Re-License of Vaultwarden to AGPLv3

[BlackDex]

Hello contributors to Vaultwarden,

I'm starting this discussion because we want to change the open source license of Vaultwarden.
Currently it is licensed under GPLv3 which is nice, but this has a gap which could allow commercial usage of Vaultwarden without providing back to the community.
For this reason Bitwarden has it's server licensed under the AGPLv3. That same license we want to use for Vaultwarden to keep Vaultwarden fully open source.

To be clear, this will not effect any (end)user or any self-hosted environment which you share with your family and friends.
This will only have an effect on companies or self-hosted environments that build proprietary tools using Vaultwarden code or modify the Vaultwarden code.
This is also more fair towards Bitwarden, since currently the GPLv3 license of Vaultwarden could allow other companies to compete with Bitwarden by modifying the Vaultwarden code and not providing these changes back to the community, which is not something we want.

What we need to do

We need a consent from all major contributors who made Vaultwarden towards what it is now. This only includes actual changes to the Rust code and does not include spelling changes, formatting, clippy fixes etc...
For this we have compiled a list of all these users from whom we would like to have a consent to continue to fully change the Vaultwarden code to AGPLv3.

The only thing you need to do is comment below using the following template, and change the parts in between {{ }}:

I, {{ Name }} hereby grant permission to re-license Vaultwarden under the GNU Affero General Public License.

A portion of the commits made by {{ github username }} are copyright of {{ name }}.
And i hereby grant the Vaultwarden project team to re-license Vaultwarden,
including all past, present and future contributions of the author listed above.

If for some reason you do not want your real name to be visible, please use the same as is visible on Github, or just your Github username instead.

What is GPL?

GPL (Gnu Public License) was originally written by Richard Stallman, the founder of the Free Software Foundation for the GNU project. All licenses in the GPL series are copyleft licenses which means that the derivative works should be released under the same license or an equivalent license.

The difference between GPL and AGPL

GPL says that if the software is redistributed, you have to release the source code of the modification. But the GPL license doesn't mention anything about modifying the software and providing it as a service. This is due to the fact that letting users interact with software over a network cannot be considered as redistribution. Redistribution is thus the triggering event of GPL. This is often referred to as the SaaS loophole of GPL.

AGPL added one more requirement to GPL, which is:

If you run a modified program on a server and let other users communicate with it there, your server must also allow them to download the source code corresponding to the modified version running there.

This just means that the software cannot be sold as a proprietary product with modification without providing the source of the modifications to the users of the product.

AGPL Is also recommended by the Free Software Foundation (FSF) if the software is commonly run over a network, which is what Vaultwarden is.

Tagging contributors

This list is just in alphabetic order. I hope i haven't missed anyone, if I did, please let us know, but it would be even better if you would sign it right away 😄 .

✔️ @aksdb
✔️ @ArmaanT
✔️ @aveao
✔️ @Baelyk
✔️ @BlackDex
✔️ @dani-garcia
✔️ @domdomegg
✔️ @dongcarl
✔️ @endyman
✔️ @farodin91
✔️ @janost
✔️ @jjlin
✔️ @Kurnihil
✔️ @MFijak
✔️ @mprasil
✔️ @njfox
✔️ @olivierIllogika
✔️ @paolobarbolini
✔️ @pjsier
✔️ @RealOrangeOne
✔️ @rfwatson
✔️ @samueltardieu
✔️ @shauder
✔️ @sirux88
✔️ @soruh
✔️ @Skeen
✔️ @stefan0xC
✔️ @Step7750
✔️ @swedishborgie
✔️ @tessus
✔️ @thelittlefireman
✔️ @TheMardy
✔️ @TinfoilSubmarine
✔️ @tomuta
✔️ @tycho
✔️ @ViViDboarder
✔️ @vplme

Thanks

And, thanks for all your support to the Vaultwarden Project!

[BlackDex]

I, Mathijs van Veluw hereby grant permission to re-license Vaultwarden under the GNU Affero General Public License.

A portion of the commits made by BlackDex are copyright of Mathijs van Veluw.
And i hereby grant the Vaultwarden project team to re-license Vaultwarden,
including all past, present and future contributions of the author listed above.

[TinfoilSubmarine]

I, Joel Beckmeyer hereby grant permission to re-license Vaultwarden under the GNU Affero General Public License.

A portion of the commits made by TinfoilSubmarine are copyright of Joel Beckmeyer.
And i hereby grant the Vaultwarden project team to re-license Vaultwarden,
including all past, present and future contributions of the author listed above.

