Chocolatey Licensed v3 Changes Require Nodes To Be Properly Licensed

By Chocolatey Team|Posted Thursday, September 9, 2021

Summary

We are about to release a major update to the Chocolatey Licensed Extension that includes a number of bug fixes, some features like Intune Integration, and an important change for clarity around licensing.

One thing we've heard from organizations over the last few years is that there is some confusion regarding licensing - "What counts as a license?", "How many licenses do I need?", etc. This point can be especially confusing when it comes to features such as Package Builder and Package Internalizer, as the packages are built/internalized on one machine and then deployed to many machines. We want to clarify licensing to reduce confusion and ensure folks have the correct license counts. In short - everywhere those packages go, those machines count in licensing.

At Chocolatey Software, we've provided Chocolatey Central Management to help organizations using Chocolatey for Business (C4B) get better metrics on licensing counts, but we've found that organizations can still get into trouble when employees install things without consideration for the number of licenses available in your inventory. The additional features in this release move to make it clearer on the number of Chocolatey licenses an organization is using. This ensures your organization has accurate license counts when it comes to licensing audits and helps you avoid costly fines and sanctions for being out of compliance.

What Are We Doing?

Packages built/internalized with commercial features in Chocolatey Licensed Extension v3 and later will ensure that the endpoints/nodes are licensed by adding checks to the packaging itself. Most organizations are already properly licensed on all endpoints, and will just need to upgrade clients to the newest version. There are no changes to the licensing agreements, and we don’t expect this to have any significant impact for most of our customers.

We do recognize that English is not everyone's first language, so it is possible that there may be a few organizations that are impacted by this change, and that is to be expected. It's better to find out you are out of compliance by an internally deployed tool such as Chocolatey Central Management, versus an external organization such as FAST (Federation Against Software Theft) or The Software Alliance (BSA).

Why Are We Making These Changes?

In doing this, the benefits for organizations are that the licensing is much clearer, so it can reduce costly fines that can come when software out of compliance:

We are removing confusion surrounding the use of packages that are built/internalized with commercial features (Package Builder/Package Internalizer).
We are ensuring that all endpoints are licensed so that our support team is providing the best possible service to our end users.
We are protecting organizations from costly licensing mishaps that can occur when licensing is misunderstood.
We are protecting organizations from employees who install what looks available without consideration for software inventory counts.

When Will These Changes Be Effective?

This will be effective in Chocolatey Licensed Extension v3.0.0 (chocolatey.extension package). Once you start building/internalizing packages with this version, you'll need to update your clients to at least version 3 (3.0.0) as older licensed versions will not be compatible with packaging changes coming in v3.

FAQs

Will I need to update all of my clients when I upgrade to v3.0.0 of the Chocolatey Licensed Extension?

Yes, as the checks that have been added will require that. You'll see a warning and error message on any clients you forget to upgrade. When you see that message, you'll just need to upgrade the clients and then the package installations will work nicely again.

I have clients that are using unlicensed editions of Chocolatey, do I really need to have those endpoints licensed?

Yes, you've always needed to have those endpoints properly licensed as part of the licensing agreements, although the software hasn't really enforced that for you. This is simply a change to help ensure that endpoints do get licensed.

I don't like the extra time it takes to get an endpoint licensed.

There are two extra steps - add the license (can be done through a package) and install the Chocolatey Licensed Extension package. It adds up to about 20-30 seconds of extra time to your provisioning. The steps are located at Licensed Extension Setup, and there are some quick scripts to get this setup quickly. Reach out to support if you need help with this aspect - our team will be happy to assist you in enhancing your scripts to work with licensed endpoints.

I have the Chocolatey For Business (C4B) edition of Chocolatey. Do these changes affect it?

Yes, Chocolatey for Business (C4B) edition requires endpoints/nodes to be licensed. This edition is for organizations, and where the features of Package Builder and Package Internalizer are most used.

I have the Architect edition of Chocolatey. Do these changes affect it?

No. Chocolatey Architect edition is targeted at building packages for your customers and their pipelines, but not managing the endpoints/nodes themselves. In that type of licensing scenario, the endpoints are not required to be licensed, so these changes will not apply to that edition of Chocolatey.

I have the MSP edition of Chocolatey. Do these changes affect it?

Yes, the MSP edition requires endpoints/nodes to be licensed, just as Chocolatey for Business (C4B) does.

I have the Professional edition of Chocolatey. Do these changes affect it?

No. Chocolatey Professional does not include Package Builder (the full generation of packages) or Package Internalizer, so these changes will not affect that edition. Chocolatey Professional is targeted at end users/consumers that are managing their own machines and just want better features to work within the community offerings.

I have ephemeral environments, this sounds like extra work for a machine that might be up for just a few minutes.

I have other questions or concerns related to these changes.

Please reach out to your representative or contact us (choose "Other") if you have any questions or concerns that we were unable to address here.