# Elm 0.19 licence types - AGPL and what should be allowed/recommended?

**URL:** <https://discourse.elm-lang.org/t/elm-0-19-licence-types-agpl-and-what-should-be-allowed-recommended/2056>\
**Category:** Request Feedback\
**Created:** [September 26, 2018, 10:30am UTC](https://discourse.elm-lang.org/t/elm-0-19-licence-types-agpl-and-what-should-be-allowed-recommended/2056 "2018-09-26T10:30:52Z")\
**Posts on this page:** 20\
**Page:** 1

<div class="post-metadata">

**Author:** ![rupert](https://yyz1.discourse-cdn.com/flex035/user_avatar/discourse.elm-lang.org/rupert/32/1775_2.png) [@rupert](https://discourse.elm-lang.org/u/rupert)\
**Post date:** [September 26, 2018, 10:30am UTC](https://discourse.elm-lang.org/t/elm-0-19-licence-types-agpl-and-what-should-be-allowed-recommended/2056/1 "2018-09-26T10:30:52Z")

</div>

The 0.19 compiler requires that an OSI approved SPDX license is used, the list is here:

[https://spdx.org/licenses/](https://spdx.org/licenses/)

I notice that AGPL (or Affero) licences are on that list. These are a more restrictive form of viral GPL, that require the entire source of an application be published under the terms of the licence, even when only the object form of the code is being distributed; if you unwittingly include such a package in your project, you could be forced to open source all of it.

I don’t know if any packages currently use this licence - should packages with this licence be allowed to be published?

Are there other potentially problematic licences in the list?

Most packages seem to use BSD or MIT. It would be worth displaying the licence type on the package site. It would also be worth doing a licence survey to see what is actually being used.

---

<div class="post-metadata">

**Author:** ![rtfeldman](https://yyz1.discourse-cdn.com/flex035/user_avatar/discourse.elm-lang.org/rtfeldman/32/50_2.png) [@rtfeldman](https://discourse.elm-lang.org/u/rtfeldman)\
**Post date:** [September 26, 2018, 10:35am UTC](https://discourse.elm-lang.org/t/elm-0-19-licence-types-agpl-and-what-should-be-allowed-recommended/2056/2 "2018-09-26T10:35:48Z")

</div>

> [@rupert](#):
>
> The 0.19 compiler requires that an OSI approved SPDX license is used

The reason for this design is specifically to unlock being able to do more useful things with licenses in the future, e.g. checking GPL compatibility.

So things like this are possible in general, but not as urgent as other things at the moment!

---

<div class="post-metadata">

**Author:** ![rupert](https://yyz1.discourse-cdn.com/flex035/user_avatar/discourse.elm-lang.org/rupert/32/1775_2.png) [@rupert](https://discourse.elm-lang.org/u/rupert)\
**Post date:** [September 26, 2018, 10:40am UTC](https://discourse.elm-lang.org/t/elm-0-19-licence-types-agpl-and-what-should-be-allowed-recommended/2056/3 "2018-09-26T10:40:07Z")

</div>

Its a good design; if I can figure out how to get the info from the package server, I’ll report back with a survey of what is currently being used.

---

<div class="post-metadata">

**Author:** ![rupert](https://yyz1.discourse-cdn.com/flex035/user_avatar/discourse.elm-lang.org/rupert/32/1775_2.png) [@rupert](https://discourse.elm-lang.org/u/rupert)\
**Post date:** [September 26, 2018, 10:59am UTC](https://discourse.elm-lang.org/t/elm-0-19-licence-types-agpl-and-what-should-be-allowed-recommended/2056/4 "2018-09-26T10:59:12Z")

</div>

Wasn’t so hard:

![elm_licences](https://canada1.discourse-cdn.com/flex035/uploads/elm_lang/original/2X/4/4980a07c34b65aaeb816f479feebb96a7d7cd2a8.png)

| Licence | Count |
| --- | --- |
| Apache-2.0 | 7 |
| BSD-3-Clause | 250 |
| GPL-3.0 | 1 |
| ISC | 1 |
| MIT | 97 |
| MPL-2.0 | 10 |

---

<div class="post-metadata">

**Author:** ![rupert](https://yyz1.discourse-cdn.com/flex035/user_avatar/discourse.elm-lang.org/rupert/32/1775_2.png) [@rupert](https://discourse.elm-lang.org/u/rupert)\
**Post date:** [September 26, 2018, 11:01am UTC](https://discourse.elm-lang.org/t/elm-0-19-licence-types-agpl-and-what-should-be-allowed-recommended/2056/5 "2018-09-26T11:01:02Z")

</div>

Only one use of a viral GPL licence, and it is on `elm-piano` which seems unlikely to have anything which depends on it.

