How do open source licenses work, and what do they leave out?

Merge ConflictsPart 5 of 5

Who decides in an open source project, how they decide, and who can review the decision. Twelve projects, the same questions.

In this series 5 parts published
Open source licenses: Merge Conflicts cover. License equals permission, not governance, on a torn paper strip.

Open source licenses are permission slips from the people who hold the copyright. They say what anyone may do with the code: run it, read it, change it and share it. They don’t say who runs the project. This post shows how that permission works, who can change it, and what it leaves out.

Key takeaways

  • The big picture: An open source license is permission from the people who hold the copyright to run, change and share the code.
  • Why it matters: When a plugin goes quiet, the license lets you fork it, patch it and ship your own version.
  • Two families: Permissive licenses, such as MIT, ask for credit and little else. Copyleft licenses, such as the GPL, ask you to pass the same freedoms along.
  • Yes, but: No license decides the name, the directory listing, the accounts or the vote.

🍴 What does an open source license let you do with a plugin?

Say a plugin you use goes quiet. No updates for a year, and your client needs a fix. You copy the code, patch it and ship your own version. That’s called a fork.

The developer, in a manual wheelchair, copies a plugin folder tagged GPL into a fork at a laptop.
Forking a plugin: the license already said yes. Illustration made with ChatGPT at my direction.

You didn’t ask anyone’s permission, because the license already gave it.

verified

The plugin directory’s first guideline reads: “Plugins must be compatible with the GNU General Public License.”1 That license is the reason your fork is allowed. It isn’t a loophole.

analysis

Here’s the plain version. A license is written permission from whoever holds the copyright. An open source license gives that permission to everyone at once, in advance.

verified

The Open Source Initiative (OSI) puts the catch up front: “Open source doesn’t just mean access to the source code.”2 Reading the code isn’t enough. The license must also let you change it and pass it on.

🧾 What makes a license count as open source?

The OSI keeps the Open Source Definition, version 1.9.3 It lists ten criteria a license must meet. To get on the OSI’s list, “a license must go through the Open Source Initiative’s license review process.”4

Five of the ten criteria do most of the work for a site builder.

verified

CriterionWhat the definition saysWhat it means for you
1. Free Redistribution“The license shall not restrict any party from selling or giving away the software”You can share it, or sell it
2. Source Code“The program must include source code”You get the readable version, not only the compiled one
3. Derived Works“The license must allow modifications and derived works”Your fork is allowed
5. No Discrimination Against Persons or Groups“The license must not discriminate against any person or group of persons.”Nobody gets left off the list
6. No Discrimination Against Fields of Endeavor“The license must not restrict anyone from making use of the program in a specific field of endeavor.”A business can use it, and so can a lab

Criterion 6 even gives examples. A license “may not restrict the program from being used in a business, or from being used for genetic research.”5 (So your client’s bakery site is covered, and so is the genetics lab next door.)

↔️ What’s the difference between permissive and copyleft licenses?

Open source licenses split into two broad families. The split comes from one question: what must you do when you share your changed copy?

verified

Permissive licenses ask for credit and little else. The MIT License grants permission “free of charge, to any person obtaining a copy of this software.” Its main condition is short: “The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.”6 Keep the notice, and you can ship your changes under almost any terms, closed ones included.

verified

Copyleft licenses ask you to pass the same freedoms along. The GNU General Public License (GPL), version 2, covers any work you share that contains or comes from the program. That work must be “licensed as a whole at no charge to all third parties under the terms of this License.”7 In other words, if you share your fork, your fork stays GPL too.

analysis

When you share a changed copyPermissive, such as MITCopyleft, such as GPLv2
Keep the copyright noticeYesYes
Share your changes under the same licenseNot requiredRequired
Ship a closed versionAllowedNot allowed

“No charge” there doesn’t mean you can’t sell. The same GPL says, “You may charge a fee for the physical act of transferring a copy.”8 Its preamble sums it up: “When we speak of free software, we are referring to freedom, not price.”9 Merge Conflicts 1.2 on free as in freedom spent a whole post on that line. I’ll stop here before this becomes a sequel.

