Is it possible to distribute BSD (derived) software with a warranty?

Question

(In the following, assume that "I" is not personal, but could be a corporation or group suitable in size and training to perform the tasks)

I have received sample code carrying a license patterned after BSD:

Copyright (c) (Year and original author are specifically named here). All rights reserved.

Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:

1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.

2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.

3. Neither the name of author nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.

THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

The significant deviation from the "classic" three-clause BSD license, as seen for example on Wikipedia is that the disclaimer uses the phrase "AUTHORS OR COPYRIGHT HOLDERS" instead of naming a particular entity.

Assume that I take steps to ensure quality of the final version of the software I develop using this BSD-licensed source code, such as code inspection, testing, use of static analysis tools, perhaps even going so far as formal proofs of correctness. (Ignore for the moment that compared to these costs, recreating the software from scratch is probably feasible)

May I now offer the final version to a client under terms that extend warranties disclaimed in the original BSD license, such as fitness for a particular purpose? Due to my quality assurance process, I am expecting to assume the associated risks, and hold harmless the authors who gave sample code to me.

Or does the license disclaimer, which I must preserve intact under the terms of redistribution, fixate the agreement between myself and my customer to the same "as-is" terms that governed the original sample, because that disclaimer names "COPYRIGHT HOLDERS AND CONTRIBUTORS", a category into which I now fall?

Is it permissible for me to substitute the name of the actual entity in place of references to that entity such as "COPYRIGHT HOLDERS", "AUTHORS" or "CONTRIBUTORS"?

Does the answer change at all if the quality assurance and warranty are provided by a separate entity who has not contributed to the software itself?

Answer 1

The creator of the software doesn't provide any warranty. If you feel confident in the quality of the software, nothing stops you from providing a warranty. If the software doesn't meet your guarantees, you will have to pay out because you provided the warranty, depending on the terms. Not the creator of the software because they explicitly didn't provide any warranty. If that's what you want to do, go ahead. I wouldn't.

You don't have to republish under the BSD license, which you wouldn't. You must attach the license terms, which clarifies the role of the original creators, and that they don't give a warranty. Doing this allows you to copy the software. It doesn't mean you can't provide a warranty.

Answer 2

As long as you are clear that YOU are providing the warranty and the original authors of the software are NOT, that should be fine. This is an important part of RedHat's business model, for example (see e.g. Open Source Assurance warranty) and is essentially a transfer of risk (& maybe also money) from the person purchasing the warranty to you, which might be a good business model if you're going to invest a lot more time and energy into understanding, managing, and mitigating the risk than your customers want to.