Fork Around and Find Out: How Open Source Beats the Rug-Pull of source-available licenses!

It has become kind of a ritual now. A company builds a beloved open source project, then gets popular, then swaps its open license for a "source-available" one, to box out competitors. Users call it a rug-pull. This lightning talk is a quick narrative journey through what follows, because the community has a strong habit of winning.

When HashiCorp relicensed Terraform, the Linux Foundation made OpenTofu, which is now a CNCF project. When Redis went SSPL, the community shipped Valkey; Debian, Ubuntu, Fedora, and AWS adopted it, and by May 2025 Redis surrendered and returned to open source under AGPL. Elasticsearch and Vault tell the same story (OpenSearch, OpenBao). The ultimate example? Git itself, written by Linus in ten days after the proprietary bitkeeper revoked the Linux kernel's license in 2005.

We'll cover why companies do this, why CLAs make it legal, what makes a fork succeed rather than fail, and the one lesson that keeps repeating: you can't pull the rug out from under a community that can fork you :)

1. An explanation of the term "rug-pull", along with differences between “source-available” licences and genuine open-source licenses.

2. Why Contributor License Agreements (CLAs) serve as the legal backbone of virtually all rug-pulls.

3. What makes a fork actually win, explaining a mix of neutral foundations, distro adoption, and governance; using OpenTofu and Valkey as case studies.

4. How to assess the rug-pull risk of any dependency you rely on: who owns it, is there a CLA, is it under a foundation.