decoration decoration

When you want to know more...
For layout only
Site Map
About Groklaw
Legal Research
ApplevSamsung p.2
Cast: Lawyers
Comes v. MS
Gordon v MS
IV v. Google
Legal Docs
MS Litigations
News Picks
Novell v. MS
Novell-MS Deal
OOXML Appeals
Quote Database
Red Hat v SCO
Salus Book
SCEA v Hotz
SCO Appeals
SCO Bankruptcy
SCO Financials
SCO Overview
SCO v Novell
Sean Daly
Software Patents
Switch to Linux
Unix Books


Groklaw Gear

Click here to send an email to the editor of this weblog.

You won't find me on Facebook


Donate Paypal

No Legal Advice

The information on Groklaw is not intended to constitute legal advice. While Mark is a lawyer and he has asked other lawyers and law students to contribute articles, all of these articles are offered to help educate, not to provide specific legal advice. They are not your lawyers.

Here's Groklaw's comments policy.

What's New

No new stories

COMMENTS last 48 hrs
No new comments


hosted by ibiblio

On servers donated to ibiblio by AMD.

CPAL Approved By OSI
Thursday, July 26 2007 @ 08:48 AM EDT

Ross Mayfield of SocialText submitted a license, the Common Public Attribution License (CPAL), which was just approved by OSI as an Open Source license. It is being spun by some as a "victory" for the logo-on-every-page crowd, but it's not that simple. I'd describe it as a compromise in that the license is a very limited arrangement to make sure authors do get some acknowledgement if others do, and the language comes from an OSI-approved attribution license already in existence.

Mayfield showed respect to the process, acknowledged that a project using it couldn't be viewed as Open Source unless or until it was approved by OSI, and modified his license language until it could be. Specifically, the attribution language was taken from the Adaptive Public License, which was already an OSI-approved license, and as you will see, the new license is practically identical, so there is no big change at OSI, and no, this is not the first attribution license to be OSI-approved. Even GPLv3 allows you to require attribution, after all. I'll show you the SugarCRM license and contrast it with the OSI-approved CPAL license requirements, so you can see the difference.

SugarCRM may switch to the new OSI-approved license, they are saying, for commercial products. If so, as I will show you, it would be a big change for them. Some will route around such licenses anyway, by avoiding code that uses such a license, of course, as Ashlee Vance reports:

Google's open source guru Chris DiBona, however, told us that Google will just make its own code when needed to get around clauses similar to these. "We have enough engineer resources that, if the license has obligations we are not interested in, we can just not use it," he said.

You can always write a license demanding anything you like, but the other side gets to then decide if they want to be annoyed with you or not. I can release code demanding your firstborn if you use my code, and you can then decide if my terms are worth it. Probably not.

OK. So now let's look at the licenses. If you read the draft of the CPAL license, you will see the requirements regarding attribution. Clause 14 talks about attribution on splash screens, and they are not obligatory in all circumstances. For example, if there's no GUI with a splash screens already, you can't demand one. And what you can require is greatly scaled down from what some badgeware licenses were asking for:


(a) As a modest attribution to the organizer of the development of the Original Code ("Original Developer"), in the hope that its promotional value may help justify the time, money and effort invested in writing the Original Code, the Original Developer may include in Exhibit B ("Attribution Notice") a requirement that each time an Executable and Source Code or a Larger Work is launched or run, a prominent display of the Original Developer's Attribution Information (as defined below) must occur on the graphic user interface (which may include display on a splash screen), if any. If the Executable and Source Code does not launch or run a graphic user interface, this obligation shall not apply. If the Original Code displays such Attribution Information in a particular form (such as in the form of a splash screen, notice at login, an "about" display, or dedicated attribution area on user interface screens), continued use of such form for that Attribution Information will meet this requirement for notice.

(b) Attribution information may only include a copyright notice, a brief phrase, graphic image and a URL ("Attribution Information") and is subject to the Attribution Limits as defined below. For these purposes, prominent shall mean display for sufficient duration to give reasonable notice to the user of the identity of the Original Developer and that if You include Attribution Information or similar information for other parties, You must ensure that the Attribution Information for the Original Developer shall be no less prominent than such Attribution Information or similar information for the other party. For greater certainty, the Original Developer may choose to specify in Exhibit B below that the above attribution requirement only applies to an Executable and Source Code resulting from the Original Code or any Modification, but not a Larger Work. The intent is to provide for reasonably modest attribution, therefore the Original Developer cannot require that You display, at any time, more than the following information as Attribution Information: (a) a copyright notice including the name of the Original Developer; (b) a word or one phrase (not exceeding 10 words); (c) one graphic provided by the Original Developer; and (d) a URL (collectively, the "Attribution Limits").

