Future versions are no longer open source

[imbev]

Starting with version 2024.10.0, Bitwarden Desktop will not be open source

bitwarden/clients#11611

This will require changes to com.bitwarden.desktop.metainfo.xml

[Eonfge]

I've made a pull request to address this problem:
#220

[ghisvail]

Right now, we have got #218 and #220 queued for merging. I am awaiting an official confirmation of the upstream policy moving forward.

[Eonfge]

Bitwarden has commented on Twitter:
https://x.com/Bitwarden/status/1848135725663076446

Sadly... it seems to be a bit of double speak. The license on the SDK is non-free and has been so since the start:
https://github.com/bitwarden/sdk-internal/blob/main/LICENSE

In the future, they want to fix custom builds. This would mean that users can build desktop client without closed-source code, but for now that dependency has not been resolved: bitwarden/clients#11611 (comment)

For this package, that likely doesn't matter. This package doesn't compile Bitwarden, it takes the official .deb with closed-source components. Even when they resolve the proprietary dependency, this package would never be 'Open Source' again.

My recommendation: Wait a week to see how this issue evolves and unless things drastically change, merge the license change and remove the "100% Open Source" text from the app description.

[quexten]

bitwarden/sdk-internal#10
bitwarden/clients#11611 (comment)

The password manager SDK is now dual licensed.

Note: There is currently one one build of the deb. I'm unsure about timeline/plans to distribute both oss and bit licensed linux desktop packages, but it should be possible to build these from source soon. So for the flatpak to remain GPL, #16 might need to be revived.

[Eonfge]

It's really anything annoying that they pull the rug under users. This package is now at a crossroads where:

• build the OSS version and keep GPL 3
• Wrap the official .deb package and move to Proprietary

Still, in the long run we can expect these versions to divert in functionality. Sooner or later, users of this package will be confused by a lack of features compared to the .deb package.

Thus, it would be best to keep this package based on the .deb and change the licence... While also submitting a com.biwarden.desktop-oss package to Flathub. That way, people can make an informed decision and we're prepared for the future.

[quexten]

It's really anything annoying that they pull the rug under users.

This makes it sound like it's intentional, but it is a legitimate technical constraint. The sdk grew from secrets manager (which never was FOSS, but only source available), and splitting up the build pipelines takes engineering effort. When that has happened I can see if I can submit an upstream PR that makes the deb use the OSS sdk since the desktop does not seem to use any source-available features (secrets manager, access intelligence) anyways.

Building from source would still be preferred though. I've tried to get the old PR up to date, but flatpak tools for node dependencies are seriously bugged, so that will take some more time.

Still, in the long run we can expect these versions to divert in functionality. Sooner or later, users of this package will be confused by a lack of features compared to the .deb package.

So far, only some specific enterprise focused features are licensed under the source-available license (admin management and access intelligence in clients, secrets manager), none of which are even available for the desktop, and there is no reason to expect this to change to license more features only as source-available. I agree though, it would be neat to have both choices in FlatHub if these divert.

[quexten]

I checked internally, and sdk-internal as an npm package is GPL compatible (and listed a such on npm: https://www.npmjs.com/package/@bitwarden/sdk-internal). While sdk-internal does have (some) source-available code in the codebase, this code is not used. If it should be used in the future, this will be under a different package. The code that is used from sdk-internal is GPL licensed, and so is the npm distributed compiled WASM-based package that bitwarden-desktop uses.

2024.10.2 builds against sdk-internal instead of sdk, so there should be no license changes required for this flatpak https://github.com/bitwarden/clients/blob/desktop-v2024.10.2/apps/browser/src/platform/services/sdk/wasm.ts

Since I think this resolves these concerns, I'm closing this issue, but please do feel free to re-open if you do not consider it solved.