Why Termphin is open source
Termphin is now open source under the GPL. Why an SSH client should be, why that license, what it does not cover, and what it costs.
I build Termphin, an SSH client, on my own. An SSH client holds your private keys and passwords and opens a shell on your servers. That is a lot of trust to ask for.
Until now, two parts were already open source: the small helper the app uploads to your server, and the terminal renderer the app draws with. The app itself, the part that holds the keys, was not.
As of today the whole app is open source, under the GNU General Public License, version 3 or later. The source is on GitHub.
The main reason is trust. “Trust me” is not enough for a program that holds the keys to your machines. Now you do not have to take my word for how the keys are stored or where the data goes. You can read it.
What you can check
You can read every line: how keys and passwords are stored, how host keys are checked, what the optional analytics send. You can build the app yourself from the source.
Every release on GitHub is built by GitHub’s own CI from a tagged commit. The release is created as a draft and only published once every build has passed.
Each file in a release comes with a SHA-256 checksum and a build provenance attestation, which proves it was built from that tag by that repository. You can verify it with one command:
gh attestation verify termphin-<version>.apk -R Termphin/TermphinThe installable package on GitHub is signed with a different key than the store build. One does not update the other, so you uninstall one before switching to the other. Release signing keys are not in the repository.
Why the GPL
I picked the GPL rather than a permissive license like MIT or Apache on purpose.
Under a permissive license anyone could take the code, close it, and sell it as their own app. Under the GPL, anyone who ships a changed version has to ship its source under the same license. Every change stays open.
Contributions come in under the same license. There is nothing to sign.
What the license does not cover
The GPL covers the code. It does not cover the name “Termphin” or its logo and icon. A separate trademark policy covers those.
Anyone can fork the code, change it and ship it. A fork that is distributed needs its own name and its own icon, and must not look like the original. The reason: when somebody installs “Termphin”, they should get the build I made, not somebody else’s build that only looks like it. For an app that holds keys and passwords, a lookalike is a real risk.
Building it yourself for your own devices, with or without changes, needs no permission. Packaging the unmodified source for a community repository or a distribution is usually welcome too. Ask first.
Some stores have terms that are widely considered to conflict with the GPL. An extra permission in the license lets the app and its forks ship through such stores, as long as everything else in the GPL is followed, including offering the full source.
Help from other people
The second reason is help. Until now people could only report bugs. Now they can also send the fix.
The issue tracker on GitHub takes bug reports and ideas. A pull request is kept to one topic, and anything larger than a small fix starts as an issue first. The automated checks (analysis and tests) must pass before it can merge. A bug fix comes with a test that fails without it.
A security problem is not reported in a public issue. It goes privately, through GitHub’s private vulnerability reporting or by email.
Dependency updates are proposed automatically; major version updates are left to a person.
What it costs
Every shortcut and every mistake in the code is now public. Code written by one person for one person reads that way. I accepted that, because hidden code is not safer, only harder to check.
Anyone can now take the code and publish a copy. The GPL keeps that copy open, and the trademark policy keeps it from using the name and icon. A clone that copies the look can still appear in a store, and the only answer to that is reporting it. If you find a lookalike, tell me.
The app is now something you can check rather than something you have to trust.