I would recommend banning AGPL though.

---

<div class="post-metadata">

**Author:** ![mfeineis](https://yyz1.discourse-cdn.com/flex035/user_avatar/discourse.elm-lang.org/mfeineis/32/104_2.png) [@mfeineis](https://discourse.elm-lang.org/u/mfeineis)\
**Post date:** [September 26, 2018, 11:08am UTC](https://discourse.elm-lang.org/t/elm-0-19-licence-types-agpl-and-what-should-be-allowed-recommended/2056/6 "2018-09-26T11:08:45Z")

</div>

I don’t think banning packages because of licenses is a good idea but it would be nice for the package manager to warn the user if she tries to install a viral license and maybe have a warning about having to provide the source code or something like that.

---

<div class="post-metadata">

**Author:** ![ianmackenzie](https://yyz1.discourse-cdn.com/flex035/user_avatar/discourse.elm-lang.org/ianmackenzie/32/86_2.png) [@ianmackenzie](https://discourse.elm-lang.org/u/ianmackenzie)\
**Post date:** [September 26, 2018, 1:16pm UTC](https://discourse.elm-lang.org/t/elm-0-19-licence-types-agpl-and-what-should-be-allowed-recommended/2056/7 "2018-09-26T13:16:40Z")

</div>

I think most of the MPL-2.0 packages there are mine - that’s been my standard license for a while, but I’m open to feedback from anyone who knows a reason it could be problematic.

The very simplified version of the MPL is that that you can incorporate MPL-licensed code into proprietary code with no real restrictions, except that if you make changes to the MPL-licensed files _themselves_ then _those_ changes must be contributed back. To me this seemed like a sensible, non-viral and entirely reasonable requirement - just enough to prevent commercial, proprietary forks and encourage contributing back improvements and fixes. But I’m open to switching to BSD or similar if there are reasonable use cases I’m not considering where the MPL’s restrictions would be an issue.

---

<div class="post-metadata">

**Author:** ![rupert](https://yyz1.discourse-cdn.com/flex035/user_avatar/discourse.elm-lang.org/rupert/32/1775_2.png) [@rupert](https://discourse.elm-lang.org/u/rupert)\
**Post date:** [September 26, 2018, 2:07pm UTC](https://discourse.elm-lang.org/t/elm-0-19-licence-types-agpl-and-what-should-be-allowed-recommended/2056/8 "2018-09-26T14:07:52Z")

</div>

I’m not advocating banning any existing packages, just the AGPL licence type, as it can be used as a Trojan horse.

I’m not advocating banning GPL or viral licences either, although others might want to argue the case here?

Consider this hypothetical scenario:

_Our business invests $1M in developing a new product, using Elm of course. One of the major packages is AGPL, but the devs just install it anyway, as often happens when we’re up to our eyeballs in code. A week before the product launch, the legal department asks for an audit of software licences to perform due diligence. At that point, the AGPL problem is brought to light. We check the authors web site and find that they also sell a commercial licence; “just give us a call!”. The author turns out to be a shrewd individual who makes a level-headed assessment of the situation and realises that re-working that package out of our code is going to cost us around $500K in development time. He sets the licence price at $450K._

Our own fault of course, for not doing the due diligence on day 1 - but it is also possible to “make this undesirable state impossible”.

