Draft — nothing here is settled. This is a first cut, published so it can be argued with. No lawyer has seen it. The name is not final. Do not rely on any of it.
Give Back

The binding text

Give Back Software Licence

Version 0.1, draft. A disclosure addendum applied on top of a conventional open-source base licence.

SPDX identifier: none yet Base licence: undecided ~1,400 words
Do not use this

No lawyer has read this text. It has not been reviewed for enforceability in any jurisdiction, it uses at least one term it does not properly define, and the name is not final. It exists so that people can argue with something concrete instead of with a description. If you apply it to real software you are on your own.

How it is put together

The licence is a rider, not a whole new licence. You take a conventional, well-understood open-source base licence and add one obligation to it. Two reasons: a lawyer reviewing “Apache 2.0 plus a disclosure addendum” has far less to read than a lawyer reviewing a new licence, and everything the base licence already gets right about patents, warranties and jurisdiction stays got right.

LayerWhat it isBinding?
Base licenceApache 2.0, MPL 2.0 or AGPL 3.0, unmodified. Still undecided.Yes
This addendumOne obligation: publish an annual declaration. Contains no numbers.Yes
The StandardThe norms. What a good declaration looks like, how to think about giving.No
The formatJSON shape the declaration is published in.Fields

Give Back Software Licence — Version 0.1 (draft)

0. Application

This Addendum applies in addition to, and does not replace, the base licence identified by the Licensor (the “Base Licence”). All permissions granted by the Base Licence are granted subject to the condition in section 3. Where this Addendum and the Base Licence conflict, the Base Licence prevails except as to section 3, which is a condition of the permissions granted.

Why: keeps the base licence intact so that its patent grant, warranty disclaimer and governing-law provisions do all the work they were drafted to do. Open: whether the obligation is best framed as a condition on the grant or as a covenant. That distinction decides whether breach terminates rights automatically or gives rise only to a claim, and it is a question for a lawyer.

1. Definitions

  1. “Covered Software” means software made available under this Addendum.
  2. “You” means the legal entity exercising permissions under this Addendum, together with all entities that control, are controlled by, or are under common control with that entity.
  3. “Declaration” means a document satisfying section 3.
  4. “Declaration Period” means any period of twelve consecutive months selected by You, provided the periods You select are contiguous.
  5. “Maintainer Profile” means a document published by a Licensor describing itself, satisfying section 5.
  6. “Publicly Available” means retrievable over the public internet by any person, without authentication, payment, registration, or agreement to terms.
  7. “Publicly Registered Component” means a software component that is itself Publicly Available from a package registry or source repository.
  8. “The Standard” means the guidance document published at the address given in section 8. The Standard is not part of this Addendum.
Note on 1.2: the affiliate language means one declaration covers a group. This is deliberate. Making each subsidiary declare separately would multiply the cost of compliance for exactly the large organisations whose adoption matters most, and would produce worse data, not better.

Note on 1.4: You choose your own year end, so it can be aligned with a financial year already being reported on. There is no common reporting date and there should not be.

2. Grant

Subject to section 3, You are granted the permissions set out in the Base Licence.

3. The Declaration Requirement

  1. For each Declaration Period in which You exercise any permission under this Addendum, You must make a Declaration Publicly Available within ninety days of the end of that period.
  2. A Declaration must state, in a machine-readable form:
    1. the identity of the declaring entity, and an address at which it may be contacted;
    2. the Declaration Period covered;
    3. the Publicly Registered Components relied upon by You during the period, and, so far as ascertainable by You from Publicly Available sources, the maintainer of each;
    4. what, if anything, You contributed during the period toward the maintenance of those components or of software generally, and to whom;
    5. a statement, authored by You, of why You consider the contributions described in (d) to be appropriate in light of the reliance described in (c); and
    6. the date on which the Declaration was published.
  3. The content of a Declaration is not prescribed. No minimum contribution is required. A Declaration stating that You contributed nothing satisfies subsection 3.2(d) in full, and a statement under subsection 3.2(e) is sufficient whatever its reasoning. No person may assess, score, approve or reject a Declaration under this Addendum.
  4. A single Declaration may satisfy this section in respect of all Covered Software relied upon by You, however many Licensors are involved.
  5. A Declaration must remain Publicly Available for at least five years from its date of publication.
This is the entire obligation. Everything else in the document is definition, exception, or plumbing.