🧩 How do open source licenses work for WordPress?

I contribute to WordPress, and I used to be a Training Team faculty member, so read this section with that in mind.

verified

WordPress.org states it plainly: “The license under which the WordPress software is released is the GPLv2 (or later) from the Free Software Foundation.”10 The license file in the WordPress code says the same, with the option to use “any later version.”11

analysis

That file also says who holds the copyright: “Copyright 2011-2026 by the contributors.”12 No company or foundation collects the copyright for the code. Each contributor keeps theirs and shares it under the GPL. The dossier found no contributor license agreement (CLA) or Developer Certificate of Origin (DCO) in the repository’s contributing file.13

verified

WordPress.org also takes a stand: “we feel strongly that plugins and themes are derivative work and thus inherit the GPL license.”14 That’s an organization’s stated position. It isn’t a court ruling, and this post doesn’t treat it as one. Whether a court would agree is unknown.

🔁 Who can change an open source license?

A license can change, but only the people holding the copyright can change it. How many people that is depends on the project’s contributor terms.

verified

PHP changed its license in 2025 and 2026, through a Request for Comments (RFC). The RFC “PHP License Update” says: “The Modified BSD License is adopted as the PHP License, version 4.”15 The vote passed 51 to 0, with 2 abstentions.16

The RFC also states who had the power to do it. It says “condition 5 grants the PHP Group the authority to make changes to the PHP License, without approval from any contributors.”17 For the Zend Engine License, it says Perforce Software holds “the sole authority to make changes.”18 Asked whether every contributor had to agree, it answers: “The short answer is, ‘No.’”19 That’s the RFC’s own reasoning. The dossier found no lawyer’s opinion either way.20

How do six projects compare on who can relicense?

Other projects answer the same question differently. Here are six from the series’ comparison, sorted alphabetically, with WordPress as one row. I work at Pantheon, a WordPress and Drupal host, so two of these rows touch my employer’s business.

verified

ProjectCode licenseContributor termsWho could relicense
DrupalGPL-2.0-or-laterContributors keep copyright; no CLA or DCO mentionedThe project lead decides distribution; a legal change needs contributor consent (analysis)
GhostMITCLA lets the Ghost Foundation license contributions “on any licensing terms”The Ghost Foundation, for contributed code (analysis)
MySQLGPLv2 plus a commercial licenseContributor agreement assigns joint ownership to OracleOracle, for its code and its joint share (analysis)
Node.jsMITDCO sign-off; no CLAAll contributors, which is impractical (analysis)
PHPBSD-3-Clause, since the RFC aboveContributors certify their rights; no CLAThe PHP Group and Perforce, after a vote
WordPressGPLv2 or laterNo CLA or DCO foundEvery copyright holder; no single holder found (analysis)

The license and contributor columns come from each project’s own files, as read for the dossier.21 The last column is analysis unless the row says otherwise.

analysis

Here’s the counterweight. The “or later” in WordPress’s license lets anyone use a later GPL version.22 So the Free Software Foundation, which writes the GPL, shapes WordPress’s terms without a WordPress vote. That’s how “or later” works for every project that uses it. It isn’t a WordPress quirk.

🚫 What don’t open source licenses decide?

A plugin founder holds a sheet reading LICENSE over code; a name tag, ballot box, server and keys sit outside it.
What the license covers, and what sits outside it. Illustration made with ChatGPT at my direction.

analysis

Here’s the catch. A license grants rights over code. It grants no vote, no account, no seat and no say over the servers.23

Think back to your forked plugin. The license let you copy the code. It didn’t give you any of these.

analysis

  • Name. “The WordPress® trademark is the intellectual property of the WordPress Foundation.”24 Code freedom and name rights come from different documents.
  • Directory listing. Who can list, close or restore a plugin comes from directory rules, not the GPL.
  • Accounts and chat rooms. Logins and team roles on WordPress.org follow their own policies.
  • Votes. Who picks releases, budgets or leaders comes from bylaws, charters or practice, if anything is written at all.

