✅ Bitwarden is not FOSS

rokejulianlockhart · July 11, 2024, 2:16pm

As explained undermentioned:

github.com/bitwarden/sdk

License is not FOSS-compatible.

opened 01:44PM - 11 Jul 24 UTC

closed 01:49PM - 11 Jul 24 UTC

RokeJulianLockhart

bug

### Steps To Reproduce Attempt to compile the package to enter it into the F-…Droid repository, per https://gitlab.com/fdroid/rfp/-/issues/114. ### Expected Result It should utilize a FOSS-compatible license. ### Actual Result 1. > https://github.com/bitwarden/sdk/blob/de2a64c10b1e37091adc9eb419e5dc19c6c23971/LICENSE#L1-L295 1. https://gitlab.com/fdroid/rfp/-/issues/114#note_1995138172:~:text=Given%20that%20Bitwarden%20SDK%20is%20not%20FOSS%20Bitwarden%20can't%20be%20included states: > Given that Bitwarden SDK [is not FOSS](https://github.com/bitwarden/sdk?tab=License-1-ov-file) Bitwarden can't be included. ### Screenshots or Videos _No response_ ### Additional Context _No response_ ### Operating System Linux ### Operating System Version `cpe:/o:fedoraproject:fedora:40`, from https://download.fedoraproject.org/pub/fedora/linux/releases/40/Spins/x86_64/iso/Fedora-KDE-Live-x86_64-40-1.14.iso ### Build Version > https://github.com/bitwarden/sdk/blob/de2a64c10b1e37091adc9eb419e5dc19c6c23971/ ### Issue Tracking Info - [X] I understand that work is tracked outside of Github. A PR will be linked to this issue should one be opened to address it, but Bitwarden doesn't use fields like "assigned", "milestone", or "project" to track progress.

Bitwarden isn’t FOSS, because the SDK necessarily to compile it utilizes a proprietary license:

image947×2952 371 KB

This has already prevented Bitwarden being added to F-Droid, per:

rokejulianlockhart · October 25, 2024, 8:13pm

As stated at a GitHub comment:

The mobile client is again suitable for inclusion in F-Droid, per Bitwarden Password Manager (#114) · Issues · F-Droid / Requests For Packaging · GitLab. Shall hide License is not FOSS-compatible. · Issue #898 · bitwarden/sdk · GitHub as resolved.

Specifically, Desktop version 2024.10.0 is no longer free software · Issue #11611 · bitwarden/clients · GitHub states (formatting-modified):

We have made some adjustments to how the SDK code is organized and packaged to allow you to build and run the app with only GPL/OSI licenses included. The sdk-internal package references in the clients now come from a new sdk-internal repository, which follows the licensing model we have historically used for all of our clients (see LICENSE_FAQ.md for more info). The sdk-internal reference only uses GPL licenses at this time. If the reference were to include Bitwarden License code in the future, we will provide a way to produce multiple build variants of the client, similar to what we do with web vault client builds.

The original sdk repository will be renamed to sdk-secrets, and retains its existing Bitwarden SDK License structure for our Secrets Manager business products. The sdk-secrets repository and packages will no longer be referenced from the client apps, since that code is not used there.

Summarily, solely this repository’s contents – the secrets portion of the SDK – should now be non-FOSS, and are packaged separately to the rest of the SDK, which none of the clients reference anymore, consequently.

An important improvement. Of course, if I’ve interpreted that comment correctly.

grb · October 25, 2024, 9:40pm

Let me know if you feel like this feature request can be closed as completed/resolved (which will return the votes to users who have voted for it).

rokejulianlockhart · October 25, 2024, 11:26pm

I think so, @grb, since most users don’t factor in Secrets access, especially in comparison to all the clients (as was previously affected).