foundation icon indicating copy to clipboard operation
foundation copied to clipboard
verified publisher icon cncf

[License Exception Request] [Crossplane] [MPL-2.0]

Open jeanduplessis opened this issue 1 year ago • 6 comments

Component details

The https://github.com/crossplane/upjet/ project relies on MPL licensed code from Hashicorp for integration with their Terraform providers.

The list of MPL licensed code referenced in the project are:

Direct dependencies

Indirect dependencies

License name

Mozilla Public License (MPL) version 2.0

Code modified?

The dependencies are referenced externally and remains unmodified. https://github.com/crossplane/upjet/blob/main/go.mod

Changes contributed?

Not applicable currently, but if changes are needed we would look to contribute directly upstream as a first step.

Any alternatives?

We looked at OpenTofu, but since OpenTofu project is also MPL licensed and depends on many of the same dependencies as we do from github.com/hashicorp/, there are no viable alternatives currently.

Integrates with other components?

The MPL licensed components are used by Upjet to be able to integrate with the Terraform providers and generate Crossplane-compatible providers.

jeanduplessis avatar Apr 29 '24 11:04 jeanduplessis

In addition to the MPL licensed dependencies used by crossplane/upjet the following dependencies are used by the providers generated by Upjet:

Dependencies

  • github.com/hashicorp/aws-cloudformation-resource-schema-sdk-go
  • github.com/hashicorp/aws-sdk-go-base
  • github.com/hashicorp/awspolicyequivalence
  • github.com/hashicorp/errwrap
  • github.com/hashicorp/go-checkpoint
  • github.com/hashicorp/go-cleanhttp
  • github.com/hashicorp/go-multierror
  • github.com/hashicorp/hc-install
  • github.com/hashicorp/terraform-exec
  • github.com/hashicorp/terraform-plugin-framework-jsontypes
  • github.com/hashicorp/terraform-plugin-framework-timeouts
  • github.com/hashicorp/terraform-plugin-framework-timetypes
  • github.com/hashicorp/terraform-plugin-framework-validators
  • github.com/hashicorp/terraform-plugin-mux
  • github.com/hashicorp/terraform-plugin-testing
  • github.com/hashicorp/terraform-provider-aws
  • github.com/hashicorp/terraform-provider-azurerm
  • github.com/hashicorp/terraform-provider-google
  • github.com/hashicorp/terraform-provider-azuread
  • github.com/hashicorp/go-azure-helpers
  • github.com/hashicorp/go-azure-sdk/resource-manager
  • github.com/hashicorp/go-azure-sdk/sdk
  • github.com/hashicorp/go-retryablehttp

jeanduplessis avatar May 24 '24 11:05 jeanduplessis

@krook Would it be accurate to assume this, https://github.com/cncf/foundation/issues/619#issuecomment-2127627367, applies here as well?

jeanduplessis avatar May 24 '24 15:05 jeanduplessis

Also if an MPL licensed repo was forked and modified, but not vendored, and still linked to at build time, I assume it is still in compliance with the granted exception.

jeanduplessis avatar May 24 '24 15:05 jeanduplessis

@krook Would it be accurate to assume this, #619 (comment), applies here as well?

Yes, the GB approval of a license exception for Issue #619 does apply to all CNCF projects, but the conditions of the prior GB approval still apply (i.e., "used in unmodified form by linking to the dependency at build time").

krook avatar May 28 '24 16:05 krook

Also if an MPL licensed repo was forked and modified, but not vendored, and still linked to at build time, I assume it is still in compliance with the granted exception.

Unfortunately not. The exception granted by the GB for Issue #619 was only for use of those dependencies "so long as they are used in unmodified form by linking to the dependency at build time." If an exception is desired for a modified fork, the project needs to open a separate license exception request.

krook avatar May 28 '24 16:05 krook

Hey folks, any updates on this one?

yordis avatar Jun 25 '24 21:06 yordis

The CNCF Governing Board has approved this exception request in an October vote.

krook avatar Oct 23 '24 00:10 krook