Can this project be built and used on open source code alone?

[ssddanbrown]

Hello 👋,

I've just been playing with the codebase, and just want to confirm if this project can be built and used from the open source code alone?

I'm assuming it is, since the project is advertising itself as an open source project, but when attempting to build I'm seeing issues trying to resolve @budibase/backend-core files, which led me to notice some "pro" mentioning in some parts of the app (so not sure if it's related to licensing or pro components).

Additionally, from just looking at the source, I'm seeing some references to use of a @budibase/pro package while this does not appear to be part of this git repo AFAICT (seems to be an empty submodule)?

[almereyda]

Would you mean freely-licensed open source, in your understanding of the term?

There are many ways to put source out in the open, depending on the license that is chosen.

This must not neccessarily contradict with licencing only parts of an enterprise application freely, and keeping enterprise-oriented features under proprietary licencing, which is also known as the "open-core" model. GitLab is a good example here.

The license statement is a good example of introducing ambiguity here. In https://github.com/Budibase/budibase/blob/master/LICENSE it reads:

Copyright 2019-2021, Budibase Ltd.

Each Budibase package has its own license, please check the license file in each package.

You can consider Budibase to be GPLv3 licensed overall.

The apps that you build with Budibase do not package any GPLv3 licensed code, thus do not fall under those restrictions.

I bet "overall" doesn't count as formal legal speech in any legislation, and thus all individual components that make up a final build package have to be considered for each build. Signed containers with SBOM will allow for provenance and integrity of this kind of metadata.

SBOM

• How to add a Software Bill of Materials (SBOM) to your containers with GitHub Actions
• sbom-tool/docs/setting-up-github-actions.md at main · microsoft/sbom-tool
• Introducing self-service SBOMs - The GitHub Blog
• Generating SBOMs for Your Image with BuildKit | Docker
• Generate the SBOM for Docker images | Docker Docs

sigstore

• Safeguard your containers with new container signing capability in GitHub Actions - The GitHub Blog

[ssddanbrown]

Would you mean freely-licensed open source, in your understanding of the term?

I mean open source as per the commonly understood definition.

If an application is being openly advertised as being "open source", I'd expect to be able to utilise the core value advertised from open source code alone really. I'm not too fussed about the granular licensing setup used, or even there being versions that have non-open code, but If I cannot build and use the application from the sources shared as open source, then I'd consider advertising the project as a whole as open source quite misleading.

I'm not sure if that's the case here though, hence my original question.

[almereyda]

Good question. From what I can tell, the last release from

• https://github.com/Budibase/budibase/actions/workflows/tag-release.yml

was built in a non-public repository, so we cannot verify how and if the build works.

• https://github.com/Budibase/budibase/actions/runs/6825065010/job/18562187547#step:3:3

This points to a private repository budibase/budibase-deploys, where this trail of build provenance stops.

---

Did you check if you could run https://github.com/Budibase/budibase/blob/master/hosting/docker-compose.build.yaml?

Then it would be possible to run a manual build as described in https://github.com/Budibase/budibase/blob/master/docs/DEV-SETUP-DEBIAN.md, and provide feedback to their installation instructions there.

But you are right, of course, that this build procedure appears rather opaque, when considering the generic open source spirit of the GPLv3.

Regarding pro, the OSI doesn't consider it incompatible and their site explicitly states

4. Integrity of The Author’s Source Code

The license may restrict source-code from being distributed in modified form only if the license allows the distribution of “patch files” with the source code for the purpose of modifying the program at build time. The license must explicitly permit distribution of software built from modified source code. The license may require derived works to carry a different name or version number from the original software.

The GPLv3 speaks about modified source and covered work, when they mean that modified versions are distributed. Yet here we see that the dependency is already part of the GPL'ed code, and if it would build sufficiently without it, I wouldn't see a violation. Yet.

The moment that the unreachable dependency is injected by a third-party and unknown means, a lawyer should be consulted.

But not if you are the owner of the copyright, because then you can give yourself different terms than the GPL dictates. This license is for us to use and/or modify/redistribute. As the IP belongs to Budibase Ltd., they can carry on with the code as they please.

My interpretation, but better ask a lawyer.

[ssddanbrown]

Thanks for the input!

Did you check if you could run https://github.com/Budibase/budibase/blob/master/hosting/docker-compose.build.yaml?

Not yet, I was specifically following the debian dev environment process. TBH, I'm not actually running debian (running Fedora) but the dependencies looked platform abstract, and something I could meet.

But not if you are the owner of the copyright, because then you can give yourself different terms than the GPL dictates.

Yeah, I can understand that Budibase can license how they wish, especially since they're getting contributors to hand over copyright via CLA, but my concern (if it's not usable on open source, still to be confirmed) is that it could be quite misleading by being advertised as an open source application. As an example, from the readme:

Budibase is open-source - licensed as GPL v3. This should fill you with confidence that Budibase will always be around. You can also code against Budibase or fork it and make changes as you please, providing a developer-friendly experience.

If I've bet on Budibase based on that, but later looked to fork for whatever reason, and found that chunks of the code were missing or proprietary, I'd be livid and feel misled.

Again, still not sure if that's the case though, may just be build issues on my side, ideally waiting for some kind of official response just to confirm it's buildable/usable from the open source code before attempting further.

[alican92]

@ssddanbrown From what we can tell some parts of Budibase are proprietary and closed source. We've been trying to build BudiBase ourselves with our custom UI changes and we still run into the same issues.

If anything Budibase is becoming more closed source than open source.

The reasoning behind open source software was to allow developers unlimited freedom to fork and alter code and make desired changes. From what it seems Budibase has put limits even on the open source version. From requiring licenses to utilize the full functionality of the Public API to now imposing user limits on self hosted open source instances. We question how this can continue to be called opensource?

@joebudi Why all the limits and restrictions on Budibase and the software is still called Opensource?

[subos2008]

This brings up an interesting question: if a random person contributes to a GPLv3 project and attributes the copyright to the owner of the project. Can the assigned owner of the copyright then re-licence the contributed code?

That would seem rather contrary to the spirit of the GPL?

[ssddanbrown]

@subos2008 Quite often projects like this, under GPL based code, will have a CLA that specifically hands over copyright and allows re-licensing. For many folks, a CLA like this in a GPL project is a red flag, at least in respect to the commitment to open source, although this is very common since building upon and providing paid-for non-open variations is a common strategy (open core).
I think most would indeed see it as against the core spirit of the GPL.

[joshyorko]

So I've yet to find anybody who's actually built it from source. Hopefully some contributor or tryhard will point me in the right direction. I'm going to build it right now