GNU Ethical Repository Criteria

We developed these criteria to judge services for hosting parts of the GNU operating system, but we recommend them to everyone that wants to use a service for publicly hosting free source code (and optionally executable programs too). The criteria emphasize protection of privacy, functionality without nonfree JavaScript, compatibility with copyleft licensing and philosophy, and not rejecting any users.

See the Free Software Foundation's 2015 press release to learn more about the criteria and the rationale behind them. Completed evaluations of major code-hosting sites are coming soon. If you have questions or suggestions, email repo-criteria-discuss@gnu.org. You can also review the list's public archive.

Version 1.0

F — Unacceptable

C — Acceptable hosting for a GNU package

All important site functionality that’s enabled for use with that package works correctly (though it need not look as nice) in free browsers, including IceCat, without running any nonfree software sent by the site. (C0)
- Regarding sending code that runs on the JavaScript platform, any such code used by an important site function either (1) is free software, and labeled properly for LibreJS to recognize as free, or (2) isn’t necessary, so that the function works properly even if JavaScript is disabled in the browser.
  
  See The JavaScript Trap for more explanation.
  
  Note that free software must come with the real source code. Minified JavaScript code, and code generated by translation from some other language, are not source code. They are a kind of object code. (C0.0)
- Regarding sending code that executes based on a platform other than JavaScript, those conditions apply, mutatis mutandis. In addition, a free implementation of that platform, and a free program to check for free licensing (comparable to LibreJS for JavaScript), must be available for the principal GNU browser IceCat, and the site must work adequately with them.
  
  Using JavaScript code to interpret some other language counts as using the JavaScript platform. Translating another language into JavaScript code and sending that JavaScript code also constitutes use of the JavaScript platform. In the former case, free JavaScript-platform code means that the interpreter and the programs it interprets are free software. In the latter case, free JavaScript-platform code means that the code people maintain, which is input to the translator, is free software; we also require that a free translator exist which is adequate for the translation job. (C0.1)
No other nonfree software is required to use the site (thus, no Flash). (C1)
Does not discriminate against classes of users, or against any country. (C2)
Permits access via Tor (we consider this an important site function). (C3)
The site's terms of service contain no odious conditions. (C4)
Recommends and encourages GPL 3-or-later licensing at least as much as any other kind of licensing. (C5)
Support HTTPS properly and securely, including the site's certificates. (C6)

B — Good enough to recommend

The above criteria, plus:

All code sent to the user’s browser must be free software and labeled for LibreJS or other suitable free automatic license analyzer, regardless of whether the site functions when the user disables this code. (B0)
Does not report visitors to other organizations; in particular, no tracking tags in the pages. This means the site must avoid most advertising networks. (B1)
Does not encourage bad licensing practices (no license, unclear licensing, GPL N only). (B2)
Does not recommend nonfree licenses for works of practical use. (B3)

A — Excellent

The above criteria, plus:

All important site functions work correctly (though may not look as nice) when the user disables execution of JavaScript and other code sent by the site. (A0)
Server code released as free software. (A1)
Encourages use of GPL 3-or-later as preferred option. (A2)
Offers use of AGPL 3-or-later as an option. (A3)
Does not permit nonfree licenses (or lack of license) for works for practical use. (A4)
Does not recommend services that are SaaSS. (A5)
Says “free software,” not “open source.” (A6)
Clearly endorses the Free Software Movement's ideas of freedom. (A7)
Avoids saying “Linux” without “GNU” when referring to GNU/Linux. (A8)

A+ — Extra credit

The above criteria, plus:

Allows visitors to look and download without authenticating. (A+0)
Does not log anything about visitors. (A+1)
Follows the criteria in The Electronic Frontier Foundation’s best practices for online service providers. (A+2)
Follows the Web “Content” Accessibility Guidelines 2.0 (WCAG 2.0) standard. (A+3)
Follows the Web Accessibility Initiative — Accessible Rich Internet Applications 1.0 (WAI-ARIA 1.0) standard. (A+4)
All data contributed by the project owner and contributors is exportable in a machine-readable format. (A+5)

Acknowledgements

The following individuals have helped as evaluators or otherwise contributed ideas, suggestions and improvements to this document.

Aaron Wolf
Bruno Félix Rezende Ribeiro <oitofelix@gnu.org>
Josh Triplett
Mike Gerwitz <mtg@gnu.org>
Richard Stallman
Zak Rogoff

If you are interested in helping with the evaluation or have any corrections, please contact repo-criteria-discuss@gnu.org.

If you are interested in helping to make code hosting sites LibreJS compliant (C0.0 and B0 criteria), please contact Mike Gerwitz at <mtg@gnu.org>.