There are approved-by-Arduino closed source Libraries in the Arduino Library manager, we recently saw the following library added – MCHPTouch Library for Arduino, and did not know how this worked.
We asked Arduino to clarify if this was part of any policy that only applies to Arduino, or if it applies to all developers who contribute to the Arduino library ecosystem. Currently there is nothing in the Arduino Library Manager FAQ as of June 27, 2021, about closed source libraries being OK or not.
We emailed Arduino and posted on the Arduino developer list about new closed source libraries. We asked if this was accidental, or if there is a Arduino IDE/library policy about closed source binaries in libraries, OR if the source code for the MCHPtouch binary blob is available.
Alessandro Ranellucci, Head of Maker Business, Open Source & Community got back to us (thanks!), here are the answers posted with permission, verbatim:
Adafruit: Are closed source Libraries allowed in the Arduino library manager?
Closed-source libraries are allowed in the Arduino library manager, as long as their license allows unrestricted redistribution and they do not violate third party intellectual property.
In fact, the library manager rules which determine whether a library is indexed or not do not include (and never included) limitations related to source code availability. This is the same license-agnostic approach adopted by most open-source package registries, which gives users the freedom to choose libraries freely according to their requirements and values.
Since 2017, a “precompiled” flag was added to the library.properties file to ease this.
Adafruit: Specifically, it is OK to include pre-complied binaries / blobs, that there is no source code available?
It is technically okay, but it should be done carefully. As Arduino we are strong advocates of open source and we discourage non-free licenses, because we believe in knowledge sharing and open collaboration. Openness also guarantees more security to users because they can inspect the source code that will run on their boards.
There are probably only two possible circumstances where a closed source library might make sense: when it is released by a chip vendor (which already controls the underlying -closed- hardware stack anyway), and when it is released by someone who has a high degree of trust in the community and provides a lot of added value. Note that we still prefer open source alternatives, but we all know that for many complex things we don’t have valid free alternatives and even on a Linux machine you may need to install proprietary software for specific needs. Considering that Arduino library submissions are increasing at an incredibly fast pace, and also considering that we now have a fully-automated and transparent submission process, it could be interesting to start a discussion with the community about technical or legal measures that we could introduce to restrict the cases when we allow closed source libraries with the goal of keeping the library ecosystem open and secure.
Adafruit: Are there any other official Arduino closed-source / pre-complied binaries / blobs?
Libraries with precompiled binaries can be easily found by looking for “precompiled=true” or “precompiled=full” in the official Arduino GitHub organizations (1, 2, 3). In most cases the source code is also available.
The library we are referring for this inquiry is the MCHPTouch library by Microchip and does not have the source code.
This library is a wrapper around the MCHPTouch library by Microchip, which is bundled in binary form in this distribution in agreement with Microchip.
Microchip Technology Inc., provides the Microchip Touch Library software subject to the license terms contained at the link below. By using the Microchip Touch Library, you acknowledge and agree to the terms of the license contained at the link below. Microchip Touch Library License Agreement
The Arduino_MCHPTouch wrapper library is distributed under the terms of the MPL-2.0 license.