The ink was barely dry on Bill Wignall’s December Ode to Open Source in which the CEO sang the praises of Sangoma’s commitment to open source development and extolled the virtues of "reinventing the ways in which we foster relationships with you, our open source community." We’ve now learned that Sangoma is planning to revoke the master key used to sign every FreePBX® module. It will be replaced with a new master key. This affects every developer with an existing GPG key signed by the soon-to-be revoked master key. The practical effect is that every existing FreePBX module will either cease to function or trigger security alerts in the Dashboard of your PBX until every module is updated. In addition, it means every developer will have to apply to have their GPG key resigned with the new master key. We were curious why Sangoma would take such a Draconian step until we read the Module Signature Checking Wiki which was modified by the Sangoma General Counsel yesterday. Here’s the new language that will trigger key revocation from open source developers of FreePBX products:


You have developed and/or are utlizing a module with FreePBX for which you are directly or indirectly generating revenue or commercial advantage and you have not entered into a commercial agreement with Sangoma that protects its commercial interests and its intellectual property

UPDATE: Without addressing whether revocation of the FreePBX Master Key was under consideration, Sangoma now denies any plan to revoke the FreePBX Master Key. See this thread on the FreePBX Forum.

You may recall that AstriCon this year featured zero outside commercial products and organizations. Now it appears Sangoma is taking much the same monopolistic approach on the open source side of the house. And you wonder why Incredible PBX® has always disabled module signature checking.

Fortunately, for those who have deployed Incredible PBX 2020, you have nothing to worry about because every new release of Incredible PBX 2020 utilizes the Clearly IP repository. This assures no interruption in the operation of your PBX.

Before your PBX self-destructs, there’s a simple fix for those using Incredible PBX 13-13 and Incredible PBX 16-15 releases. Although we haven’t tested other distributions, this fix should work fine with all other FreePBX 13 and 15 implementations. Other than rebranding your PBX and changing the destination for module updates, this update makes no other changes to your PBX. Deploying the IncrediblePBX module will also make the Clearly IP Trunking and Phones modules available in the new repository. We’ll be covering these in detail in coming weeks. For those updating a non-Incredible PBX platform, remember to make a backup before proceeding. If you experience problems, post a comment and we’ll get you a quick fix.

Here’s how to download and install the new IncrediblePBX module which will enable the Clearly IP repository on any FreePBX 13 or 15-based server:

cd /var/www/html/admin/modules
wget http://incrediblepbx.com/incrediblepbx-13.03.tgz
tar zxvf incrediblepbx-13.03.tgz
rm -f incrediblepbx-13.03.tgz
fwconsole ma install incrediblepbx
fwconsole reload
fwconsole restart

If you also wish to add support for the new Incredible PBX IP phones including plug-and-play endpoint management and configuration, here’s how. If your system still uses FreePBX 13, be advised that phone apps such as follow-me are not supported because of system limitations on the FreePBX 13 platform.

cd /var/www/html/admin/modules
wget http://incrediblepbx.com/clearlydevices.tgz
tar zxvf clearlydevices.tgz
rm -f clearlydevices.tgz
fwconsole ma install clearlydevices
fwconsole reload
fwconsole restart

These latest developments suggest that perhaps the time has come for a new steward for the FreePBX GPL modules, an organization that actually respects the interests of the open source development community. Stay tuned.

Sangoma Blinks: Here is a belated response from the FreePBX developers.

Originally published: Wednesday, January 22, 2020



Need help with Asterisk? Visit the PBX in a Flash Forum.


 

Special Thanks to Our Generous Sponsors


FULL DISCLOSURE: ClearlyIP, Skyetel, Vitelity, DigitalOcean, Vultr, Digium, 3CX, Sangoma, TelecomsXchange and VitalPBX have provided financial support to Nerd Vittles and our open source projects through advertising, referral revenue, and/or merchandise. As an Amazon Associate, we also earn from qualifying purchases. We’ve chosen these providers not the other way around. Our decisions are based upon their corporate reputation and the quality of their offerings and pricing. Our recommendations regarding technology are reached without regard to financial compensation except in situations in which comparable products at comparable pricing are available from multiple sources. In this limited case, we support our sponsors because our sponsors support us.

BOGO Bonaza: Enjoy state-of-the-art VoIP service with a $10 credit and half-price SIP service on up to $500 of Skyetel trunking with free number porting when you fund your Skyetel account. No limits on number of simultaneous calls plus quadruple data center redundancy assures that you’ll never have a failed call. Tutorial and sign up details are here.

The lynchpins of Incredible PBX 2020 are the new ClearlyIP components which bring management of FreePBX modules and SIP phone integration to a level never before available with any other Asterisk distribution. And now you can configure and reconfigure your new Incredible PBX phones from the convenience of the Incredible PBX GUI.

VitalPBX is perhaps the fastest-growing PBX offering based upon Asterisk with an installed presence in more than 100 countries worldwide. VitalPBX has generously provided a customized White Label version of Incredible PBX tailored for use with all Incredible PBX and VitalPBX custom applications. Follow this link for a free test drive!
 

Special Thanks to Vitelity. Vitelity is now Voyant Communications and has halted new registrations for the time being. Our special thanks to Vitelity for their unwavering financial support over many years and to the many Nerd Vittles readers who continue to enjoy the benefits of their service offerings. We will keep everyone posted on further developments.
 



Print Friendly, PDF & Email

Be Sociable, Share!

This article has 1 comment

  1. The information in this article is false. The old master key won’t be revoked but will continue to work. A new one will be added: https://www.freepbx.org/freepbx-master-key-update/

    [WM: Nothing in the post you have referenced indicates that the old master key won’t be revoked. Read it again. "[T]here are no current plans at Sangoma to deprecate the old master key. If circumstances in the future change, it would be done in such a way to minimize disruption." There also would appear to be a difference of opinion as to ownership of the old master key, but we’ll reserve comment on that for another day. And there have been reported issues. See, for example, this thread.]