(c) If Exhibit B does not include any Attribution Information, then there are no requirements for You to display any Attribution Information of the Original Developer.f

(d) You acknowledge that all trademarks, service marks and/or trade names contained within the Attribution Notice distributed with the Covered Code are the exclusive property of their owners and may only be used with the permission of their owners, or under circumstances otherwise permitted by law or as expressly set out in this License.

You can see how scaled down the requirements are if you compare it with the SugarCRM "Open Source" license terms, which require this:

II. SugarCRM and logo. This License does not grant any rights to use the trademarks "SugarCRM" and the "SugarCRM" logos even if such marks are included in the Original Code or Modifications.

However, in addition to the other notice obligations, all copies of the Covered Code in Executable and Source Code form distributed must, as a form of attribution of the original author, include on each user interface screen (i) the "Powered by SugarCRM" logo and (ii) the copyright notice in the same form as the latest version of the Covered Code distributed by SugarCRM, Inc. at the time of distribution of such copy. In addition, the "Powered by SugarCRM" logo must be visible to all users and be located at the very bottom center of each user interface screen. Notwithstanding the above, the dimensions of the "Powered By SugarCRM" logo must be at least 106 x 23 pixels. When users click on the "Powered by SugarCRM" logo it must direct them back to In addition, the copyright notice must remain visible to all users at all times at the bottom of the user interface screen. When users click on the copyright notice, it must direct them back to

Mayfield also submitted a compliance document, explaining how the license met all 10 points of OSI's definition and here is the explanation of the attribution elements:

The Common Public Attribution License (CPAL) is the result of significant review and modification based on Socialtext’s initial submission of the Generic Attribution Provision (GAP), Socialtext Public License (STPL) and the comments from License Discuss.

CPAL is based on the MPL which has been approved and all of the new provisions are in Sections 14 and 15 (and Exhibit B) and adding “Original Developer” to certain disclaimers ("Original Developer" is a term defined in the new provisions for those who originally created the program who may be different from the "Initial Developer"). Section 14 provides for an attribution notice based on the Adaptive Public License and Section 15 provides for a network use provision based on the commonly used provision on “External Deployment” found in the Apple Public License, Real Network Public License and the Open Software License. We have used the Adaptive Public License as the basis for the attribution provision because it was approved after OSD 10 was adopted. In addition, it was the basis for the attribution provision of in Exhibit B of the draft STPL which was submitted for approval, but superseded by this agreement. Socialtext believes that the application software has special needs as compared to operating systems because of the application software can be used anonymously in large distributions and can be used to provide services through an ASP which does not provide modifications back to the community. None of the approved OSI approved licenses include both a network use provision and an attribution provision. We have limited the new provisions to those which are either the same or very close to provisions from existing licenses (see above).

We have made the following major changes to the GAP and STPL approach:

1. We have made the provision part of a specific license (MPL) and we have made the license a template which can be reused. We removed references to Socialtext in the agreement.

2. We have used the Adaptive Public License as the basis for the attribution provision because it was approved after OSD 10 was adopted. This change will avoid the debate over whether the Attribution Assurance License (upon which GAP was based) would comply with OSD 10. The need for attribution provision has been acknowledged by the final draft of the GPL version 3 which includes attribution as an option under Section 7(b).

3. We have provided that the attribution obligation would not apply if the product does not have a graphic user interface.

4. We have limited the placement requirement for attribution notice to “prominent” rather than a specified size or location. We have also permitted the use of splash screens. These terms are frequently used in other OSI approved licenses such as the GPL and NASA Public License.

5. License-Discuss has commented favorably on the Medsphere Public License (except the actual notice requested by Medsphere) which is essentially the same as the attribution provision in Section 14.

6. We have modified the network access provision from one based on the Affero license which was not OSI approved to a provision from the OSI approved licenses such as the Apple Public License, Real Networks Public License and Open Software License. It is also less technology specific.

So, don't let the headlines confuse you. Life is rarely a headline, you know. It's only journalists who see the world like that.


CPAL Approved By OSI | 135 comments | Create New Account
Comments belong to whoever posts them. Please notify us of inappropriate comments.
Off-topic here, please
Authored by: overshoot on Thursday, July 26 2007 @ 08:59 AM EDT
Please post any links as clickable HTML (instructions in red at bottom of form.)

[ Reply to This | # ]

Corrections Here
Authored by: feldegast on Thursday, July 26 2007 @ 09:01 AM EDT
So they can be fixed

My posts are ©2004-2007 and released under the Creative Commons License
Attribution-Noncommercial 2.0
P.J. has permission for commercial use.

[ Reply to This | # ]

Your deal beats Microsoft's EULA
Authored by: Anonymous on Thursday, July 26 2007 @ 09:43 AM EDT
I can release code demanding your firstborn if you use my code, and you can then decide if my terms are worth it.