---

<div class="post-metadata">

**Author:** ![akavel](https://yyz1.discourse-cdn.com/flex035/user_avatar/discourse.elm-lang.org/akavel/32/943_2.png) [@akavel](https://discourse.elm-lang.org/u/akavel)\
**Post date:** [September 26, 2018, 3:10pm UTC](https://discourse.elm-lang.org/t/elm-0-19-licence-types-agpl-and-what-should-be-allowed-recommended/2056/9 "2018-09-26T15:10:47Z")

</div>

> [@rupert](#):
>
> [… AGPL] require[s] the entire source of an application be published under the terms of the licence, even when only the object form of the code is being distributed […]

1. That is also required by the regular GPL, not only by AGPL.
2. It’s not enough to check license of a library, you must also check licenses of its dependencies. If any one of them is GPL, the final library is GPL too. Also, you must check _all files_ in the library, checking just the LICENSE file is not enough, some files may have different license headers, etc. Checking license of any existing codebase is non-trivial, and you didn’t even mention how you did it when creating your plot, so I find the plot not worth a dime, I’m afraid.
3. You should _always_ review the license of _any_ code you include in your codebase. That’s on you, _no excuses_. The listing of packages may try to help you with this, but even if it does, the legal responsibility is most probably still 100% on you. (IANAL.) And by the way, both GPL and AGPL still allow you to sell software using this license for money; so your “hypothetical scenario” still allows you to not pay the author of the library you used a dime! (But did you stop for a moment to consider that he/she actually _helped_ your business, so it might be actually _right_ to pay him/her for his/her hard work?)
4. Personally, I’d find banning AGPL or GPL on packages list absurd. There are people who want to build FLOSS, and for them, GPL/AGPL might be a totally valid choice. Banning it from the packages list would make the Elm ecosystem explicitly pro proprietary licensing, and against free/libre licensing. I’m being super moderate with words when I’m saying this would be… _controversial_… on the Internet.

I’m not planning to follow this discussion after this post, as per point 4 above especially, I believe it is not really worth any discussion. I find this proposal outrageous. Just wanted to make sure a whistle was clearly blown on this suggestion, so that it wouldn’t be accidentally overlooked per some insane “silent agreement assumption”.

---

<div class="post-metadata">

**Author:** ![lydell](https://yyz1.discourse-cdn.com/flex035/user_avatar/discourse.elm-lang.org/lydell/32/178_2.png) [@lydell](https://discourse.elm-lang.org/u/lydell)\
**Post date:** [September 26, 2018, 3:27pm UTC](https://discourse.elm-lang.org/t/elm-0-19-licence-types-agpl-and-what-should-be-allowed-recommended/2056/10 "2018-09-26T15:27:24Z")

</div>

> [@rupert](#):
>
> if you unwittingly include such a package in your project, you could be forced to open source all of it.

Is that really true? Wouldn’t it be sensible to let the project to either open source all of it **or** to stop using the package? But maybe that’s not how laws work.

---

<div class="post-metadata">

**Author:** ![rupert](https://yyz1.discourse-cdn.com/flex035/user_avatar/discourse.elm-lang.org/rupert/32/1775_2.png) [@rupert](https://discourse.elm-lang.org/u/rupert)\
**Post date:** [September 26, 2018, 3:36pm UTC](https://discourse.elm-lang.org/t/elm-0-19-licence-types-agpl-and-what-should-be-allowed-recommended/2056/11 "2018-09-26T15:36:58Z")

</div>

> [@lydell](#):
>
> Is that really true? Wouldn’t it be sensible to let the project to either open source all of it **or** to stop using the package? But maybe that’s not how laws work.

Ok, you could be force to open-source your entire project if you continue to use the package. You could also choose to not use it, yes, and then you would not be subject to that requirement.

---

<div class="post-metadata">

**Author:** ![rtfeldman](https://yyz1.discourse-cdn.com/flex035/user_avatar/discourse.elm-lang.org/rtfeldman/32/50_2.png) [@rtfeldman](https://discourse.elm-lang.org/u/rtfeldman)\
**Post date:** [September 26, 2018, 4:15pm UTC](https://discourse.elm-lang.org/t/elm-0-19-licence-types-agpl-and-what-should-be-allowed-recommended/2056/12 "2018-09-26T16:15:32Z")

</div>

> [@akavel](#):
>
> I find the plot not worth a dime

@akavel It’s clear that you feel strongly about this, but let’s please be kind to one another. 🙂

---

<div class="post-metadata">

**Author:** ![rupert](https://yyz1.discourse-cdn.com/flex035/user_avatar/discourse.elm-lang.org/rupert/32/1775_2.png) [@rupert](https://discourse.elm-lang.org/u/rupert)\
**Post date:** [September 26, 2018, 8:08pm UTC](https://discourse.elm-lang.org/t/elm-0-19-licence-types-agpl-and-what-should-be-allowed-recommended/2056/13 "2018-09-26T20:08:55Z")

