Outside counsel was asked, publicly

The Question That Could Not Be Fenced

By the mid-2000s, the Joomla extension ecosystem had grown large enough to have commercial interests worth protecting. Developers were selling extensions — some open-source, some encoded with tools like ionCube or Zend Guard, some simply distributed as closed binaries. The question underneath all of it was one the project could not avoid indefinitely: did the GNU General Public License, which governed Joomla's core code, require that extensions also be GPL?

The answer mattered commercially. If extensions were derivative works under the GPL, then selling a closed extension was not merely frowned upon — it was, in the project's reading, a licence violation. If they were not, the extension market could continue as a mixed economy, with proprietary code sitting alongside open-source contributions.

This is the kind of question that organisations frequently settle internally, by policy statement, with legal review that never leaves the board room. Joomla did not do that.

The SFLC Opinion

The project formally engaged the Software Freedom Law Center ↗, the New York-based non-profit legal organisation founded in 2005 to provide pro-bono counsel to free software projects. The SFLC's brief was to assess whether Joomla extensions constituted derivative works of the Joomla core under the GPL — and the result of that assessment was published.

The SFLC's position, as released, was that PHP applications which call Joomla's core functions and run within the same process are derivative works, and therefore must be distributed under the GPL. The argument rested on established software copyright doctrine: a program that links to, or substantially interposes itself into, a GPL-covered codebase cannot simply declare independence from that licence. The SFLC was not inventing a novel theory — it was applying the same reasoning that had been applied to Linux kernel modules and to other GPL-covered platforms elsewhere.

What made this notable was not the conclusion. Similar positions had been articulated by the Free Software Foundation ↗ on GPL compliance questions for years. What was notable was the procedure: an identifiable outside body, with public credibility, was asked a direct question, gave a direct answer, and both the question and the answer were placed where anyone in the ecosystem could read them. Developers who disagreed with the outcome could disagree with a published document, not with a rumour about what someone on the leadership team believed.

What It Settled, and What It Did Not

The opinion gave Open Source Matters — the non-profit incorporated in 2005 to hold Joomla's assets and trademark — a documented basis for its GPL enforcement position. Extensions listed in the Joomla Extensions Directory were expected to comply. The directory's listing rules became, in effect, a soft enforcement mechanism: non-compliant extensions could be delisted, which mattered because the directory was the principal discovery channel for the ecosystem.

In practice, the commercial extension market continued to include vendors whose compliance was incomplete or disputed. Encoding tools did not vanish overnight. But the terms of the argument had been fixed in public, which changed what vendors could claim in good faith. A developer distributing encoded, closed Joomla extensions after the SFLC opinion was not operating in a legal grey zone they could claim ignorance of — the zone had been surveyed and the survey published.

The episode is a useful governance case study precisely because it is not dramatic. No court case followed. No major vendor was sued. The opinion functioned the way a well-drafted policy ought to: it reduced the space for strategic ambiguity, made the project's position legible to outsiders, and provided a stable reference point that subsequent decisions could cite. Whether a given extension complied was still a judgment call. What was no longer a judgment call was what compliance meant.