So a project can be fully open source and still have one person or one company deciding everything else. The license can’t tell you which kind of project you’re in. Seasons 2 and 3 of this series go looking for those other documents, project by project.

What this post leaves out

This post covers how licenses work, not every license fight. It skips:

  • Licenses that left open source, such as the Server Side Public License (SSPL) and the Business Source License (BSL). The dossier has those cases, and a later post covers them.
  • GPL version 3 and patents. Version 3 added patent terms; this post quotes version 2 only.
  • Legal advice. I’m not a lawyer. For your own project, ask one.

📋 Quick answers about open source licenses

What is an open source license?

Written permission from whoever holds the copyright, given to everyone at once, in advance. To be called open source, a license has to meet the Open Source Initiative’s Open Source Definition and pass its license review.

What is the difference between permissive and copyleft licenses?

A permissive license, such as MIT, asks you to keep the copyright notice and lets you ship changes under almost any terms. A copyleft license, such as the GPL, asks you to share your changed copy under the same license.

Can you charge money for free software?

Yes. The GPL says you may charge a fee for the physical act of transferring a copy. In free software, free means freedom, not price.

Who can change an open source license?

Only the people who hold the copyright. In WordPress, each contributor keeps their copyright, so no single holder exists. In PHP, the PHP Group and Perforce changed the license after a community vote.

What does an open source license not decide?

The name, the directory listing, the accounts and the vote. A license grants rights over code; organizational rights come from other documents, if they are written down at all.

❓ Which license questions can you ask about any project?

Pick a plugin, theme or tool you depend on. Ask its records these five questions. Mark each answer documented, unclear, or a tradeoff you accept:

  1. License. Which license does it use, and is that license on the OSI’s list?
  2. Share alike. If you change it and share it, must your version use the same license?
  3. Copyright. Who holds the copyright: each contributor, a foundation or a company?
  4. Change. Who could change the license, and would anyone have to ask you?
  5. Everything else. Where are the rules for the name, the accounts and the vote written down, if anywhere?

Questions 1, 3 and 4 match the license and contributor columns in the series’ comparison. Question 5 is the rest of Merge Conflicts.

My relationships that bear on this post
  • Pantheon, my employer, a WordPress and Drupal host.
  • GoDaddy, where I managed the Five for the Future contributors until July 2026.
  • The WordPress Training Team, where I was a faculty member and a team rep. I’m not active on the team now.
  • The FAIR Package Manager, where I used to sit on the Technical Steering Committee.
  • The WPOCC, where I’m one of the founding board members.
  • Questions I asked on stage at WordCamp US 2024, the WordCamp Europe 2025 fireside and WordCamp Canada 2025.
  • My own words appear in court exhibits in WPEngine v. Automattic (Dkt. 18-28, 107-4, 18-5 and 69-16). The series reports that litigation in pairs.

Where this post sits in the series

This post follows 1.3, From GNU to GitHub: what does the history of open source say about who decides? It uses the labels on the Merge Conflicts methods page. Next up is 1.5, the twelve projects this series compares. Follow along on the Merge Conflicts series page.

