Wait three years

Before the move, some of the tools Golem Trust leaned on hardest had changed their licences once already, in the two years before the firm adopted them. HashiCorp Vault held the secrets, Teleport the access, Graylog the logs, and each is an open core held by a US company, Vault under the Business Source Licence since August 2023 and Graylog under the SSPL since 2022.

Cheery Littlebottom’s risk register already carried the line, “single-vendor dependency on US-incorporated open core software with proprietary licensing options”, and Ludmilla’s rule sat under it: if the company is American and the software is successful, wait three years and it will change the licence. The scraps for this layer say: a tool from a US firm keeps its licence right up until the quarter it does not, and the next quarter is not on the roadmap.

The line in the risk register

The pattern is not hypothetical, and two of the three had already done it once: a widely used tool relicensed from an open licence to a source-available one, the community left to fork or pay, the migration priced in the leaver’s own time. The three tools were ranked not by how good they are, which is not in question, but by how much it would cost to leave on the quarter the licence changed. The list, the ranking and the European replacements are held in Golem Trust’s own alternative-tools notes.

The swaps

Vault’s replacement is OpenBao, a fork of Vault run as a project of the Linux Foundation’s Open Source Security Foundation under open governance and an OSI-approved licence, which is the same software without the company that can relicense it. Teleport and Graylog have their community and European equivalents mapped the same way in the alternative-tools notes, each chosen so that the day the licence changes is a day it has already rehearsed rather than a day it discovers it has a problem. None is switched overnight. Each is piloted beside the tool it replaces, so the swap is a decision already made when it is needed.

Not every American thing goes

The test is licence capture, not nationality. Keycloak’s project home is a US foundation and it stays, because a foundation-governed project under a stable open licence is a different animal from a company’s open core with a proprietary tier and a shareholder. That is the same judgement Purple Lantern made about Sphinx and PyPI: what settles it is whether an American company can, on a Tuesday, decide Golem Trust no longer has the tool.

The quarter is scheduled

   held by a US company's licence            its own, or a foundation's

   HashiCorp Vault ───────────────────────►  OpenBao (OpenSSF / Linux Foundation)
   Teleport, Graylog ─────────────────────►  community / EU swaps, piloted in advance
   Keycloak (US foundation, stable licence)   kept: governance, not a company, holds it

Each captured tool ranked by the cost of leaving it, a replacement identified and piloted before the licence turns, the swaps that are foundation-governed and open kept whatever their flag, and the risk written down as a schedule Golem Trust controls.

What could go wrong?

  • A vendor relicenses on a quarter’s notice, and Golem Trust moves to the pilot it already stood up.

  • A pilot is never stood up, only listed, and the day the licence turns the notes describe a plan nobody has run.

  • A community fork loses momentum, and Golem Trust is depending on a project thinner than the one it left.

Nanny Ogg will lend a neighbour anything in her kitchen except the good knife, holding that a tool a body truly depends on is one nobody is entitled to ask back.