</div>

From the wikipedia page on AGPL ([https://en.wikipedia.org/wiki/Affero\_General\_Public\_License](https://en.wikipedia.org/wiki/Affero_General_Public_License)):

“Both versions of the Affero GPL were designed to close a perceived [application service provider](https://en.wikipedia.org/wiki/Application_service_provider) (ASP) _loophole_ in the ordinary GPL, where, by using but not distributing the software, the [copyleft](https://en.wikipedia.org/wiki/Copyleft) provisions are not triggered.”

I guess it comes down to whether using a single page application counts as distributing the object code - but I think web applications do count as SAAS.

---

<div class="post-metadata">

**Author:** ![matt.cheely](https://yyz1.discourse-cdn.com/flex035/user_avatar/discourse.elm-lang.org/matt.cheely/32/4524_2.png) [@matt.cheely](https://discourse.elm-lang.org/u/matt.cheely)\
**Post date:** [September 26, 2018, 9:05pm UTC](https://discourse.elm-lang.org/t/elm-0-19-licence-types-agpl-and-what-should-be-allowed-recommended/2056/14 "2018-09-26T21:05:32Z")

</div>

I see the AGPL as a way for developers to request (non-financial) compensation for their work, which I’d never begrudge anyone. Referring to it as “viral” or a “trojan horse” makes it seem as if authors who choose the AGPL are doing so with malicious intent, which I’d venture is almost never the case.

I do like the idea of having tooling warn if you include a library with a license which requires code re-sharing. That helps people make informed decisions, and highlights the importance of understanding the licenses of software you use. Banning those licenses however, seems to me to push the idea that open source developers not only aren’t compensated in practice, but in fact _shouldn’t_ be, which isn’t something I can get behind.

---

<div class="post-metadata">

**Author:** ![nidi](https://yyz1.discourse-cdn.com/flex035/user_avatar/discourse.elm-lang.org/nidi/32/283_2.png) [@nidi](https://discourse.elm-lang.org/u/nidi)\
**Post date:** [September 27, 2018, 12:56am UTC](https://discourse.elm-lang.org/t/elm-0-19-licence-types-agpl-and-what-should-be-allowed-recommended/2056/15 "2018-09-27T00:56:21Z")

</div>

Reading the header I thought you were asking what licenses apart from AGPL were missing on the list. Then I understand you mean the contrary !?

My answer is a clear “Yes, of course - AGPL licensed packages should be allowed to be published”!

Why?:

AGPL is a great license. It disallows closed forks, even for SaaS, simple. Btw I’m missing the ALGPL, it doesn’t exist (yet).

Automatic license compliance checking for standard free software licenses is not hard by the way - and even realistic with our cool favorite three letter language as @rtfeldman envisions above. This would be impossible with arbitrarily complex proprietary license contracts. But AGPL is not an issue.

An important “personal” note to @rupert : I’m actually worried by your fearmongering rhetoric, in particular reading the hypothetical “blackmail” scenario in your comment. In multiple ways, even shocked. Two advises:

- Please take your responsibility seriously when writing and distributing source code professionally!
- Please think more before writing proposals and be aware that you may trigger, even hurt people (you’re proposing exclusion after all!) and for sure occupy other people’s time, at least my last hour or more. Sorry that this is a bit embarrassing, but who cares. Happened to all of us 😉

@democracy-bot / @rupert: I’m proposing the closure of this thread.

Sorry!

Linus.

---

<div class="post-metadata">

**Author:** ![nikolaipaul](https://yyz1.discourse-cdn.com/flex035/user_avatar/discourse.elm-lang.org/nikolaipaul/32/1079_2.png) [@nikolaipaul](https://discourse.elm-lang.org/u/nikolaipaul)\
**Post date:** [September 27, 2018, 4:54am UTC](https://discourse.elm-lang.org/t/elm-0-19-licence-types-agpl-and-what-should-be-allowed-recommended/2056/16 "2018-09-27T04:54:25Z")

</div>

> [@nidi](#):
>
> Sorry that this is a bit embarrassing, but who cares. Happened to all of us

I agree that we should try to be a friendly and inclusive community. Everybody has his own views and opinions. You don’t know a persons background for that matter and judging him this way is simply unneccesary and does not add any value to the conversation.

