The license tells you what you may do with the code. The support contract tells you what you will pay to keep it running. Those are different documents with different authors, different incentives, and very different amounts of money attached. Reading one and assuming it covers the other is how enterprises end up surprised at renewal.

The License Is Not the Contract

A permissive license such as Apache 2.0 or MIT grants rights: use, modify, redistribute. It does not grant revenue, and it does not obligate anyone to answer a support ticket. That distinction matters because the license is written by maintainers or a foundation, while the contract is written by a vendor's legal team with a procurement department across the table.

Cloud terms govern a separate set of things: uptime commitments, indemnity, escalation paths, and the price of a named support engineer. None of that appears in the license text. A buyer who reviews only the license has reviewed the part of the arrangement that costs nothing and promises nothing.

Maintainers often sign contributor agreements and corporate CLAs without mapping what leverage they are giving up. The code goes upstream, the vendor builds a managed service around it, and the maintainer's name appears in a release note. The bargaining position was surrendered at the point of contribution, quietly, in a document nobody priced.

There is a second asymmetry buried in the paperwork. Licenses are public and get read by thousands of people; contracts are private and get read by two legal teams. That means the license accumulates commentary, tooling, and institutional memory while the contract accumulates nothing. A buyer inheriting a renewal has no public record of what the previous buyer negotiated, which is precisely why vendors can hold a line on price across a whole market segment without anyone noticing the pattern.

Where Maintenance Money Actually Lands

Support contracts are usually priced per seat, per cluster, or per node, and they scale with the customer's footprint rather than the maintainer's hours. That is the structural gap. A vendor selling a managed database can charge by the vCPU while the person fixing the replication bug works from a sponsorship page.

Sponsorship tiers rarely cover a full-time maintainer. GitHub Sponsors and comparable programs have made small recurring payments easier, but the amounts tend to land in the low hundreds to low thousands of dollars a month for all but a handful of projects. A single senior engineer's fully loaded cost is a multiple of that.

Foundation grants skew toward events, travel, and community programs, which are legible and photograph well. Payroll is harder to fund and harder to justify to a board. The result is that maintenance labor, the thing that keeps the dependency graph from rotting, is the least reliably financed line item in the stack. This site has argued elsewhere that patch debt sits with vendors while budgets flow to detection, and the same asymmetry shows up here.

The scale question is worth being concrete about. A popular library can sit inside thousands of commercial products and still have one or two people with commit rights and a day job elsewhere. When those people change jobs, the project does not announce a transition; it just goes quiet, and the quiet is only visible to the handful of engineers who file issues into that repository and watch the response times drift from days to weeks to nothing.

Copyleft as a Pricing Signal

Copyleft licenses such as AGPL, and source-available licenses such as SSPL, do not usually produce lawsuits. They produce negotiations. When a hosted resale model collides with a copyleft obligation, the practical outcome is a commercial license discussion, and the license change becomes a pricing event rather than a legal one.

Buyers treat copyleft as a discount lever. Procurement teams know that a vendor offering an AGPL core has a commercial edition behind it, and they ask for the terms that separate the two. Legal review cycles stretch by weeks when the license text and the SLA terms have to be reconciled, and those weeks have a cost in delayed deployment.

The real risk on a license change is fork risk, not litigation. When a project relicenses, the credible threat is that a well-funded competitor forks the last permissive commit and sells support against it. That threat is what brings the vendor back to the table, and it is why the fork cost belongs in any renewal model.

Fork risk is also easy to overstate. A fork preserves the code but not the community, the documentation, the integrations, or the trust that downstream projects extend to a package name. Most forks that get announced never reach parity, and the ones that do usually had a large commercial sponsor behind them from the first commit. Buyers should price the fork option as a genuine fallback while recognising that it is a slow, expensive fallback that only works when someone is already paying the engineers.

The Indemnity Gap in Cloud Contracts

Vendors routinely indemnify customers for intellectual property claims on code they did not write. That is a real liability transfer, and it is priced somewhere. Upstream contributors carry no warranty obligation at all, which is exactly what the license says and exactly what the buyer does not want to hear.

Enterprise buyers price that asymmetry into renewals. A procurement lead comparing a managed offering against a self-supported deployment is not comparing feature lists; they are comparing who absorbs the cost if a claim lands. Insurance brokers now underwrite open-source exposure as a distinct line, which tells you the market has decided the risk is real and quantifiable.

The objection worth stating plainly: indemnity is not free, and a vendor that offers broad coverage charges for it in the subscription. A buyer who negotiates the indemnity down may find the headline price drops while the residual risk moves onto their own balance sheet. Cheaper is not the same as safer.

Read the carve-outs before you read the headline. Most indemnity language excludes modifications the customer made, combinations with other software, and use outside the documented scope, which in practice covers a large share of real deployments. The coverage is real, but it is narrower than the summary slide suggests, and the gap between the summary and the clause is where disputes get settled.

Reading the Contract Before the License

Start by mapping which legal entity signs the support paper. It is frequently a subsidiary, and the entity that holds the open-source project's trademark may be a different one entirely. If the signing entity is not the one with the engineering team, escalation paths get long.

Check whether upstream is named in the contract or absorbed into the vendor's offering. Named upstream means the buyer can trace funding and influence direction. Absorbed upstream means the dependency is invisible until the maintainer leaves, and then it is a supply-chain incident.

Model renewal cost against fork cost before the first renewal, not after. A fork is expensive, slow, and culturally painful, but it is a real option with a real price, and knowing that price changes the negotiation. A related piece on long-lived build systems makes the same point about code that outlasts the team that wrote it.

Watch the renewal clock as well. Multi-year terms with auto-renewal and notice windows measured in months are standard, and the notice window is where leverage quietly expires. A team that starts negotiating thirty days before expiry is negotiating against a contract that has already renewed itself.

Four Moves for Buyers and Maintainers

Buyers should demand upstream funding disclosure as a contract term, asking the vendor to state what share of subscription revenue reaches the maintainers of the components in the bill of materials. A vendor that cannot answer has told you something useful.

Maintainers should publish a support price list with named tiers and response times, so that a commercial user has a number to approve rather than a donation link to feel vaguely guilty about. The absence of a price is not neutrality; it is a subsidy to the vendor.

Legal teams should reconcile license text with SLA terms in one review, flagging any clause where the vendor warrants behavior the upstream license disclaims. Those contradictions surface at the worst possible moment, usually during an incident.

Foundations should tie grants to maintenance hours rather than project prestige, with reporting that names the people paid and the work completed. The economics of inference bills overtaking training spend show how quickly operating costs dominate; maintenance is the open-source version of that same curve, and it is funded last.