My oldest son is 34 years old and still lives with his parents, has no job, and his room smells kind of funny. Of course, I'd still have to see the code, but we probably have a deal.

...Demonstrating once again why writing licenses should be left to trained lawyers wherever possible.


[ Reply to This | # ]

OSI Approved -- It's The Real Thing
Authored by: Aladdin Sane on Thursday, July 26 2007 @ 09:58 AM EDT
Oh man, I think I just violated Coke's trademark.

/me wanders off to find some coffee.

"You interact with a computer differently when you can trust it to be reliable." --from a blog comment, 2007-07

[ Reply to This | # ]

CPAL Approved By OSI
Authored by: Anonymous on Thursday, July 26 2007 @ 10:06 AM EDT
Bad, bad, bad decision by OSI. Badgeware is evil. What happens when you take 1
line of code from each of 10 projects licensed under the CPAL? Your splash
screen is going to look ridiculous. And of course this license is yet another
non-GPL (at least v2) compatible license, which just creates more divisions in
the F/OSS world.

I thought OSI was against license proliferation anyway? Why does SocialText
need the CPAL? If they wanted to be an open-source company, are we really
supposed to believe they couldn't find a suitable license from among the many
dozens of existing OSI approved licenses?

[ Reply to This | # ]

CPAL Approved By OSI
Authored by: Anonymous on Thursday, July 26 2007 @ 10:09 AM EDT
"and no, this is not the first attribution license to be

Attribution is one thing - constant, obnoxious and unreusable attribution is

Russ seemed to be of the opinion that it should be tried and if it fails then it
fails. It will fail in the sense that the code will not be picked up by others,
though the license may be.

[ Reply to This | # ]

Newspics Comments here please
Authored by: rc on Thursday, July 26 2007 @ 11:06 AM EDT
Assuming we are still doing this, if not someone hit me (gently please!) with a clue stick and I'll quit doing it :-)

As always, please use HTML mode where appropriate, remember that 'the preview button is your friend', and read (and obey!) the 'Important Stuff' at the bottom of the 'Post a Comment' page. Thanks!


[ Reply to This | # ]

Authored by: Anonymous on Thursday, July 26 2007 @ 11:25 AM EDT
On getting GPL an OSI approval. Anyone any comments? I can see certain nameless
companies packing meetings to oppose it but would it have any practical
benefits? My thoughts are that it would be harder to ignore if it was an
approved standard.


[ Reply to This | # ]

"The Original Developer cannot" -- Huh?
Authored by: FreeChief on Thursday, July 26 2007 @ 01:38 PM EDT
therefore the Original Developer cannot require that You display
Why would I, as the (hypothetical) Original Developer, put a requirement on myself into the license? I simply require something, or I do not. If I do not require it, then this requirement that I do not require it is simply redundant.

--Programmer in Chief

[ Reply to This | # ]

Now that I've read the CPAL terms....
Authored by: Anonymous on Thursday, July 26 2007 @ 02:23 PM EDT

That'll be a license whose code I may, or may not, avoid. It'll really depend on the original author of the code and how they set up the attribution.

If it's a splash screen that can't be disabled by the user and sticks around for more then about a half-second, then I'll likely be avoiding it.

If it's in the about area under an appropriate attributions section, then that works with me.


[ Reply to This | # ]

CPAL Approved By OSI
Authored by: Anonymous on Thursday, July 26 2007 @ 02:26 PM EDT
Actually, the patented system looks exactly like GameSpy.

Given that the patent applies to the whole, or extensions thereof, I don't see
how there's even a hope to apply it to a small subset of functions and say it
violates the patent.

"It's like a game server, only without the game."


[ Reply to This | # ]

a mere quibble, perhaps ...
Authored by: Rudisaurus on Thursday, July 26 2007 @ 03:20 PM EDT
... but I wonder about the wording in the "new" (CPAL) license:
[...]each time an Executable and Source Code or a Larger Work is launched or run, a prominent display of the Original Developer's Attribution Information (as defined below) must occur on the graphic user interface (which may include display on a splash screen), if any. If the Executable and Source Code does not launch or run a graphic user interface, this obligation shall not apply.
I'm a mere software developer, but I have never seen "Source Code" being "launched" or "run". To me, therefore, this is a rather curious turn of phrase to include in a legally-binding agreement, and it gives me pause (misgivings, even) about the level of understanding of the person who added that particular passage.

[ Reply to This | # ]

CPAL Approved By OSI
Authored by: Anonymous on Thursday, July 26 2007 @ 03:59 PM EDT
Business Week
Microsoft Should Welcome Piracy in India and China

Why is it that Linux is not the OS of choice?

