Ross Mayfield of SocialText submitted a license, the Common Public Attribution License (CPAL), which was just approved by OSI as an Open Source license. It is being spun by some as a "victory" for the logo-on-every-page crowd, but it's not that simple. I'd describe it as a compromise in that the license is a very limited arrangement to make sure authors do get some acknowledgement if others do, and the language comes from an OSI-approved attribution license already in existence.
Mayfield showed respect to the process, acknowledged that a project using it couldn't be viewed as Open Source unless or until it was approved by OSI, and modified his license language until it could be. Specifically, the attribution language was taken from the Adaptive Public License, which was already an OSI-approved license, and as you will see, the new license is practically identical, so there is no big change at OSI, and no, this is not the first attribution license to be OSI-approved. Even GPLv3 allows you to require attribution, after all. I'll show you the SugarCRM license and contrast it with the OSI-approved CPAL license requirements, so you can see the difference.
SugarCRM may switch to the new OSI-approved license, they are saying, for commercial products. If so, as I will show you, it would be a big change for them. Some will route around such licenses anyway, by avoiding code that uses such a license, of course, as Ashlee Vance reports:
Google's open source guru Chris DiBona, however, told us that Google will just make its own code when needed to get around clauses similar to these.
"We have enough engineer resources that, if the license has obligations we are not interested in, we can just not use it," he said.
You can always write a license demanding anything you like, but the other side gets to then decide if they want to be annoyed with you or not. I can release code demanding your firstborn if you use my code, and you can then decide if my terms are worth it. Probably not.
OK. So now let's look at the licenses. If you read the draft of the CPAL license, you will see the requirements regarding attribution. Clause 14 talks about attribution on splash screens, and they are not obligatory in all circumstances. For example, if there's no GUI with a splash screens already, you can't demand one. And what you can require is greatly scaled down from what some badgeware licenses were asking for:
14. ADDITIONAL TERM: ATTRIBUTION
(a) As a modest attribution to the organizer of the development of the Original Code ("Original Developer"), in the hope that its promotional value may help justify the time, money and effort invested in writing the Original Code, the Original Developer may include in Exhibit B ("Attribution Notice") a requirement that each time an Executable and Source Code or a Larger Work is launched or run, a prominent display of the Original Developer's Attribution Information (as defined below) must occur on the graphic user interface (which may include display on a splash screen), if any. If the Executable and Source Code does not launch or run a graphic user interface, this obligation shall not apply. If the Original Code displays such Attribution Information in a particular form (such as in the form of a splash screen, notice at login, an "about" display, or dedicated attribution area on user interface screens), continued use of such form for that Attribution Information will meet this requirement for notice.
(b) Attribution information may only include a copyright notice, a brief phrase, graphic image and a URL ("Attribution Information") and is subject to the Attribution Limits as defined below. For these purposes, prominent shall mean display for sufficient duration to give reasonable notice to the user of the identity of the Original Developer and that if You include Attribution Information or similar information for other parties, You must ensure that the Attribution Information for the Original Developer shall be no less prominent than such Attribution Information or similar information for the other party. For greater certainty, the Original Developer may choose to specify in Exhibit B below that the above attribution requirement only applies to an Executable and Source Code resulting from the Original Code or any Modification, but not a Larger Work. The intent is to provide for reasonably modest attribution, therefore the Original Developer cannot require that You display, at any time, more than the following information as Attribution Information: (a) a copyright notice including the name of the Original Developer; (b) a word or one phrase (not exceeding 10 words); (c) one graphic provided by the Original Developer; and (d) a URL (collectively, the "Attribution Limits").
(c) If Exhibit B does not include any Attribution Information, then there are no requirements for You to display any Attribution Information of the Original Developer.f
(d) You acknowledge that all trademarks, service marks and/or trade names contained within the Attribution Notice distributed with the Covered Code are the exclusive property of their owners and may only be used with the permission of their owners, or under circumstances otherwise permitted by law or as expressly set out in this License.
You can see how scaled down the requirements are if you compare it with the SugarCRM "Open Source" license terms, which require this:
II. SugarCRM and logo.
This License does not grant any rights to use the trademarks "SugarCRM" and the "SugarCRM" logos even if such marks are included in the Original Code or Modifications.
However, in addition to the other notice obligations, all copies of the Covered Code in Executable and Source Code form distributed must, as a form of attribution of the original author, include on each user interface screen (i) the "Powered by SugarCRM" logo and (ii) the copyright notice in the same form as the latest version of the Covered Code distributed by SugarCRM, Inc. at the time of distribution of such copy. In addition, the "Powered by SugarCRM" logo must be visible to all users and be located at the very bottom center of each user interface screen. Notwithstanding the above, the dimensions of the "Powered By SugarCRM" logo must be at least 106 x 23 pixels. When users click on the "Powered by SugarCRM" logo it must direct them back to http://www.sugarforge.org. In addition, the copyright notice must remain visible to all users at all times at the bottom of the user interface screen. When users click on the copyright notice, it must direct them back to http://www.sugarcrm.com
Mayfield also submitted a compliance document, explaining how the license met all 10 points of OSI's definition and here is the explanation of the attribution elements:
The Common Public Attribution License (CPAL) is the result of significant review and modification based on Socialtext’s initial submission of the Generic Attribution Provision (GAP), Socialtext Public License (STPL) and the comments from License Discuss.
CPAL is based on the MPL which has been approved and all of the new provisions are in Sections 14 and 15 (and Exhibit B) and adding “Original Developer” to certain disclaimers ("Original Developer" is a term defined in the new provisions for those who originally created the program who may be different from the "Initial Developer"). Section 14 provides for an attribution notice based on the Adaptive Public License and Section 15 provides for a network use provision based on the commonly used provision on “External Deployment” found in the Apple Public License, Real Network Public License and the Open Software License. We have used the Adaptive Public License as the basis for the attribution provision because it was approved after OSD 10 was adopted. In addition, it was the basis for the attribution provision of in Exhibit B of the draft STPL which was submitted for approval, but superseded by this agreement. Socialtext believes that the application software has special needs as compared to operating systems because of the application software can be used anonymously in large distributions and can be used to provide services through an ASP which does not provide modifications back to the community. None of the approved OSI approved licenses include both a network use provision and an attribution provision. We have limited the new provisions to those which are either the same or very close to provisions from existing licenses (see above).
We have made the following major changes to the GAP and STPL approach:
1. We have made the provision part of a specific license (MPL) and we have made the license a template which can be reused. We removed references to Socialtext in the agreement.
2. We have used the Adaptive Public License as the basis for the attribution provision because it was approved after OSD 10 was adopted. This change will avoid the debate over whether the Attribution Assurance License (upon which GAP was based) would comply with OSD 10. The need for attribution provision has been acknowledged by the final draft of the GPL version 3 which includes attribution as an option under Section 7(b).
3. We have provided that the attribution obligation would not apply if the product does not have a graphic user interface.
4. We have limited the placement requirement for attribution notice to “prominent” rather than a specified size or location. We have also permitted the use of splash screens. These terms are frequently used in other OSI approved licenses such as the GPL and NASA Public License.
5. License-Discuss has commented favorably on the Medsphere Public License (except the actual notice requested by Medsphere) which is essentially the same as the attribution provision in Section 14.
6. We have modified the network access provision from one based on the Affero license which was not OSI approved to a provision from the OSI approved licenses such as the Apple Public License, Real Networks Public License and Open Software License. It is also less technology specific.
So, don't let the headlines confuse you. Life is rarely a headline, you know. It's only journalists who see the world like that.