[aveao]

I, Ave Özkal hereby grant permission to re-license Vaultwarden under the GNU Affero General Public License.

A portion of the commits made by aveao are copyright of Ave Özkal.
And i hereby grant the Vaultwarden project team to re-license Vaultwarden,
including all past, present and future contributions of the author listed above.

[ViViDboarder]

I, Ian hereby grant permission to re-license Vaultwarden under the GNU Affero General Public License.

A portion of the commits made by ViViDboarder are copyright of Ian.
And I hereby grant the Vaultwarden project team to re-license Vaultwarden,
including all past, present and future contributions of the author listed above.

[TheMardy]

I, Martijn Hanegraaf hereby grant permission to re-license Vaultwarden under the GNU Affero General Public License.

A portion of the commits made by TheMardy are copyright of Martijn Hanegraaf.
And i hereby grant the Vaultwarden project team to re-license Vaultwarden,
including all past, present and future contributions of the author listed above.

[swedishborgie]

I, Michael Powers hereby grant permission to re-license Vaultwarden under the GNU Affero General Public License.

A portion of the commits made by swedishborgie are copyright of Michael Powers.
And I hereby grant the Vaultwarden project team to re-license Vaultwarden,
including all past, present and future contributions of the author listed above.

[ArmaanT]

I, Armaan Tobaccowalla hereby grant permission to re-license Vaultwarden under the GNU Affero General Public License.

A portion of the commits made by ArmaanT are copyright of Armaan Tobaccowalla.
And I hereby grant the Vaultwarden project team to re-license Vaultwarden,
including all past, present and future contributions of the author listed above.

[mprasil]

I, Miro Prasil hereby grant permission to re-license Vaultwarden under the GNU Affero General Public License.

A portion of the commits made by mprasil are copyright of Miro Prasil.
And i hereby grant the Vaultwarden project team to re-license Vaultwarden,
including all past, present and future contributions of the author listed above.

[shauder]

I, Shane Faulkner hereby grant permission to re-license Vaultwarden under the GNU Affero General Public License.

A portion of the commits made by shauder are copyright of Shane Faulkner.
And i hereby grant the Vaultwarden project team to re-license Vaultwarden,
including all past, present and future contributions of the author listed above.

[rfwatson]

I, Rob Watson, hereby grant permission to re-license Vaultwarden under the GNU Affero General Public License.

A portion of the commits made by @rfwatson are copyright of Rob Watson.
And i hereby grant the Vaultwarden project team to re-license Vaultwarden,
including all past, present and future contributions of the author listed above.

[dani-garcia]

I, Daniel García hereby grant permission to re-license Vaultwarden under the GNU Affero General Public License.

A portion of the commits made by @dani-garcia are copyright of Daniel García.
And i hereby grant the Vaultwarden project team to re-license Vaultwarden,
including all past, present and future contributions of the author listed above.

[janost]

I, Janos Tassy hereby grant permission to re-license Vaultwarden under the GNU Affero General Public License.

A portion of the commits made by @janost are copyright of Janos Tassy.
And i hereby grant the Vaultwarden project team to re-license Vaultwarden,
including all past, present and future contributions of the author listed above.

[jjlin]

While I don't object to changing the license, I think a few things mentioned in the intro are not quite true and should be clarified.

To be clear, this will not effect any (end)user or any self-hosted environment which you share with your family and friends.

If you make your Vaultwarden instance publicly accessible, then there is a reasonable expectation that anyone could interact with it (if only to load the login page), so if you've modified any of the Vaultwarden backend (e.g., custom templates or graphics that get built into the binary), I believe you would technically be obligated to "prominently offer" the source. In practice, that would probably mean modifying the web vault login page with a link to your source.

This will only have an effect on companies that build proprietary tools using Vaultwarden code.

As mentioned above, this also affects non-commercial users who have modified the Vaultwarden code.

This is also more fair towards Bitwarden, since currently the GPLv3 license of Vaultwarden could allow other companies to compete with Bitwarden, which is not something we want.

While this may prevent deep integration of Vaultwarden with a company's other products, they are still perfectly able to provide standalone instances, even with some customizations (as long as they make the modified source available), so I don't think this change would have much effect on most MSPs who offer managed Vaultwarden services.

Overall, AGPL has a limited ability to prevent third-party competition with the original product, as can be seen with Bitwarden's shift towards a non-open-source ("source-available") license for key portions of their software.

