Request for clarification of EULA terms

[freakboy3742]

Hi - I'm the maintainer of an Open Source project (Briefcase) that utilizes WiX, a tool that is now released under the terms of the OSMF.

Firstly, let me say that I am sympathetic to what the OSMF is trying to achieve. As a maintainer of an Open Source project, I am all too familiar with the struggle of supporting users who don't contribute in any way to the maintenance of the project.

I wish to comply with both the letter and spirit of what you're trying to achieve with the OSMF. However, some of the language in the EULA is sufficiently vague that I cannot determine if it applies to the way Briefcase is using WiX, or to Briefcase's users.

This is my situation:

• Briefcase is an Open Source (BSD-3-Clause) project. I personally own the trademarks and primary copyright for the project.

• I personally earn money from Github Sponsors, in part because of my work on Briefcase. There are other maintainers; they do not have GitHub sponsors.

• I am currently employed full time by Anaconda, a for-profit company, who generates revenue, but not by selling Briefcase. I am employed as part of an Open Source group at Anaconda, and my remit is to contribute to Open Source projects in the packaging and app development ecosystem. However, while I am paid for my time to work on (amongst other things) Briefcase, my employer has no copyright, trademark, or other IP claim over Briefcase.

• Briefcase itself is not packaged using WiX. It is a tool that exists in the Python language ecosystem, and is installed using standard Python tooling (pip, et al). The installation of Briefcase does not directly result in the installation of WiX.

• However, when an end user runs Briefcase on a Windows machine, and chooses MSI packaging (the current default on Windows), Briefcase will look for an existing install of the WiX Toolset in various ways. If it is not found, it currently downloads the standalone WiX 3 binaries from the Github releases page, and then use those binaries to package software as an MSI.

• Anaconda may, at some point in the future, use Briefcase to package a tool they have created. That product may be offered for free download, or they may charge for access for that tool.

We discovered the OSMF EULA in the process of investigating an upgrade to WiX 6, which is covered by the OSMF EULA.

Given that background, in the opinion of authors of the OSMF EULA, assuming Briefcase were to update to use WiX 6:

1. Is Briefcase a "revenue-generating user" or a "User that generates revenue by the Software"? My reading of the EULA would be a cautious "no" - but I could easily see interpretations where it would be.

2. Are the developers of Briefcase required to pay the fee? Even if the answer to (1) is "yes", my read would be that no, Briefcase is invoking WiX on behalf of a user, so it's the user invoking Briefcase (and transitively, WiX) who has the fee-paying requirement.

3. Are Briefcase users required to pay the fee? Following on from (2), my read would be "yes", but only if they're "revenue-generating Users".

4. If a Briefcase user is a for-profit entity, but they do not earn money from selling the tool that is packaged with Briefcase and WiX - are they a "revenue-generating User"/"User that generates revenue by the Software"? My read would be no, as their revenue is not generated by the tool that WiX is packaging.

5. Clause (4) of the EULA suggests that Briefcase (a BSD-3-Clause project) would be allowed to download the official binaries provided by WiX, and redistribute them as part of it's own install process. Does my reading of this clause match your own expectations?

6. If so, would that trigger any requirements for Briefcase as a project, or Briefcase users, to pay the fee? By my reading, Briefcase would still have no fee requirement, but for end users, this is, at best, ambiguous. A Briefcase-distributed version of the official binary is a "version of the Software provided by the Project" in the sense that the project originally generated the binary; but the version used by the end user wasn't provided to the user by the project - it was provided by Briefcase.

So - what is the opinion of the OSMF authors on these questions?

I can understand the spirit of what you're trying to achieve - the tl;dr being that if you're using software to make money, you should be contributing to the maintenance of that software. That's a completely understandable and reasonable position.

However, the phrases "revenue-generating user" and "provided by the project" are sufficiently imprecise that I find myself unable to determine a clear answer. This confusion is shared by an in-house lawyer at my employer. And, more importantly, there are modes of usage (such as the "redistribute the offical binaries" approach) that appear to be entirely in compliance with the letter of the OSMF EULA, but fail to meet the spirit of the license.

---

On a practical note - I also want to highlight that we found out about this EULA change almost by accident. An online search for WiX leads you to https://www.firegiant.com/wixtoolset/; if click on Get Started, then "Using WiX" under the "WiX Toolset" section, and read the installation documentation, there is no mention of the EULA on any of those pages. If you follow the install instructions for command line installation (dotnet tool install --global wix), the package downloads and installs without displaying anything about the EULA. If you run the tool, installed via dotnet you are not prompted to acknowledge a EULA. The introduction of EULA is not mentioned as a change in the 6.0.0 or 6.0.1 release notes. The GitHub standard LICENSE.txt makes no mention of the EULA associated with the binaries.

It is mentioned in the blog post for the 6.0.0 release, but not the 6.0.1 release. It is also mentioned in the README on GitHub (well "below the fold"); and it comes up as a license to accept if you download the MSI release from the Github releases page - but only if you run the graphical installer. If you manually extract the MSI contents using msiexec /a wix-cli-x86.msi /qn, you won't see the EULA. We didn't come across the first two until we started looking for additional information to guide our 3.0 to 6.0 transition; and the third when we started looking into alternatives to the dotnet installer.

Given the significance of this change to end-users, I would humbly suggest that there is a fairly significant gap in your current documentation strategy.

[JackCoplandGranta]

@freakboy3742 FYI Whilst the EULA is poorly flagged (We also found it incidentally), there are actually additional terms to using the project beyond the license and EULA, see https://github.com/orgs/opensourcemaintenancefee/discussions/3 . By my reading virtually any interaction with the WiX project will result in being subject to the fee (presuming you are a "revenue-generating user").

