Server Side Public License

Server Side Public License

The Server Side Public License (SSPL) is a source-available software license authored by MongoDB, Inc. and published in 2018 to modify how software provided as a hosted service is governed. It aims to require entities that offer modified versions of covered software as a service to release associated management and deployment code, positioning itself against practices by companies similar to Amazon (company), Google LLC, and Microsoft that deliver proprietary services reusing open-source components. The SSPL has intersected with institutions such as Open Source Initiative, Debian Project, and Red Hat, Inc. in debates about distribution, compliance, and community governance.

Background and Purpose

SSPL emerged following strategic decisions by MongoDB, Inc. after earlier success with patents and commercial subscriptions, echoing tensions seen in cases like MySQL AB and Oracle Corporation over stewardship of open-source software stewardship models. The license was introduced amid discussions at venues such as FOSDEM, OSSCon, and CraftConf where stakeholders from Canonical (company), Elastic NV, and HashiCorp discussed commercialization of server-side deployments. The stated purpose was to compel cloud providers, comparable to Amazon Web Services, Google Cloud Platform, and Microsoft Azure, to either contribute additional code under SSPL or obtain commercial licenses, echoing precedents involving GNU Affero General Public License debates and responses from projects like Redis Ltd..

License Terms and Key Provisions

SSPL reuses permissive and copyleft mechanisms familiar from licenses like GNU General Public License and GNU Affero General Public License, but adds an obligation triggered by offering the licensed work "as a service." Key provisions require that any entity offering the software as a service must release "Service Source Code" encompassing management and orchestration software, analogous to the requirements found in Affero General Public License interpretations and debates involving Free Software Foundation. The license defines covered works, distribution triggers, and downstream obligations in terms that reference deployment scenarios similar to those operated by Heroku, DigitalOcean, and VMware, Inc.. SSPL also addresses patent grants and termination clauses reflecting clauses seen in agreements used by Apple Inc. and Google LLC.

Compatibility and Differences with Other Licenses

SSPL differs from MIT License and Apache License models by imposing service-related reciprocity obligations reminiscent of but broader than GNU Affero General Public License provisions. Where Apache License 2.0 grants patent protections favored by vendors like Red Hat, Inc. and Intel Corporation, SSPL's Service Source Code requirement has been viewed as a stronger copyleft-like constraint that affects compatibility with distributions by projects associated with Debian Project and Linux Foundation. Organizations such as Open Source Initiative and Software Freedom Conservancy evaluated SSPL in relation to accepted definitions of open source found in documents associated with Free Software Foundation and European Union Agency for Cybersecurity. The license's terms influenced downstream relicensing discussions involving companies like Amazon (company) and projects that previously used GNU General Public License family terms.

Adoption and Use Cases

The most notable adopter and author of SSPL is MongoDB, Inc., which relicensed several components to SSPL to govern cloud-hosted offerings by major providers similar to Amazon Web Services and Google Cloud Platform. Other projects and vendors in the database and infrastructure domain — including organizations akin to Elastic NV, Redis Ltd., and Grafana Labs in spirit though with different licensing choices — have faced comparable community responses when changing terms. SSPL has been used mainly by firms seeking to protect commercial AGPL-like offerings and has been discussed at conferences such as KubeCon and Open Source Summit. Some cloud-native platforms and managed service providers evaluated migration strategies referencing practices of Cloudflare, Inc. and DigitalOcean.

Controversies and Legal Challenges

SSPL generated controversy when Open Source Initiative and distributions like Debian Project assessed whether it met their open-source criteria; the OSI ultimately declined to approve SSPL, citing concerns similar to debates earlier involving GNU Affero General Public License interpretations. Legal commentators compared SSPL disputes to antitrust and licensing disputes involving Oracle Corporation and MySQL AB as well as licensing changes by Redis Ltd. that provoked community forks. Cloud providers and service operators, including subsidiaries of Amazon (company) and other hyperscalers, expressed operational and compliance concerns akin to earlier reactions to Creative Commons license variations. Litigation and regulatory scrutiny were anticipated by some legal analysts with expertise from institutions like Stanford University and Harvard University law faculties, but high-profile lawsuits directly challenging SSPL terms have been limited; instead, much resolution occurred through community governance, package maintainers, and distribution policy actions by bodies such as Debian Project and Red Hat, Inc..

Category:Software licenses