---

<div class="post-metadata">

**Author:** ![rupert](https://yyz1.discourse-cdn.com/flex035/user_avatar/discourse.elm-lang.org/rupert/32/1775_2.png) [@rupert](https://discourse.elm-lang.org/u/rupert)\
**Post date:** [September 27, 2018, 9:17am UTC](https://discourse.elm-lang.org/t/elm-0-19-licence-types-agpl-and-what-should-be-allowed-recommended/2056/17 "2018-09-27T09:17:33Z")

</div>

The blackmail scenario is unfortunately real - I can’t say too much but I do have direct experience of it! I think this kind of thing is not that common, and of course you can’t cry about it if you didn’t do the due diligence early.

Banning AGPL is not without precedent:

[https://opensource.google.com/docs/using/agpl-policy/](https://opensource.google.com/docs/using/agpl-policy/)

and many other big corporates also follow that policy.

Reading the above responses it sounds like I am in a minority on this issue, but I think it is good that we had a debate about it.

I would suggest that getting the licence type displayed prominently on the package site would be a good step to take and something that we do seem to agree on.

Also, no-one has used AGPL for an Elm package yet; its mostly BSD and MIT - and MPL for elm-geometry is also a good choice, of course we would want to contribute back to such a great piece of software. The licensing picture across Elm looks very healthy at the moment, and easy for the more corporate participants to work with.

---

<div class="post-metadata">

**Author:** ![rupert](https://yyz1.discourse-cdn.com/flex035/user_avatar/discourse.elm-lang.org/rupert/32/1775_2.png) [@rupert](https://discourse.elm-lang.org/u/rupert)\
**Post date:** [September 27, 2018, 9:21am UTC](https://discourse.elm-lang.org/t/elm-0-19-licence-types-agpl-and-what-should-be-allowed-recommended/2056/18 "2018-09-27T09:21:20Z")

</div>

> [@nidi](#):
>
> @democracy-bot / @rupert: I’m proposing the closure of this thread.

I think you were looking for @dictator-bot? 😉 (this is a joke btw, just to be clear…)

---

<div class="post-metadata">

**Author:** ![rupert](https://yyz1.discourse-cdn.com/flex035/user_avatar/discourse.elm-lang.org/rupert/32/1775_2.png) [@rupert](https://discourse.elm-lang.org/u/rupert)\
**Post date:** [September 27, 2018, 9:38am UTC](https://discourse.elm-lang.org/t/elm-0-19-licence-types-agpl-and-what-should-be-allowed-recommended/2056/19 "2018-09-27T09:38:27Z")

</div>

This article is worth a read:

[http://greendrake.info/#nfy0](http://greendrake.info/#nfy0)

It is saying that if you include a GPL library in a web application, the whole application is a derived work, and must also be GPLed.

---

<div class="post-metadata">

**Author:** ![akavel](https://yyz1.discourse-cdn.com/flex035/user_avatar/discourse.elm-lang.org/akavel/32/943_2.png) [@akavel](https://discourse.elm-lang.org/u/akavel)\
**Post date:** [September 27, 2018, 11:15am UTC](https://discourse.elm-lang.org/t/elm-0-19-licence-types-agpl-and-what-should-be-allowed-recommended/2056/20 "2018-09-27T11:15:00Z")

</div>

@rtfeldman Sorry if this post came out as too emotional; I tried to restrain my wording, while still not losing the importance of the thing for me… I hoped that limiting this to assertive descriptions of my subjective feelings (without trying to cast them as objective truth) would be OK; sorry if I was still too risky. Huge thanks @rupert for keeping calm and not escalating further in response! And one more big thanks goes to @nidi, I find your post to summarize my view in much more elegant way than I would imagine possible, while also to my own surprise perfectly diagnosing why I felt so strongly about the issue. It’s humbling, refreshing and elevating to suddenly find myself among such a civilized company.

[Next page](https://discourse.elm-lang.org/t/elm-0-19-licence-types-agpl-and-what-should-be-allowed-recommended/2056.md?page=2)