A week ago, developers were concerned about Bitwarden’s apparent shift towards open source. The password manager indeed offers almost all of the code of its components in GPLv3 or AGPLv3.
A developer discovered that the Bitwarden client had introduced a dependency on an internal SDK. Not only did you have to have it on hand to compile the client, but the license for this development kit prohibited any use for any project other than building the official client. Many then saw this as a clear limit to the creation of third-party clients, even though this is precisely one of Bitwarden’s strengths.
Kyle Spearrin, founder and technical director of Bitwarden, took the floor to explain in particular that it was a question of establishing clarification on what was under GPL and what was not.
In a new message, however, he wishes to clarify the situation again. “ We’ve made some adjustments to how the SDK code is organized and packaged to allow you to build and run the application with only the GPL/OSI licenses included. References to the sdk-internal package in clients now come from a new sdk-internal repository, which follows the licensing model we have historically used for all of our clients », he begins by explaining.
Above all, he adds: “ The sdk-internal reference currently only uses GPL licenses. If the reference were to include the Bitwarden license code in the future, we would provide a way to produce multiple client build variations, similar to what we do with Vault web client builds ».
He specifies that the original SDK repository will be renamed sdk-secrets and that it “ will retain its existing Bitwarden SDK licensing structure » for Secrets Manager commercial products. “ The sdk-secret repository and packages will no longer be referenced from client applications, since this code is not used there “, finished explaining Kyle Spearrin. In other words, it was a bug.