Footnotes (24)
  1. WordPress.org. “Detailed Plugin Guidelines.” Plugin Handbook, Developer.WordPress.org. Last updated 2026-03-11. https://developer.wordpress.org/plugins/wordpress-org/detailed-plugin-guidelines/. Accessed 2026-11-06. Guideline 1. ↩︎
  2. Open Source Initiative. “The Open Source Definition.” opensource.org. Version 1.9, last modified 2007-03-22; page modified 2024-02-16. https://opensource.org/osd. Accessed 2026-11-06. ↩︎
  3. Open Source Initiative. “The Open Source Definition.” opensource.org. Version 1.9, last modified 2007-03-22; page modified 2024-02-16. https://opensource.org/osd. Accessed 2026-11-06. ↩︎
  4. Open Source Initiative. “OSI Approved Licenses.” opensource.org. https://opensource.org/licenses. Accessed 2026-11-06. ↩︎
  5. Open Source Initiative. “The Open Source Definition.” opensource.org. Version 1.9, last modified 2007-03-22; page modified 2024-02-16. https://opensource.org/osd. Accessed 2026-11-06. ↩︎
  6. Open Source Initiative. “The MIT License.” opensource.org. https://opensource.org/license/mit. Accessed 2026-11-06. ↩︎
  7. WordPress. “license.txt” (WordPress copyright notice and the full text of the GNU General Public License, version 2, June 1991). wordpress-develop repository, trunk. https://github.com/WordPress/wordpress-develop/blob/trunk/src/license.txt [TXT]. Accessed 2026-11-06. Sections quoted: copyright notice, preamble, sections 1 and 2(b). ↩︎
  8. WordPress. “license.txt” (WordPress copyright notice and the full text of the GNU General Public License, version 2, June 1991). wordpress-develop repository, trunk. https://github.com/WordPress/wordpress-develop/blob/trunk/src/license.txt [TXT]. Accessed 2026-11-06. Sections quoted: copyright notice, preamble, sections 1 and 2(b). ↩︎
  9. WordPress. “license.txt” (WordPress copyright notice and the full text of the GNU General Public License, version 2, June 1991). wordpress-develop repository, trunk. https://github.com/WordPress/wordpress-develop/blob/trunk/src/license.txt [TXT]. Accessed 2026-11-06. Sections quoted: copyright notice, preamble, sections 1 and 2(b). ↩︎
  10. WordPress.org. “License.” WordPress.org. https://wordpress.org/about/license/. Accessed 2026-11-06. ↩︎
  11. WordPress. “license.txt” (WordPress copyright notice and the full text of the GNU General Public License, version 2, June 1991). wordpress-develop repository, trunk. https://github.com/WordPress/wordpress-develop/blob/trunk/src/license.txt [TXT]. Accessed 2026-11-06. Sections quoted: copyright notice, preamble, sections 1 and 2(b). ↩︎
  12. WordPress. “license.txt” (WordPress copyright notice and the full text of the GNU General Public License, version 2, June 1991). wordpress-develop repository, trunk. https://github.com/WordPress/wordpress-develop/blob/trunk/src/license.txt [TXT]. Accessed 2026-11-06. Sections quoted: copyright notice, preamble, sections 1 and 2(b). ↩︎
  13. Merge Conflicts governance dossier. “Legal structure and IP matrix” and “What ‘open’ means.” Claims V-SA-01, V-SA-02, C-DRU-011, C-BG-036, C-MDB-102, C-MDB-103, C-JS-078, C-PHP-027 to C-PHP-029, all verified. Primary files: Drupal licensing FAQ, https://www.drupal.org/about/licensing ; Ghost LICENSE and CONTRIBUTING.md, https://github.com/TryGhost/Ghost ; MySQL licensing, https://www.mysql.com/about/legal/licensing/oem/ ; Node.js LICENSE and pull request guide, https://github.com/nodejs/node ; PHP CONTRIBUTING.md, https://github.com/php/php-src. Read 2026-10-26 to 2026-10-27. ↩︎
  14. WordPress.org. “License.” WordPress.org. https://wordpress.org/about/license/. Accessed 2026-11-06. ↩︎
