Undecided
Open questions
Published unresolved on purpose. A first cut that hides its uncertainty gets agreement instead of argument, and argument is what this needs.
1. The base licence
Biggest Everything else can be revised later. This one is a one-way door.
The disclosure clause is a rider on a conventional open base. Which base is genuinely undecided.
| Base | For | Against |
|---|---|---|
| Apache 2.0 | Maximum composability and adoption. Patent grant, trademark clause, international language. Corporate legal knows it cold and will not blink. | A competitor can build a closed product on the runtime and their entire obligation is one paragraph. |
| MPL 2.0 Leaning |
File-level copyleft: changes to these files must be shared, anything added alongside stays theirs. Keeps the platform open with no reach into the data layer, which removes the need for a linking exception entirely. OSI-approved and corporate-familiar. No network clause, but the disclosure clause covers hosted use. | Less protective of the runtime than AGPL. Less familiar than either of the others. |
| AGPL 3.0 | Open by default. Improvements to the platform flow back. | Blanket bans at many large companies. Does not actually stop hosted competition anyway. And it protects an asset that may not be worth protecting. |
If a large company took the runtime, improved it substantially, published none of those improvements, but published an honest declaration saying exactly that: is that acceptable, or intolerable?
Answer “acceptable” and the answer is Apache or MPL. Answer “intolerable” and it is AGPL, at the cost of the corporate adoption that is the entire point.
The current lean is MPL 2.0, on the reasoning that a runtime which bootstraps toward being driven by data is a diminishing asset, and copyleft over it defends the half already assessed as not worth defending, at the cost of the adoption that is. The competitive evidence points the same way: AGPL did not save Logseq, Backstage won its category on Apache 2.0, and Grafana is AGPL while Amazon Managed Grafana exists regardless.
Two fears were investigated and set aside as non-differentiating. Constant technical breach through slowness is solved by the cure provision in GPL-3.0 section 8, which this draft copies. And the worry that publishing source might one day become unsafe applies equally to the disclosure clause, so changing the base does not escape it; the section 6 safety valve is the answer instead.
2. The name
Reversible, but not for long
“Give Back Software Licence” is the working name and it may not survive. No obvious collision has been found, but the SPDX list, the OSI list and the New Zealand trademark register have not all been checked properly.
An SPDX licence-list search, 727 entries, found these shelves empty:
| Term | Hits in SPDX 3.28.0 |
|---|---|
| provenance, disclosure, label, ingredient, statement, transparency, declaration | 0 each |
| reciprocal / reciprocity | 5. A crowded shelf, and in licence-speak the word is a synonym for copyleft, which is the opposite of what this does. |
| attribution licence | 2 |
Three naming traps, recorded because they generalise:
- Do not put both layers in one name. An earlier candidate, “Give Back Provenance Licence”, collapses the split between the binding text and the norms at first read, and that split is the design’s whole point.
- Avoid the
*PLshelf. A four-letter acronym ending inPLreads as a member of the GNU family and signals strong copyleft to somebody whose actual question is “does this reach into our code?” - Watch the acronym.
GBPis the currency code for pounds sterling, which argues against the zero floor before anyone has read a word. And “Know Your Stack” is unusable for reasons that become obvious once you write the acronym down.
The structural alternative still on the table is a warm name for the norms and a dull name for the binding instrument: the culture document stays Give Back, and the licence becomes something like the Provenance Disclosure Addendum. Dull names get read by lawyers without an eyebrow raised; warm names carry the thing. This site currently uses one name for both, which is the simpler choice and possibly the wrong one.
3. Governance
Not urgent, easy to foreclose
This is currently one person, which does not work as an end state. SPDX had the Linux Foundation behind it; a standard owned by a sole trader in New Zealand does not get referenced by the EU.
That does not mean building an institution now. It means not building anything that would be hard to hand over later, which costs nothing today and is the same separable, product-neutral design wanted for adoption anyway. Concretely: no product name in anything structural, CC BY on all the text, no registry privileged by the licence, and no dependency on any body continuing to exist.
The template to follow is SPDX, not organic certification. SPDX went from a community format to ISO/IEC 5962 in 2021 and is now what regulators point at when they mandate SBOMs, in roughly six years, in this exact domain. Organic is the wrong shape because certification needs a certifier, and a certifier is an institution that must exist forever and behave well forever, which is the hundred-year problem this design specifically engineered out.
Honest note: this is a ten-to-twenty year proposition, most standards never make it, and none of it should be load-bearing in anybody’s plans. Upside case only.
4. Drafting problems that need a lawyer
| Question | Why it matters |
|---|---|
| Condition or covenant? | Section 0 asserts a condition on the grant. If a court reads it as a covenant instead, breach gives rise to a claim rather than terminating anything, and the licence has no teeth at all. Possibly fatal, so it is listed first. |
| What does “relied upon” mean? | Section 3.2(c) turns on it and section 1 does not define it. Build dependency? Runtime? Transitive? Vendored? The weakest word in the draft, and the one most likely to be argued about. |
| Does 3.3 make 3.1 illusory? | A clause saying the content cannot be judged, sitting next to one requiring the content, may be read as an obligation with no substance. |
| Does the safety valve swallow the obligation? | “Demonstrable security risk” is undefined and is asserted by the party relying on it. |
| Do the procedural numbers break the no-numbers rule? | Ninety days and five years are numbers. The distinction drawn is between numbers that quantify an obligation and numbers that bound a procedure. That distinction may not hold up. |
| Enforceable where? | New Zealand, the EU and the United States will most likely give three different answers. |
5. Should individuals be exempt?
Currently they are not: the obligation applies to anyone exercising the permissions, which includes a hobbyist with a Raspberry Pi. The argument for exempting them is that requiring a personal domain and an annual filing from an individual is absurd and will be ignored, and a rule that is universally ignored damages the rule.
The argument against is that a threshold needs a definition, and every definition is either a revenue figure, which is a number in the binding text, or a headcount, which is trivially structured around. The current position is to leave the text universal and let the standard say plainly that tier zero is the expected answer for individuals and volunteers. That may be too clever.
6. Smaller things, still open
- Should the declaration be signed? Currently no, on the reasoning that
TLS on your own domain is the same assurance
security.txtsettles for, and that forging somebody’s admission that they gave nothing has little appeal. - Is ninety days right? It aligns with common financial reporting deadlines. It may be too short for organisations whose year end is already crowded.
give-back.jsonorprovenance.json? Ties to the naming question. The second is more neutral and more registerable; the first says what it is.- Should the profile carry a freshness expectation? A profile untouched for four years is a signal, but is a stale profile a published profile for the purposes of the conditional obligation? Currently yes, which may be too generous.
- Does the CC BY licensing of the text conflict with anything? Licence texts are conventionally licensed oddly, often as verbatim-copying-only. CC BY invites modified forks, which is intended, but it means somebody could publish a “Give Back Licence” that says something else entirely.
What would change any of this
In rough order of usefulness: a lawyer’s read of the condition-versus-covenant question; one organisation of any size actually attempting a declaration and reporting what broke; a maintainer saying whether the profile asks for the right things; and a critique from the OSI licence-review list, which is free, fast and unsparing.