37 of the top 50 self-hosted apps can go closed

Description and use

37 of the top 50 self-hosted apps can switch to closed licenses via CLAs or license changes, threatening their open-source status.

Problem

Self-hosted applications may change their licensing to restrict open-source use without notifying users.

Outcome

The study shows that 37 of the top 50 self-hosted apps can become closed either because they already ship non-open code or because their CLAs allow the maintainers to relicense contributions. Users should verify CLAs before relying on the open-source nature of an app.

Workflow

• 1. Gather list of top 50 self-hosted apps from Awesome Selfhosted. 2. Classify each app into groups: (a) already ship non-open code, (b) permissive, (c) copyleft with CLA, (d) copyleft no CLA, (e) permissive owned by foundation. 3. Identify apps in groups (a) and (c) as potentially able to go closed. 4. Examine recent commits and releases for license changes (e.g., NocoDB, Stirling-PDF). 5. Review CLAs to determine if they grant the maintainer rights to relicense contributions. 6. Summarize findings and provide guidance on checking CLAs for other apps.

Evidence

For 37 of them the answer is yes, or they already have.

Source

NocoDB is a self-hosted Airtable with 65,000 stars, and untill this year it was AGPL. On 8 January a commit called "chore: change to sustainable use license" deleted the 661-line AGPL and put 61 lines of the Sustainable Use License in its place.

Source

A CLA, or contributor licence agreement, is something you sign before your PR gets merged, and NocoDB's contributing guide has asked for one since 2022.

Source

PhotoPrism's is the bluntest: "this includes the right to apply any license to the Contributions that PhotoPrism considers fit for the respective purpose as decided by PhotoPrism in its sole discretion, including other open-source, copyleft, and proprietary licenses".

Source