  15. PHP. “PHP RFC: PHP License Update.” PHP Wiki. Status Accepted; vote 51 yes, 0 no, 2 abstain. https://wiki.php.net/rfc/php_license_update. Accessed 2026-11-06. ↩︎
  16. PHP. “PHP RFC: PHP License Update.” PHP Wiki. Status Accepted; vote 51 yes, 0 no, 2 abstain. https://wiki.php.net/rfc/php_license_update. Accessed 2026-11-06. ↩︎
  17. PHP. “PHP RFC: PHP License Update.” PHP Wiki. Status Accepted; vote 51 yes, 0 no, 2 abstain. https://wiki.php.net/rfc/php_license_update. Accessed 2026-11-06. ↩︎
  18. PHP. “PHP RFC: PHP License Update.” PHP Wiki. Status Accepted; vote 51 yes, 0 no, 2 abstain. https://wiki.php.net/rfc/php_license_update. Accessed 2026-11-06. ↩︎
  19. PHP. “PHP RFC: PHP License Update.” PHP Wiki. Status Accepted; vote 51 yes, 0 no, 2 abstain. https://wiki.php.net/rfc/php_license_update. Accessed 2026-11-06. ↩︎
  20. Merge Conflicts governance dossier. “Legal structure and IP matrix” and “What ‘open’ means.” Claims V-SA-01, V-SA-02, C-DRU-011, C-BG-036, C-MDB-102, C-MDB-103, C-JS-078, C-PHP-027 to C-PHP-029, all verified. Primary files: Drupal licensing FAQ, https://www.drupal.org/about/licensing ; Ghost LICENSE and CONTRIBUTING.md, https://github.com/TryGhost/Ghost ; MySQL licensing, https://www.mysql.com/about/legal/licensing/oem/ ; Node.js LICENSE and pull request guide, https://github.com/nodejs/node ; PHP CONTRIBUTING.md, https://github.com/php/php-src. Read 2026-10-26 to 2026-10-27. ↩︎
  21. Merge Conflicts governance dossier. “Legal structure and IP matrix” and “What ‘open’ means.” Claims V-SA-01, V-SA-02, C-DRU-011, C-BG-036, C-MDB-102, C-MDB-103, C-JS-078, C-PHP-027 to C-PHP-029, all verified. Primary files: Drupal licensing FAQ, https://www.drupal.org/about/licensing ; Ghost LICENSE and CONTRIBUTING.md, https://github.com/TryGhost/Ghost ; MySQL licensing, https://www.mysql.com/about/legal/licensing/oem/ ; Node.js LICENSE and pull request guide, https://github.com/nodejs/node ; PHP CONTRIBUTING.md, https://github.com/php/php-src. Read 2026-10-26 to 2026-10-27. ↩︎
  22. WordPress. “license.txt” (WordPress copyright notice and the full text of the GNU General Public License, version 2, June 1991). wordpress-develop repository, trunk. https://github.com/WordPress/wordpress-develop/blob/trunk/src/license.txt [TXT]. Accessed 2026-11-06. Sections quoted: copyright notice, preamble, sections 1 and 2(b). ↩︎
  23. Merge Conflicts governance dossier. “Legal structure and IP matrix” and “What ‘open’ means.” Claims V-SA-01, V-SA-02, C-DRU-011, C-BG-036, C-MDB-102, C-MDB-103, C-JS-078, C-PHP-027 to C-PHP-029, all verified. Primary files: Drupal licensing FAQ, https://www.drupal.org/about/licensing ; Ghost LICENSE and CONTRIBUTING.md, https://github.com/TryGhost/Ghost ; MySQL licensing, https://www.mysql.com/about/legal/licensing/oem/ ; Node.js LICENSE and pull request guide, https://github.com/nodejs/node ; PHP CONTRIBUTING.md, https://github.com/php/php-src. Read 2026-10-26 to 2026-10-27. ↩︎
  24. WordPress.org. “License.” WordPress.org. https://wordpress.org/about/license/. Accessed 2026-11-06. ↩︎
, , , , ,

FIELD NOTES

Get the next field note in your inbox

A weekly note from the open-source frontier — what I’m building, breaking, and learning. No spam, no AI summaries, real writing from a real human.

Subscribe →
See past issues

Comments

Leave a Reply

Your email address will not be published. Required fields are marked *

To respond on your own website, enter the URL of your response which should contain a link to this post’s permalink URL. Your response will then appear (possibly after moderation) on this page. Want to update or remove your response? Update or delete your post and re-enter your post’s URL again. (Find out more about Webmentions.)

More from the blog