[RFC] Updating the PHP License

Hello internals,

I’m opening discussion on an RFC proposing that we relicense PHP under
the Modified BSD License (SPDX identifier: BSD-3-Clause), starting with
PHP 9.0. This change simplifies and modernizes our licensing,
addressing long-standing issues while preserving the rights of both
contributors and users. Below is a quick summary of what the RFC
proposes and what it means for developers.

• Proposes that PHP 9.0 adopt the Modified BSD License (BSD-3-Clause),
  replacing the current PHP and Zend Engine licenses.
• The Modified BSD License is OSI-approved, GPL-compatible, and widely
  recognized in the open source community.
• Your rights as a developer—use, modification, distribution—remain
  unchanged.
• Extensions and tools may adopt BSD-3-Clause in place of the outdated
  PHP License.
• The update removes confusing legacy clauses tied to branding and
  permissions.

I’ve spoken with all members of the PHP Group, and each has voiced their
approval of this proposal. The Perforce legal team has also informally
approved, and I will be working with them to get a formal letter of
approval soon.

The RFC is available at: https://wiki.php.net/rfc/php_license_update

Discussion will remain open for at least six months to ensure all
interested parties have an opportunity to respond.

Cheers,
Ben

P.S. For legal questions or concerns, I’m working with Pamela Chestek
of Chestek Legal https://www.chesteklegal.com on behalf of the PHP
Group. You may be familiar with her work as chair of the license
committee for the Open Source Initiative.

Sounds great. I'm sure this was a lot of work involved. Thank you.

I'd just have two questions here that are popping up to things I've encountered lately:

1. TSRM (Thread Safe Resource Manager) also has a separate LICENSE file but it is BSD 2 Clause, which is compatible with all of that, I assume. That should be also simplified in some way? Perhaps integrating TSRM into Zend Engine directly at some point or updating its license to 3 clause BSD?

The license that applies to TSRM should remain the same. For one, it’s already under a widely-accepted and permissive OSI-approved license. Secondly, I think changing it would require approval from all contributors:

1. The license on TSRM doesn’t explicitly reserve the right for anyone to change the license (the PHP License and Zend Engine Licenses do), so no one can unilaterally change the license.

2. Changing from BSD-2-Clause to BSD-3-Clause adds more restrictions to the terms authors have granted by including the 3rd clause (i.e., “Neither the name of the copyright holder…”). So, the authors would need to approve of these additional restrictions added to the use of their contributions.

There are only about 70 contributors to TSRM, so getting approvals wouldn’t be too hard, but I also don’t think it’s necessary to change the license on it.

It looks like TSRM was originally written with the intention of being a standalone library that could be used apart from PHP, which is why it was contributed under a different license.

2. To be more clear, the GPL compatibility would probably need to be just slightly clarified to make PHP usage simpler in the future for cases when GPL-licensed software is involved.

PHP currently has option to link to two GPL-3 licensed libraries that cause issues when distributing PHP (for example, packaging PHP and providing it as a binary via some package and similar):

• GNU readline library for ext/readline (here libedit alternative can be used)
  https://github.com/php/php-src/issues/16826
• GDBM for ext/dba (here other handlers can be used)
  https://github.com/php/php-src/issues/15882

So, GPL-compatibility here means that PHP licensed under the Modified BSD License could link to GNU Readline library but it should be relicensed as GPL-3 then?

Because I'm thinking of deprecating linking options with GNU Readline and GDBM to make the PHP build process worry-free for packagers.

I’m not sure what you mean by “GPL compatibility would probably need to be just slightly clarified to make PHP usage simpler.”

The FSF considers the Modified BSD License as compatible with the GPL.^1 They elaborate on what they mean by compatibility:

“It means that the other license and the GNU GPL are compatible; you can combine code released under the other license with code released under the GNU GPL in one larger program.

“All GNU GPL versions permit such combinations privately; they also permit distribution of such combinations provided the combination is released under the same GNU GPL version.”^2

Being licensed under the Modified BSD License means that PHP may be combined with GPL-licensed software and released together with that software, as long as the combination is released under the terms of the GPL.

For those who are packaging PHP and linking against GPL libraries, the current PHP License, version 3.01, presents an incompatibility that cannot be resolved because of the additional restrictions it places on users.^3 However, under the Modified BSD License, there is no incompatibility, as long as the combined package is released under the terms of the GPL.

Example: if I create a PHP package that links against Readline (whether statically or dynamically) the GPL considers this a combined work, and I must release the combination under the terms of the same version of the GPL that covers Readline.^4

Does that clear things up?

Cheers
Ben

The RFC is available at: https://wiki.php.net/rfc/php_license_update

Discussion will remain open for at least six months to ensure all
interested parties have an opportunity to respond.

Thanks for tackling this. Licensing issues can be thorny.

