To be covered, open source dependencies must meet these criteria:
- They must be reported to us via the Tidelift tools (so we know what coverage to provide)
- They must be in one of the currently-covered ecosystems
- You must be using a standard version of the package (not a fork or other modification)
For all covered open source dependencies, we offer basic support which includes:
- Notification and resolution of known security vulnerabilities impacting the packages you have reported to us.
- On request, correction of missing machine-readable licensing information.
- We provide suggestions about outdated dependencies.
- We provide suggestions about unmaintained dependencies.
- We provide suggestions about deprecated dependencies.
Lifted dependencies have additional assurances:
We have commercial relationships with many independent open source maintainers. When we have such a relationship, we call the package provided by those maintainers a lifted package. Lifted packages have the following additional assurances:
Maintenance
- We ensure the package is actively maintained.
- We provide a centralized feed of release notes for each new release of the package.
- We inform you which release streams are actively maintained (meaning that critical fixes will be backported) and provide suggestions to avoid inactive streams.
- We annotate releases which are known to have critical bugs and provide suggestions to avoid them.
- On request, we will communicate roadmap input or other feedback to the upstream maintainers and let them know that the input comes from paying subscribers.
Security
- The package will follow coordinated disclosure best practices, including having a confidential security reporting address.
- Participating maintainers will use two-factor authentication, where available, to reduce the risk of trojan horse attacks.
Licensing
- Participating maintainers verify all licensing metadata.
- Should a subscriber violate an open source license, participating maintainers agree to work with the subscriber to resolve the problem prior to filing a lawsuit. This approach is based on the GPL Cooperation Commitment.
- Participating maintainers certify the authorship of code they write. This approach is based on the Developer Certificate of Origin.
As part of your subscription, we also work to add more of the specific packages you use to the lifted list over time.
IP Indemnification
Tidelift indemnifies customers against claims that lifted packages contain copyright violations, such as copied code or an open source license violation.
Tidelift may respond to such a claim by (i) replacing the infringing portion of the software, (ii) modifying the software so that its use becomes non-infringing, (iii) obtaining the rights necessary for a customer to continue its use of the software without interruption or (iv) defending the customer (that is, hire and pay for a lawyer) against the claim and paying any resulting damages (up to a certain cap).
Indemnities are capped based on an organization’s specific needs and subscription level.
Support for open source dependencies does NOT include:
- Issue resolution or feature development
- Control over project technical roadmaps
- Training or advice
- Creation of custom forked or patched versions of packages