Why 3.2 is a list of fields and nothing else: a missing field is objective and provable, so a court can rule on it without weighing anybody’s good faith. Weak content is not a breach at all. This is the asymmetry the whole design rests on.

Why “so far as ascertainable” in 3.2(c): without it, an unattributable component would put a licensee in permanent, uncurable breach. With it, the obligation is to make an honest attempt using public information, which is what the tool automates.

Why 3.3 exists at all: it is not strictly necessary, since nothing elsewhere imposes a minimum. It is there because the first question any reviewing lawyer asks is “what is the exposure?”, and the answer needs to be findable in the text rather than inferred from its silence.

Open: ninety days and five years are numbers, and section 4 of the argument says the binding text should contain none. The distinction being drawn is between numbers that quantify an obligation (a fee, a percentage, a rate) and numbers that bound a procedure (a deadline, a retention period). The second kind appears in every licence ever written. It is still worth a second opinion.

4. Where the Declaration is published

  1. A Declaration is Publicly Available for the purposes of this Addendum if it is retrievable at the path /.well-known/give-back.json on a domain controlled by You and reasonably associated with You.
  2. Publication elsewhere also satisfies section 3 if the Declaration is Publicly Available and can be found by a person of ordinary diligence looking for it.
  3. You are not required to submit a Declaration to any registry, index, directory or other person. No such submission is a condition of any permission granted.
4.3 is load-bearing. If compliance required registering somewhere, then the death of that registry would put every licensee in breach with no way to cure. An obligation that depends on an institution inherits that institution’s mortality, and that is the specific failure this whole design was rebuilt to avoid. Registries may crawl the published files, and they are expected to compete on doing it well. None of them is privileged by the licence.

5. Reciprocal obligation on the Licensor

  1. A Licensor distributing Covered Software under this Addendum must make a Maintainer Profile Publicly Available, stating: the identity of the maintaining entity; whether it is a for-profit entity, a not-for-profit entity, or unincorporated; the approximate number of people maintaining the software, expressed as a band; whether any of them are paid to do so; and any addresses at which contributions may be directed.
  2. If a Licensor fails to make a Maintainer Profile Publicly Available, Your obligations under section 3 are suspended in respect of that Licensor’s software for so long as the failure continues.
  3. The suspension in 5.2 operates only in respect of the Licensor from whom You received the software directly, and does not extend along a chain of Licensors.
Why the reciprocity: it removes the “you are extracting from me” objection completely, it gives every licensee a reason to want its licensors alive and visible, and it makes the whole thing self-enforcing without anybody having to police it. Almost everyone building on a platform ends up on both sides of this, so dropping your own profile to escape your duty would also void the duty owed to you.

Why 5.3 exists: without it, a lapse anywhere in a deep dependency chain could cascade unpredictably, and a cycle (A depends on B, B depends on A) could unravel the obligation entirely. Conditioning on the immediate licensor only keeps the trigger verifiable by the person who has to act on it.

6. Withholding

  1. Where publishing a particular detail otherwise required by section 3 would place You in breach of law, or would create a demonstrable security risk, You may omit that detail.
  2. Where You omit a detail under 6.1, the Declaration must state that a detail has been omitted and which subsection it relates to. It need not state what was omitted, and need not state how much was omitted.
  3. Nothing in section 3 requires You to disclose the existence, number, nature or purpose of software that is not a Publicly Registered Component.
6.3 is why this is adoptable at all. Your proprietary internal work never appears in the declaration, and neither does the fact of it. “We have 43 internal components” is competitive intelligence, and a format that demanded it would be declined by every company large enough to matter. See the privacy rules.