[robmen]

That reading is not entirely correct, and you'll notice I updated the FAQ to soften the OSMF requires as I mentioned in my response to you in that thread.

At this time, the Discussions forum in the WiX Toolset is open to everyone. We also continue to triage all Issues, even though I suspect some people may not be being entirely truthful about their use of the WiX Toolset when filling out the Issue form. As I noted in my response to Russell, we're still experimenting to determine the appropriate level of enforcement. 😄

[robmen]

First of all, thank you for the very detailed description of your project and how it works. That made it possible to really understand where you're questions were coming from. Very helpful.

Second, I added a few more answers to the FAQ based on your questions and some others that came up in the last couple of weeks. I'll try to use those to answer your questions, but a couple of yours aren't FAQs but still good.

1. Is Briefcase a "revenue-generating user" or a "User that generates revenue by the Software"? My reading of the EULA would be a cautious "no" - but I could easily see interpretations where it would be.

From the FAQ:

Q: My Open Source project takes sponsorships, do I need to pay a fee?

If the sponsorships are donations (i.e. not required in any way), they are not revenue and the Maintenance Fee does not have to be paid. If the sponsorships are required (for example, by requiring a Maintenance Fee), then the sponsorships are revenue and the fee does need to be paid.

So, given my understanding of your project I agree with your assessment: "No".

2. Are the developers of Briefcase required to pay the fee? Even if the answer to (1) is "yes", my read would be that no, Briefcase is invoking WiX on behalf of a user, so it's the user invoking Briefcase (and transitively, WiX) who has the fee-paying requirement.

From the FAQ:

Q: Do I need to pay a fee for a revenue generating Open Source project’s dependencies if I’m just a contributor?

No. A project that makes revenue must pay its fees, but that is a task for the maintainers of the project. Contributors need not be involved.

So, again I agree with your assessement: "No".

3. Are Briefcase users required to pay the fee? Following on from (2), my read would be "yes", but only if they're "revenue-generating Users".

Your assessment is correct. Exactly correct.

4. If a Briefcase user is a for-profit entity, but they do not earn money from selling the tool that is packaged with Briefcase and WiX - are they a "revenue-generating User"/"User that generates revenue by the Software"? My read would be no, as their revenue is not generated by the tool that WiX is packaging.

From the FAQ:

Q: Do I have to pay the fee if my organization makes money but our product that uses the project is offered for free?

Yes. The requirement to pay the Maintenance Fee is based on whether the organization generates revenue, not whether the products they offer are free or not. For example, the product may be offered for free but the organization may make money via advertising or selling a service where the product is a loss leader.

In this case, your assesment is not quite correct, the fee is required. Hopefully, the example provided explains why but I'm happy to discuss more.

5. Clause (4) of the EULA suggests that Briefcase (a BSD-3-Clause project) would be allowed to download the official binaries provided by WiX, and redistribute them as part of it's own install process. Does my reading of this clause match your own expectations?

Correct. Nothing prevents you from doing that.

6. If so, would that trigger any requirements for Briefcase as a project, or Briefcase users, to pay the fee? By my reading, Briefcase would still have no fee requirement, but for end users, this is, at best, ambiguous. A Briefcase-distributed version of the official binary is a "version of the Software provided by the Project" in the sense that the project originally generated the binary; but the version used by the end user wasn't provided to the user by the project - it was provided by Briefcase.

You correctly captured this edge case in your sentence here: And, more importantly, there are modes of usage (such as the "redistribute the offical binaries" approach) that appear to be entirely in compliance with the letter of the OSMF EULA, but fail to meet the spirit of the license. I think it is fair argue that Briefcase can take ownership of the WiX Toolset binaries and insulate users from them. Briefcase now takes responsibility for maintaining the binaries. It absolutely skirts the spirit of the license if Briefcase is not actually doing anything beyond copying the files. But you could "just as easily", rebuild the WiX Toolset yourself and do the same anyway.

When designing the OSMF EULA, attempts to remove this "loophole" introduced undesirable side-effects. If others have concrete suggestions to improve the EULA, I'm all ears.

---

On the practical note, I agree with you that there is more to improve on the documentation front. The WiX Toolset docs site lacking any information was an oversight. I think it was just too close to us to see it as an obvious location to be updated. :) We just finished updating several pages yesterday based on your feedback. Thanks.

The dotnet tool behavior (or lack of behavior really) is incredibly frustrating. I opened the issue with the .NET team dotnet/sdk#48272 and they vaguely argued it's not their problem. I've encouraged others to comment on the issue to point out the negative impact silently accepting the EULA for the user via dotnet tool install. As you can see, there hasn't been much movement. WiX Toolset maintainers are considering what to do if the .NET team won't respect their own setting (which seems likely unless some big companies show up mad that they weren't prompted). 😠

The LICENSE.txt is an OSI approved license for the source code (not the binaries) and should not be modified. That's why the README boldly calls out the OSMF EULA (with a picture! 😁 ) and it is the topic right after the introduction to the project. I disagree that it is "below the fold" and I don't think the OSMF should be the first paragraph describing the WiX Toolset.

The MSI based install works like most instalation packages. The UI provides standard prompts and using a quiet install silently accepts them. I suppose we could require an ACCEPT_EULA property but that's not common. But, I'll definitely take the feedback back to WiX.

In the end, there is absolutely more education to do. However, I've slowed my education work a bit right now because I'm focused on feedback from procurement teams (usually in very large companies) to address their unique payment demands. After that is resolved, I plan to turn my attention back towards education... and eventually enforcement. The funny thing is most devs want to talk about enforcement. But I'm still focused on working out all the kinks in the process as a whole.

Thank you for your feedback. It is helpful in making the Open Source Maintenance Fee successful.