I only really have one comment — why wait until (specifically) PHP 9,
and not PHP-next (the one after 8.5)?

cheers,
Derick

I don’t think there are any technical or legal reasons for this. When I began discussing this with others a few years ago, the next major version (PHP 9) seemed like the right time to make a major licensing change.

If others think PHP-next (i.e., either 8.6 or 9.0, whichever comes first) is the right version for this change, then I’m okay with that.

Cheers,
Ben

Hi

The RFC is available at: https://wiki.php.net/rfc/php_license_update

Discussion will remain open for at least six months to ensure all
interested parties have an opportunity to respond.

With the new policy in https://wiki.php.net/rfc/rfc_discussion_and_vote,
RFCs are considered inactive after 42 days to ensure that the discussion
is fresh. The long discussion period on this RFC will not help anyone if
the thread is already buried my several other RFCs and folks already
forgot about it.

I'm thus using the opportunity to bump this discussion to the top of the
inbox and to also note that the new policy very strongly encourages that
the final voting widgets are added early to an RFC (since the addition
of a voting widget is considered a Major Change). Don't forget to
include the “Abstain” option.

Best regards
Tim Düsterhus

Thanks, Tim, for bumping this thread.

I've updated the RFC to include the voting widget, including the Abstain
option.

So far, I think the only substantial bit of feedback comes from Derick:

I only really have one comment — why wait until (specifically) PHP 9,
and not PHP-next (the one after 8.5)?

My response was:

I don't think there are any technical or legal reasons for for this.
When I began discussing this with others a few years ago, the next
major version (PHP 9) seemed like the right time to make a major
licensing change.

If others think PHP-next (i.e., either 8.6 or 9.0, whichever comes
first) is the right version for this change, then I'm okay with that.

What do others think? Should this be for PHP 8.6, or should it wait
until PHP 9.0?

According to the original timeline for this, I plan to open voting for
this in early January, and according to the new RFC policy, I'll ensure
the discussion is active with the proper cool-down period before I open
voting.

Cheers,
Ben

Hi,

Hello internals,

I’m opening discussion on an RFC proposing that we relicense PHP under
the Modified BSD License (SPDX identifier: BSD-3-Clause), starting with
PHP 9.0. This change simplifies and modernizes our licensing,
addressing long-standing issues while preserving the rights of both
contributors and users. Below is a quick summary of what the RFC
proposes and what it means for developers.

• Proposes that PHP 9.0 adopt the Modified BSD License (BSD-3-Clause),
  replacing the current PHP and Zend Engine licenses.
• The Modified BSD License is OSI-approved, GPL-compatible, and widely
  recognized in the open source community.
• Your rights as a developer—use, modification, distribution—remain
  unchanged.
• Extensions and tools may adopt BSD-3-Clause in place of the outdated
  PHP License.
• The update removes confusing legacy clauses tied to branding and
  permissions.

I read it through and it's really nice! +1 on this. I already started using
BSD License for some of the new stream changes - we are not required to use
PHP license and other licenses are already contained in it - mainly BSD
(e.g. FPM) and Apache.

FPM is actually 2-Clause BSD:
https://github.com/php/php-src/blob/php-8.5.0/sapi/fpm/LICENSE . It might
make sense to cover it in the RFC and update it to 3-Clause as well maybe?
Also we should add headers with SPDX tag to its files where it's missing
completely - see
https://github.com/php/php-src/blob/php-8.5.0/sapi/fpm/fpm/fpm.c#L1 for
example. Assuming that it's fine to change it because the project is under
that license..?

I’ve spoken with all members of the PHP Group, and each has voiced their
approval of this proposal. The Perforce legal team has also informally
approved, and I will be working with them to get a formal letter of
approval soon.

It would be good to get this stored somewhere so we have got proof of it.
It can be done privately but the point is that more people would have
access in case it is ever needed and you are not available.

It could be slightly clearer in the RFC that you have already all approvals
from PHP Group members - it just talks about how many of them might be
needed and then list them as approved without saying that it is all covered.

I guess the vote can start without the formal approval from Perforce but
the actual change should wait for it.

The RFC is available at: https://wiki.php.net/rfc/php_license_update

Discussion will remain open for at least six months to ensure all
interested parties have an opportunity to respond.

Cheers,
Ben

P.S. For legal questions or concerns, I’m working with Pamela Chestek
of Chestek Legal https://www.chesteklegal.com on behalf of the PHP
Group. You may be familiar with her work as chair of the license
committee for the Open Source Initiative.

The only feedback I've received thus far regards the proposed PHP
version. After thinking on it a bit, I agree with changing the proposed
PHP version from 9.0 to the next version of PHP, whether that's 8.6 or
9.0. I've updated the RFC to reflect this.

You should just target just PHP 8.6 which is the automatic next version
unless there is an RFC that would change it to 9.0.

Kind regards,

Jakub