations?

One. Section 3.4: a single declaration satisfies the obligation for all covered software however many licensors are involved. Which means the second project you adopt costs nothing extra to comply with, and the licence gets cheaper as it spreads. That is unusual enough to be worth pointing out to whoever reviews it.

We never distribute anything. It is all internal.

You still declare. The obligation attaches to the organisation annually, not to a deployment, which is what makes internal-only use workable at all: there is no public instance to publish from, so it publishes from your corporate domain instead. This is also why the obligation is public rather than running only to users, the way AGPL’s does. An obligation with no audience does no work.

Does it cover our subsidiaries?

Yes, and one declaration covers the group. “You” is defined to include entities under common control. Making each subsidiary declare separately would multiply the cost for exactly the large organisations whose participation matters most, and would produce worse data rather than better.

Do I have to list every dependency?

No. You need a count and a description of how you arrived at it. Listing them all is optional, and for most declarations a link to your SBOM is the better answer. Naming eleven components well is worth more than listing four hundred.

Privacy and risk

Does this expose our proprietary code?

No, and not by accident. Only publicly registered components are ever counted. Your internal work does not appear, and neither does the fact of it: there is no field for how many proprietary components you have, and there will not be one, because “we have 43 internal components” is competitive intelligence. The privacy rules are part of the format.

What if publishing something would be unsafe or unlawful?

Section 6 lets you omit it, provided the declaration says that something was omitted and which field it relates to. You never have to say what, and you never have to say how much. A stock licence cannot offer a safety valve like that, and it is one of the few honest reasons to write new text rather than add a sentence to Apache 2.0.

Could a thin declaration be used against us?

The intent is no: section 11 says nothing in a declaration is a representation or warranty, and section 3.3 says nobody may assess or reject one. Whether a sentence in a software licence actually achieves that against consumer protection or fair-trading law in a given jurisdiction is a real question that this draft is not competent to answer, and it is on the list of things a lawyer needs to look at first.

Does this send you our dependency data?

No. Nothing phones home, there is no telemetry, and there is nothing to register for. You publish a file on your own server. The tool runs entirely in your browser. Registries crawl what you have already made public, and you are free to block them, though it would be a slightly odd thing to do to a file you published deliberately.

Licence status

Is this open source?

Not in the sense that has a definition. It has not been submitted to the Open Source Initiative and, on the current reading, would probably be rejected. Until that changes the accurate description is source-available with a disclosure obligation, or open-plus-disclosure if you want a friendlier phrase.

Claiming approved status before approval is the fastest possible way to lose the argument, and there is a live example: a well-known knowledge tool markets itself as open source on a source-available licence and gets publicly corrected for it, at a real cost to its credibility. Not worth it.

Why would OSI reject it?

Two clauses of the Open Source Definition are the likely grounds:

• Clause 1, no fee. The counter is that no fee is charged and nothing must be given. The obligation is to publish a document.
• Clause 6, no discrimination against fields of endeavour. The counter is that the obligation applies identically to everyone and discriminates against nobody.

The precedent to be honest about is the Hippocratic License, rejected in about 2019, widely covered, and with near-zero adoption since.

What is the actual argument for approval?

1. The binding obligation is publishing a document. Nothing must be given.
2. Notice requirements are OSD-compatible. Every licence has them.
3. AGPL compels an affirmative act with far greater cost, assembling and hosting complete corresponding source, and AGPL is approved. So “you must publish a document” cannot be disqualifying in itself.
4. The expected counter is that AGPL’s obligation is about the software while Hippocratic’s was about conduct in the world. The rebuttal is that publishing your dependency provenance is about the software. It is supply-chain transparency, not ethics in general. Under the framing on the why page, this stops being a rebuttal and becomes the whole point.

So will you apply?

Not soon, and possibly not ever. The order that makes sense is: draft, use it, get others using it, and only then apply, if there is a reason to. Adoption is the lever, not argument. PolyForm never applied at all, which is arguably the more honest position: its drafter knew it would fail and did not pretend otherwise.

What is the base licence?

Undecided, and published undecided rather than guessed at. Apache 2.0, MPL 2.0 and AGPL 3.0 are all live. The full comparison and the question that would settle it.

Adopting it

Can I use this for my own software?

Yes. That is the intention, and it is not a courtesy: a licence that only works for one product is capped at that product’s adoption, and MongoDB proved that enormous software adoption does not transfer to licence adoption anyway. You will not find any product name in the licence text, the JSON schema, or the .well-known path. Everything here is CC BY 4.0 so it can be adopted, forked or renamed without asking.

Can I publish a declaration without using the licence?

Yes, and this is the more likely path. The format has no dependency on the licence. Publish one voluntarily under MIT if you like. If the format spreads first, the licence becomes the formalisation of something people already do, which is the easiest adoption path any licence has ever had, and roughly how security.txt spread with nobody obliged to use it.

Do you take a cut of anything?

There is nothing to take a cut of. No money moves through any part of this. No payment rail, no wallet, no escrow, no fee, no percentage. Maintainer profiles link to funding channels that already exist, and that is the extent of it. The moment money flowed through here it would need a company, and the company would need to behave well forever, which is precisely the failure this design was rebuilt to avoid.

Is there a badge?

No, and there should not be. A badge implies somebody issued it, which implies somebody assessed you, which is exactly what section 3.3 forbids. Link to your declaration if you want to. Let people read it.

This project

Who wrote this?

One developer in New Zealand, roughly thirty years into writing commercial software, who wanted a licence for a project of his own and could not find one that did what he needed. Which is a weakness, not a credential. A standard owned by a sole trader in New Zealand does not get referenced by anybody who matters, and the intended end state is that it is owned by a body that is not this project. More on governance.

Why is this at oosl.org?

Because the domain was already registered and sitting idle. It stands for Open Ownership Software Licence, an earlier and completely different attempt by the same author, abandoned because it had a pay-to-read tier, a unilaterally variable fee schedule, and an obligation running to an institution that would one day cease to exist. That last failure is the direct ancestor of the zero floor, so the domain is at least thematically appropriate. A proper domain will follow once the name is settled, and the name is not settled.

What is the software this was drafted for?

A knowledge tool called Kanecta, which has been in development for about two decades and is not the subject of this site. It is mentioned here only because the honest answer to “why does this exist” involves it, and because you should know that the author has a specific interest. It appears nowhere in the licence text, the schema, or the path, and the design would be the same without it.

How do I argue with it?

Issues on the repository. The most useful contributions right now are the ones on the open questions, and the single most useful of those is the base licence. Free critique is also available on the OSI licence-review mailing list, which is a much cheaper first reviewer than a lawyer and considerably less polite.