[RFC] Updating the PHP License

Hello internals,

I’m opening discussion on an RFC proposing that we relicense PHP under
the Modified BSD License (SPDX identifier: BSD-3-Clause), starting with
PHP 9.0. This change simplifies and modernizes our licensing,
addressing long-standing issues while preserving the rights of both
contributors and users. Below is a quick summary of what the RFC
proposes and what it means for developers.

• Proposes that PHP 9.0 adopt the Modified BSD License (BSD-3-Clause),
  replacing the current PHP and Zend Engine licenses.
• The Modified BSD License is OSI-approved, GPL-compatible, and widely
  recognized in the open source community.
• Your rights as a developer—use, modification, distribution—remain
  unchanged.
• Extensions and tools may adopt BSD-3-Clause in place of the outdated
  PHP License.
• The update removes confusing legacy clauses tied to branding and
  permissions.

I’ve spoken with all members of the PHP Group, and each has voiced their
approval of this proposal. The Perforce legal team has also informally
approved, and I will be working with them to get a formal letter of
approval soon.

The RFC is available at: https://wiki.php.net/rfc/php_license_update

Discussion will remain open for at least six months to ensure all
interested parties have an opportunity to respond.

Cheers,
Ben

P.S. For legal questions or concerns, I’m working with Pamela Chestek
of Chestek Legal https://www.chesteklegal.com on behalf of the PHP
Group. You may be familiar with her work as chair of the license
committee for the Open Source Initiative.

Sounds great. I'm sure this was a lot of work involved. Thank you.

I'd just have two questions here that are popping up to things I've encountered lately:

1. TSRM (Thread Safe Resource Manager) also has a separate LICENSE file but it is BSD 2 Clause, which is compatible with all of that, I assume. That should be also simplified in some way? Perhaps integrating TSRM into Zend Engine directly at some point or updating its license to 3 clause BSD?

The license that applies to TSRM should remain the same. For one, it’s already under a widely-accepted and permissive OSI-approved license. Secondly, I think changing it would require approval from all contributors:

1. The license on TSRM doesn’t explicitly reserve the right for anyone to change the license (the PHP License and Zend Engine Licenses do), so no one can unilaterally change the license.

2. Changing from BSD-2-Clause to BSD-3-Clause adds more restrictions to the terms authors have granted by including the 3rd clause (i.e., “Neither the name of the copyright holder…”). So, the authors would need to approve of these additional restrictions added to the use of their contributions.

There are only about 70 contributors to TSRM, so getting approvals wouldn’t be too hard, but I also don’t think it’s necessary to change the license on it.

It looks like TSRM was originally written with the intention of being a standalone library that could be used apart from PHP, which is why it was contributed under a different license.

2. To be more clear, the GPL compatibility would probably need to be just slightly clarified to make PHP usage simpler in the future for cases when GPL-licensed software is involved.

PHP currently has option to link to two GPL-3 licensed libraries that cause issues when distributing PHP (for example, packaging PHP and providing it as a binary via some package and similar):

• GNU readline library for ext/readline (here libedit alternative can be used)
  https://github.com/php/php-src/issues/16826
• GDBM for ext/dba (here other handlers can be used)
  https://github.com/php/php-src/issues/15882

So, GPL-compatibility here means that PHP licensed under the Modified BSD License could link to GNU Readline library but it should be relicensed as GPL-3 then?

Because I'm thinking of deprecating linking options with GNU Readline and GDBM to make the PHP build process worry-free for packagers.

I’m not sure what you mean by “GPL compatibility would probably need to be just slightly clarified to make PHP usage simpler.”

The FSF considers the Modified BSD License as compatible with the GPL.^1 They elaborate on what they mean by compatibility:

“It means that the other license and the GNU GPL are compatible; you can combine code released under the other license with code released under the GNU GPL in one larger program.

“All GNU GPL versions permit such combinations privately; they also permit distribution of such combinations provided the combination is released under the same GNU GPL version.”^2

Being licensed under the Modified BSD License means that PHP may be combined with GPL-licensed software and released together with that software, as long as the combination is released under the terms of the GPL.

For those who are packaging PHP and linking against GPL libraries, the current PHP License, version 3.01, presents an incompatibility that cannot be resolved because of the additional restrictions it places on users.^3 However, under the Modified BSD License, there is no incompatibility, as long as the combined package is released under the terms of the GPL.

Example: if I create a PHP package that links against Readline (whether statically or dynamically) the GPL considers this a combined work, and I must release the combination under the terms of the same version of the GPL that covers Readline.^4

Does that clear things up?

Cheers
Ben

The RFC is available at: https://wiki.php.net/rfc/php_license_update

Discussion will remain open for at least six months to ensure all
interested parties have an opportunity to respond.

Thanks for tackling this. Licensing issues can be thorny.

I only really have one comment — why wait until (specifically) PHP 9,
and not PHP-next (the one after 8.5)?

cheers,
Derick

I don’t think there are any technical or legal reasons for this. When I began discussing this with others a few years ago, the next major version (PHP 9) seemed like the right time to make a major licensing change.

If others think PHP-next (i.e., either 8.6 or 9.0, whichever comes first) is the right version for this change, then I’m okay with that.

Cheers,
Ben