The LICENSE file goes in with the first commit and then nobody touches it again, which means the most consequential legal decision a project ever makes gets made on day one, usually by whoever created the repo, usually by picking whatever the GitHub dropdown suggested last time. We made that decision once, deliberately, and then stopped remaking it: every VisorCraft app, from Arte Ogre down to the Realistic Mouse Jiggler, ships GPL-3.0-only, and the two alternatives we rejected, LGPL and dual licensing, were rejected for specific reasons rather than out of copyleft enthusiasm, because the license is not a statement of values, it is a machine that does specific things, and we wanted the specific things GPL-3.0 does and none of the things the alternatives do.

What GPL-3.0-only actually buys a downstream fork

Strip the folklore away and the license says one thing: you can use this software for anything, you can study it and modify it, and if you distribute your modified version, you distribute it under these same terms, with source. The part that matters to us is the last clause, because it is the only mechanism in the whole stack that outlives our interest in the project, so if we abandon a repo tomorrow and someone picks it up, every improvement they make stays public by default, and nobody, including us, can take the codebase private and sell it back to the people who wrote half of it.

The “only” suffix deserves its own paragraph, because most people treat it as noise. GPL-3.0-or-later is a standing pre-consent to whatever text the FSF publishes as GPL-4, sight unseen, and while we trust the FSF about as much as one can trust any foundation, signing a blank check against a document that does not exist is not something we do in contracts, so we do not do it in licenses either; if a GPL-4 arrives and it is good, moving to it while the code is still wholly ours is an afternoon of work, and if it is bad, we never agreed to it. The honest cost of that caution is worth naming, since it is the flip side of the no-CLA stance we take further down: once outside contributions land without a contributor agreement, no single party can relicense the combined work, so a future move to GPL-4 would need every contributor’s consent, and or-later exists precisely to dodge that negotiation. We still take the consent route, because a relicensing conversation with our own contributors is a problem we are happy to have, and a signature on an unread future license is not.

Why not LGPL, and when we go permissive anyway

The LGPL exists for one scenario: a library that the author wants linked into closed-source applications, where the library stays copyleft but the application around it does not have to be. That is a sensible machine for a widget toolkit or a codec, and it is a nonsense machine for an application, because nobody links a desktop PDF editor into anything, so applying LGPL to Kanoprii would change nothing except signaling a confusion about what the artifact is. Where we do want code embedded in other people’s products without copyleft obligations, we say so directly and ship those pieces under Apache-2.0 or MIT, which is why the organization as a whole is a mix, as we said in the original building in the open post, and the boundary is easy to state: the apps, the things a user installs and runs, are GPL-3.0-only, and the permissive licenses go on the components and libraries whose entire job is to be adopted into other people’s code.

Why not dual-license, the honest version

Dual licensing is the MySQL playbook: give the code away under the GPL, sell the same code under a commercial license to anyone the GPL inconveniences. It works, it built real companies, and we considered it seriously, but it has a hidden load-bearing part that its fans underplay, which is that you can only relicense code you own outright, so every outside contribution needs a contributor license agreement assigning rights back to the company, and a CLA is a legal document you are asking a volunteer to sign before they fix your typo. Some projects absorb that friction fine; we decided the trade was wrong for us twice over, first because the thing we sell, Mongrel, is closed source anyway and does not need a GPL shadow version to monetize, and second because we would rather have the typo fix than the paperwork, since a project that cannot accept a drive-by PR without a signature has quietly stopped being open in the way that matters day to day.

What people think the GPL does, versus what it does

The folklore costs us real adoption, so it is worth naming. The GPL does not restrict use; a company with a blanket “no GPL” policy can still run our apps on every desktop it owns, because the copyleft obligations attach to distribution of derived works, not to having the binary on your laptop. The GPL is not contagious across a process boundary or a network call; your proprietary code does not catch anything by talking to ours. What it does prevent, precisely and only, is taking the source, improving it, and shipping the improvement as a closed product, and when a vendor’s policy boils down to “we might want to do that someday,” the honest translation is that the license is working as designed, just not for them. The one genuine hole is the SaaS loophole, the AGPL exists to close it, and we still picked plain GPL-3.0, because our apps are desktop software and the network-use vector that AGPL guards against is not how a desktop image editor gets strip-mined; choosing AGPL to defend against a threat model we do not have would be the same dropdown thinking we criticized at the top, just with a more militant flavor.

The tradeoff, said out loud

The cost is real and we pay it knowingly: some shops will never install anything with GPL in the header, some app stores and embedded contexts are effectively closed to copyleft, and a permissive license would get our code into places it currently cannot go, which is exactly why the permissive licenses exist. We are not optimizing for maximum footprint, though; we publish because we wish someone had published all of this in 2014, as we have said before, and a gift that can be un-given by the first company to fork it is not much of a gift. GPL-3.0-only is the license where “open” stays true after we are no longer the ones maintaining the repo, and twenty-odd years of watching the alternative play out, the permissive project that became somebody’s closed SaaS tier, the dual-licensed project that drowned its contributor base in CLA paperwork, is what settled the question for us. It is not a grand philosophy; it is just the license that means what we meant.