[ Reply to This | # ]

Other criteria...
Authored by: xtifr on Thursday, July 26 2007 @ 07:04 PM EDT

Whether a license is OSI-approved only matters if you agree with the criteria the OSI uses, and, of course, with their interpretation of their own criteria. Organizations like the FSF and Debian will make up their own minds whether this is a free software license. Of course, if it's not, then this will be only the second license to win OSI approval but be rejected by the FSF and Debian, and the first, I believe, was eventually withdrawn by the vendor responsible.

Me, I tend to go with the Debian Free Software Guidelines (DFSG), not because I prefer them or trust Debian's judgment over OSI's, but simply because I run Debian for my personal systems. I know that some people were upset that Debian was unable to accept (for example) Mozilla's trademark license on Firefox (which is different from the copyright license), but I really don't care whether my browser is named "Firefox" or "Iceweasel". :)

Anyway, it looks like PJ is saying that this license is notably different from the old SugarCRM license--enough so that calling it FLOSS may well be justified. And I think I agree. This looks like a credit-where-credit-is-due license, rather than a credit-at-all-costs license. In other words, it seems to say, "if you display any logos, you must include mine", which leaves you with the option of displaying no logos at all. That seems reasonable to me. Saying "you must display my logo no matter what" means that you can't use the code in software that lacks graphics or a user interface, which is not a reasonable restriction, IMO. It would seem to violate point #6 of both the Open Source Definition and the DFSG (no discrimination against fields of endeavor).

Anyway, I think the bottom line is that you shouldn't use OSI-approval as a substitute for your own judgment.

Do not meddle in the affairs of Wizards, for it makes them soggy and hard to light.

[ Reply to This | # ]

And now Microsoft is badly seeking OSI backing for its licenses as "Open Source" (sic)
Authored by: kosmonaut on Friday, July 27 2007 @ 03:42 AM EDT
My spider sense tells me there is a patern here, let me elaborate a little bit
on it:
First, Microsoft is going after some Linux distros, in order to try to divide
the FOSS community and to subvert the 4 freedoms that the GPL is designed to
guarantee (remember that MSFT has been relentlessly attacking the GPLv3 and the
FSF long before the last version of the license was actually released)
Now they want to throat-feed its locking-in fake standard MSOOXML through the
ISO in order to subvert the stablished standard document format (ODF/ISO23600)
that, incidentally, they are the only company not willing to support in their
office suite offerings. They are stuffing the technical commitees at the ISO
(and astruturfing with fake support letters sent by their gold certified
partners who depend on MSFT for their livelyhood)in order to force a favourable
decission for MSOOXML.
As soon as they get the standard they will shout everywhere they're
"THE" standard.
It is the same so with the Open Source Initiative:
They badly want its backing so it allows them to go all around shouting they are
also "Open". In this case, it is the community collaborative
development what the corporate structure of MSFT cannot imitate, and which is
outpacing, both in quantity and in quality the development and offerings of the
monopoly: Compare or Freshmeat with Codeplex... well, they are
not even in the same league.

This "me too" strategy is deep rooted in Microsoft behaviour: whenever
a product, service, development model or standard that they do not control, is
successful they go out with their own second class offering and try to use their
desktop monopoly leverage to impose their "clone" in the market, while
at the same time eroding and subverting the original/competing one. (It already
worked with DRDOS, OS2, Novell, WordPerfect, Borland, Netscape, Palm... and they
keep trying against PlayStation -Xbox mkI & mkII-, Ipod -Zune mkI &
mkII- ...etc)
Aditionally, I suspect that if they get the standard and the open
"certification" they will go around shouting they are THE standard and
THE open way to go, but it won't take long for them to change some details in
the standard or in the licence that make them double-edged and they will be used
exclusively (in ways that are neither standard nor open) against any competing
player in the market. You can bet the licence Microsoft submits to the OSI will
be carefully designed to be fully incompatible and toxic with the GPLv3: In fact
many of these exclusive-proprietary-non-standard flaws are alredy incorporated
in their MSOOXML format or, for example, in their "covenants not to
sue" devised to attack-threaten any Gnu/Linux distros /users not caving to
Microsoft's wishes.On the other hand, if they cannot get their way and the ISO
rejects the MSOOXML format and the OSI rejects their "open" licence, I
expect a harsh campaign from Microsoft to discredit these intitutions as
So far this strategy has worked with many products and some services. Let's hope
it doesn't work so well with international standards or with community
development models and licences.

[ Reply to This | # ]

Groklaw © Copyright 2003-2013 Pamela Jones.
All trademarks and copyrights on this page are owned by their respective owners.
Comments are owned by the individual posters.

PJ's articles are licensed under a Creative Commons License. ( Details )