[dumblob]

I'd add that the following sentence:

This just means that the software cannot be sold as a proprietary product.

is also not quite true. AFAIK AGPL does in no way forbid selling (or otherwise profiting from) a modified version of the SW. It just requires you to provide this very particular running SW piece also in source form (only) to those "communicationg with it" (in case of Vaultvarden you can thus skip anyone not having a working login credentials as they can not really "communicate with it" in any sensible way).

[BlackDex]

Thanks for the input @jjlin and @dumblob, i have updated the message to better reflect this.

[jjlin]

I, Jeremy Lin, hereby grant permission to re-license Vaultwarden under the GNU Affero General Public License.

A portion of the commits made by @jjlin are copyright of Jeremy Lin.
And I hereby grant the Vaultwarden project team to re-license Vaultwarden,
including all past, present and future contributions of the author listed above.

[domdomegg]

I, Adam Jones hereby grant permission to re-license Vaultwarden under the GNU Affero General Public License.

A portion of the commits made by domdomegg are copyright of Adam Jones.

And I hereby grant the Vaultwarden project team to re-license Vaultwarden, including all past, present and future contributions of the author listed above.

[samueltardieu]

I, Samuel Tardieu hereby grant permission to re-license Vaultwarden under the GNU Affero General Public License.

A portion of the commits made by @samueltardieu are copyright of Samuel Tardieu.
And i hereby grant the Vaultwarden project team to re-license Vaultwarden,
including all past, present and future contributions of the author listed above.

[tessus]

I, Helmut K. C. Tessarek hereby grant permission to re-license Vaultwarden under the GNU Affero General Public License.

A portion of the commits made by @tessus are copyright of Helmut K. C. Tessarek.
And i hereby grant the Vaultwarden project team to re-license Vaultwarden,
including all past, present and future contributions of the author listed above.

[pjsier]

I, Pat Sier hereby grant permission to re-license Vaultwarden under the GNU Affero General Public License.

A portion of the commits made by @pjsier are copyright of Pat Sier.
And I hereby grant the Vaultwarden project team to re-license Vaultwarden,
including all past, present and future contributions of the author listed above.

[MFijak]

I, Maximilian Fijak hereby grant permission to re-license Vaultwarden under the GNU Affero General Public License.

A portion of the commits made by @MFijak are copyright of Maximilian Fijak.
And i hereby grant the Vaultwarden project team to re-license Vaultwarden,
including all past, present and future contributions of the author listed above.

[tomuta]

I, @tomuta hereby grant permission to re-license Vaultwarden under the GNU Affero General Public License.

A portion of the commits made by @tomuta are copyright of @tomuta.
And i hereby grant the Vaultwarden project team to re-license Vaultwarden,
including all past, present and future contributions of the author listed above.

[Kurnihil]

I, Daniele Andrei hereby grant permission to re-license Vaultwarden under the GNU Affero General Public License.

A portion of the commits made by Kurnihil are copyright of Daniele Andrei.
And i hereby grant the Vaultwarden project team to re-license Vaultwarden,
including all past, present and future contributions of the author listed above.

[sirux88]

I, Matthias G. hereby grant permission to re-license Vaultwarden under the GNU Affero General Public License.

A portion of the commits made by @sirux88 are copyright of Matthias G.
And i hereby grant the Vaultwarden project team to re-license Vaultwarden,
including all past, present and future contributions of the author listed above.

[farodin91]

I, Jan Jansen hereby grant permission to re-license Vaultwarden under the GNU Affero General Public License.

A portion of the commits made by @farodin91 are copyright of Jan Jansen.
And i hereby grant the Vaultwarden project team to re-license Vaultwarden,
including all past, present and future contributions of the author listed above.

[soruh]

I, Paul Römer hereby grant permission to re-license Vaultwarden under the GNU Affero General Public License.

A portion of the commits made by @soruh are copyright of Paul Römer.
And i hereby grant the Vaultwarden project team to re-license Vaultwarden,
including all past, present and future contributions of the author listed above.

[BlackDex]

I want to thank everybody who signed the consent to make it possible to convert Vaultwarden from GPLv3 to AGPLv3 🥳
We couldn't have done this without you. Not only the Re-License, but also bringing Vaultwarden to the state it currently is at.
We hope you keep contributing and help make Vaultwarden better.

Thanks!

[BlackDex]

To save the current state I have created a PDF of this topic and attached it to this post.

Re-License of Vaultwarden to AGPLv3 - Discussion #2450 - dani-garcia_vaultwarden - 2023-02-13.pdf