License compliance for Sandboxie Plus (no CLA)

[zypA13510]

I just discovered this project after first using sandboxie some 10 years ago. First of all, I'm glad that the project is still alive and active, thank you.

However, I noticed a few problems regarding the licensing of this project (Sandboxie Plus):

1. Please correct me if I'm wrong, but GPL-3 is a copyleft license. If you base your project off of someone else's GPL-3 licensed code, then you are obligated to release the derivative work under GPL-3 or a compatible license too, which is not followed in this case.
2. At the moment, it seems to me that this project is licensed under a commercial for-profit source-available aka. freemium license, not "open source", and it would be wrong to advertise as such.
   
3. Since the license for the project is proprietary, it is unclear to me how contribution to the project is licensed. It seems to me that the maintainer is (the only one?) benefiting from Patreon and sales without an explicit consent from its contributors.

Don't get me wrong, I totally appreciate the amount of work put into the development and maintenance of this project, as a fellow developer myself and someone who is occasionally involved in FOSS. However, I believe there is a difference between getting Patreon because people want to express their gratitude, and getting Patreon because you are selling an open-source project.

[DavidXanatos]

this has been already discussed here: #1388
In short, the GPL licensed Sandboxie can be soled for money just as red hat sells enterprise Linux. Don't like it build your own from source.
The alternative Qt based UI is separate it does not link eider dynamically nor statically with the GPLed code instead it uses generic means of IPC communication to talk to the GPLed components.
The alternative UI and the core components are distributed in mere aggregation.
You don't need the alternative UI to use Sandboxie.

[zypA13510]

Some projects that are open source, are free as in the freedom of speech and as in free beer, while only offering the sources a release has been build with

@bastik-1001 but those projects allow you to build on top of them, even the ones that are licensed under AGPL still offer you the freedom to build on top of it as long as you also offer your code as AGPL.
But you cannot build on Sandboxie-Plus. If say, one day DavidXanatos is to become unresponsive for family or whatever reason, you are not allowed (legally) to create a Sandboxie-Plus-Plus (not until their death + 70 years anyway). That's the important distinction between open-source and source-available, that's why some of us still cares about the spirit of open source, and that's why many rejected the "open source" claim after the MongoDB license switch.

[isaak654]

@zypA13510 Since you seem to know a lot about it and David is looking for someone to add the CLA, how about submitting a pull request containing a CLA.md file in the repository root?

[bastik-1001]

You are right that what is covered by the custom license is not as free and by comparison worse. Luckily, the core is GPL, so thanks to Sophos for choosing this license to release the code of Sandboxie under, which means not everything would be "lost".

[zypA13510]

@isaak654 I don't claim to know a lot about it. I know a bit about open-source licenses, but I am not a lawyer. 😂
CLAs are very common in dual-licensed/open-core projects.

[isaak654]

Originally posted by @DavidXanatos via Slack on May 13, 2024

We should add a CLA with an integration to the pull workflow similar to what system informer has: https://github.com/winsiderss/systeminformer/blob/master/CLA.md
Would you have time to look into it?

This is the help request shared via Slack, in case anyone wants to open a pull request on this.