6.1 is only possible because this text is bespoke. A stock licence cannot offer a safety valve like this, which is one of the few genuine advantages of drafting something new instead of adding a sentence to Apache 2.0.

7. Breach, cure and reinstatement

  1. Failure to publish a Declaration as required by section 3 is a breach of this Addendum. Nothing in the content of a Declaration is capable of constituting a breach.
  2. On breach, the permissions granted under section 2 are suspended.
  3. Permissions are reinstated automatically and retroactively if the breach is cured within thirty days of You becoming aware of it, whether or not You were notified.
  4. Permissions are reinstated permanently if a Licensor notifies You of the breach and You cure it within thirty days of that notice, unless that Licensor has previously notified You of a breach of this Addendum.
Borrowed, deliberately, from GPL-3.0 section 8. The concern that licensees would be in constant technical breach through ordinary slowness is real, and it was solved once already: first violation from a given holder is curable, automatically and retroactively. Using familiar machinery means a reviewing lawyer recognises the shape and moves on.

8. The Standard

  1. Guidance on the preparation of Declarations is published as The Standard, at https://oosl.org/standard/.
  2. The Standard is not incorporated into this Addendum and imposes no obligation. It may be revised at any time. No revision of The Standard alters this Addendum, and departing from The Standard is not a breach.
  3. Software that generates, assists in generating, or publishes Declarations does not create the obligation in section 3. That obligation applies whether or not any such software is used, present, or functional.
8.2 keeps the numbers out of the binding text. Suggested amounts, percentages of IT spend and worked examples are useful, so they exist — in a document that can be revised without relicensing anything and that no lawyer has to approve.

8.3 closes an obvious hole. If the obligation looked like it came from the tool, the answer would be “we disabled that feature, so nothing applies”. The licence names the fields; the tool is a convenience.

9. No endorsement

This Addendum grants no right to use the name, trade marks or logos of any Licensor, or of the publisher of The Standard, and publication of a Declaration implies no approval, certification or endorsement by any person.

10. Versions

  1. You may comply with the version of this Addendum under which the software was made available to You, or any later version.
  2. A later version cannot impose an obligation beyond the publication of a Declaration meeting section 3.
10.2 is a promise not to tighten. Redis is the cautionary tale: BSD, then a source-available relicence in 2024, then community fury, a Linux Foundation fork in Valkey, distributions switching, and a retreat to AGPL a year later. Giving something away is applauded; taking it back is not. So the ceiling is written into the text now, while it costs nothing.

11. Disclaimer

The warranty disclaimers and limitations of liability in the Base Licence apply to this Addendum. Nothing in a Declaration constitutes a representation or warranty to any person.

The second sentence needs a lawyer. The intent is that a thin or optimistic declaration cannot be actionable as a misrepresentation. Whether one sentence in a software licence can achieve that against consumer protection or fair-trading law in any given jurisdiction is exactly the kind of question this draft is not competent to answer.

What a lawyer should attack first

Published in this order because the first item may be fatal:

  1. Condition or covenant? Section 0 asserts a condition. If it is really a covenant, breach does not terminate anything and the licence has no teeth at all.
  2. Is “relied upon” definable? Section 3.2(c) turns on it and section 1 does not define it. Build dependency? Runtime? Transitive? This is the weakest word in the draft.
  3. Does 3.3 undermine 3.1? A clause saying the content cannot be judged, sitting next to a clause requiring the content, may be read as making the whole obligation illusory.
  4. Does section 6.1 swallow section 3? “Demonstrable security risk” is not defined and is asserted by the party relying on it.
  5. Enforceability in NZ, the EU and the US. Three different answers, most likely.
Plain text version The Standard →
BackWhy this exists NextThe standard →