[rossy]

I checked my repo to see which Stalwart version I was running and if I could update, and I was surprised to find that the Arch package has been deleted due to FOSS licensing concerns[1], the most severe of which seems to be that Stalwart can no longer build without proprietary code[2]. Other smaller issues include the fact that the web admin interface isn't included in the source distribution, but is downloaded from GitHub on first run, and _also_ seems to contain proprietary code[3].

These issues, which would be showstoppers for a real free software project, and pretty easy to fix if you were the rightsholder of the code, were promised to be fixed "in a few weeks" in September last year, and "in a few months" in January this year, however they're still not fixed, which means I can't upgrade - not that I probably want to anymore. I truly believe in free software, so I find the idea of using "open source" as an empty marketing bullet-point for at least eight months to be fairly distasteful. Might be time to switch to Maddy.

[1]: https://gitlab.archlinux.org/archlinux/packaging/packages/st... [2]: https://github.com/stalwartlabs/stalwart/issues/783 [3]: https://gitlab.archlinux.org/archlinux/packaging/packages/st...

[StalwartLabs]

I want to clarify that Stalwart can absolutely be compiled without any proprietary code. All you need to do is omit the Enterprise feature flag during compilation [0], and what you get is a 100% AGPL-3.0 build. The Arch package removal wasn’t because the software suddenly became non-free, but rather due to a packaging requirement: Arch needs a clean separation of the Enterprise code from the source tree, and that’s something we haven’t done yet (it will be implemented as a script). The delay isn’t due to any unwillingness to comply, it’s simply been a matter of prioritization. Over the past few months, the focus was on delivering major features like WebDAV support. That said, I'm still fully committed to resolving the packaging issue because we want Stalwart back in Arch as much as you do.

It’s also worth noting that only about 5% of the codebase is Enterprise, and that small slice helps fund ongoing development and expansion of the team [1]. As much as I'd love to be completely sponsor-funded, the reality is that open source projects still need to cover real-world costs. For what it's worth, Stalwart has received two NLNet grants [2] [3] to support open protocol work, which hopefully reinforces our commitment to open source.

So while the optics of this situation may look rough from the outside, I promise it’s not some “open source in name only” kind of thing. It’s just one of those painful balance acts between building features, maintaining packages, and paying the bills.

And hey, if you're heading back to Maddy, no hard feelings. But the door’s always open if you want to give Stalwart another shot down the road.

[0]: https://stalw.art/docs/development/compile [1]: https://stalw.art/compare/#faq [2]: https://nlnet.nl/project/Stalwart/ [3]: https://nlnet.nl/project/Stalwart-Collaboration/

[rossy]

As I understand, the AGPLv3 requires the corresponding source code to be provided under the same license, so the Arch guys wanting an AGPLv3 source package isn't just a niche Arch-specific concern or a "packaging issue," but a licensing requirement that can't be ignored or delayed.

> All you need to do is omit the Enterprise feature flag during compilation, and what you get is a 100% AGPL-3.0 build.

Maybe I'm misunderstanding, but my interpretation of this issue[1] is that Stalwart contains AGPLv3 licensed functions that call into the SEL licensed `has_tenant_access` function, among others, and that the affected functions are not conditionally compiled out of the AGPLv3 binaries. @afontenot says on that issue that they don't believe it's "possible to use Stalwart under the AGPL at present." Are they wrong and can that issue be closed?

I am also concerned about the webadmin. A free software program that downloads proprietary code on first start isn't free software in practice, and since there aren't two separate SEL and AGPLv3 licensed builds of the webadmin on GitHub, that must be the case.

> So while the optics of this situation may look rough from the outside, I promise it’s not some “open source in name only” kind of thing. It’s just one of those painful balance acts between building features, maintaining packages, and paying the bills.

I get it, but it's disappointing that AGPLv3 compliance is so low in the list of priorities that this licensing issue has been known about but not solved in 8 months, all while receiving grants intended for free software projects. That balancing act must have included the consideration that the free software community is regularly burnt by rug-pulls (Redis) and trust isn't easily won back once its lost.

> And hey, if you're heading back to Maddy, no hard feelings. But the door’s always open if you want to give Stalwart another shot down the road.

I might. Sorry if I've been harsh, but it's only because Stalwart is a very cool project. A FOSS all-in-one mail server written in a safe language is exactly what email needs, and since learning about it, I've been worried that it's too good to be true. Please don't let it be. I don't think it will gain the momentum to replace Postfix if it can't be packaged in Linux distros due to licensing issues.

[1]: https://github.com/stalwartlabs/stalwart/issues/783