There are forks of OSCommerce such as CRELoaded, although that doesn't change much in terms of the basic calculus, it just may have some additional features that you care about.
I had experience with CRELoaded/OSCommerce. I found the code base pretty bad, with UI and logic mixed in everywhere, with no good control over the architecture and what code goes where.
You said free as in freedom, so I'm going to throw this out (although I think the technology is Java). Fry is not at all free as in beer (several hundred thousand short of free), but whatever they implement you get full source code (at least according to their sales pitch when I was looking at them). I suspected that this was because they used GPL stuff in their stack, but I don't know.