Wait three years

Before the move, some of the tools Golem Trust leaned on hardest were open source from companies that could stop it being so. HashiCorp Vault held the secrets, Teleport the access, Graylog the logs, and each is an open core with a proprietary licence option held by a US company. Cheery Littlebottom’s risk register already carried the line, “single-vendor dependency on US-incorporated open core software with proprietary licensing options”, and Ludmilla’s rule sat under it: if the company is American and the software is successful, wait three years and it will change the licence. The scraps for this layer say: an open-source tool from a US firm is open right up until the quarter it is not, and the quarter is not on the roadmap.

The line in the risk register

The pattern is not hypothetical, and Golem Trust had watched it happen to others: a widely used tool relicensed from an open licence to a source-available one, the community left to fork or pay, the migration priced in the leaver’s own time. The three tools were ranked not by how good they are, which is not in question, but by how much it would cost to leave on the quarter the licence changed. The list, the ranking and the European replacements are held in Golem Trust’s own alternative-tools notes.

The swaps

Vault’s replacement is OpenBao, a fork of Vault run as a project of the Linux Foundation’s Open Source Security Foundation under open governance and an OSI-approved licence, which is the same software without the company that can relicense it. Teleport and Graylog have their community and European equivalents mapped the same way in the alternative-tools notes, each chosen so that the day the licence changes is a day it has already rehearsed rather than a day it discovers it has a problem. None is switched overnight. Each is piloted beside the tool it replaces, so the swap is a decision already made when it is needed.

Not every American thing goes

The test is licence capture, not nationality. Keycloak’s project home is a US foundation and it stays, because a foundation-governed project under a stable open licence is a different animal from a company’s open core with a proprietary tier and a shareholder. That is the same judgement Purple Lantern made about Sphinx and PyPI: what settles it is whether an American company can, on a Tuesday, decide Golem Trust no longer has the tool.

The shelf

   held by a US company's licence            its own, or a foundation's

   HashiCorp Vault ───────────────────────►  OpenBao (OpenSSF / Linux Foundation)
   Teleport, Graylog ─────────────────────►  community / EU swaps, piloted in advance
   Keycloak (US foundation, stable licence)   kept: governance, not a company, holds it

Each captured tool ranked by the cost of leaving it, a replacement identified and piloted before the licence turns rather than after, the swaps that are foundation-governed and open kept whatever their flag, and the whole risk written down as a schedule it controls instead of a surprise a vendor delivers.

What could go wrong?

  • A vendor relicenses on a quarter’s notice, and it moves to the pilot it already stood up, rather than starting the migration from a cold beginning.

  • A pilot is never actually stood up, only listed, and the day the licence turns the notes describe a plan nobody has run.

  • A community fork loses momentum, and it is depending on a project thinner than the one it left, which the ranking is meant to keep an eye on.

Nanny Ogg will lend a neighbour anything in her kitchen except the good knife, holding that a tool a body truly depends on is one nobody is entitled to ask back.