3 ms·

Terraform was (and I assume currently, OpenTF) under an MPL license, which is not currently compatible with the approved licenses that the CNCF supports: https:

Terraform was (and I assume currently, OpenTF) under an MPL license, which is not currently compatible with the approved licenses that the CNCF supports: https://github.com/cncf/foundation/blob/main/allowed-third-party-license-policy.md https://github.com/cncf/foundation/blob/main/allowed-third-p... For them to get accepted into the CNCF would require relicensing a large amount of MPL work. What's always been confusing to me about Hashicorp's change and any subsequent relicense of OpenTF is that I know for a fact not everyone who contributed code to Terraform signed the CLA and allowed permission to relicense. I suspect if OpenTF tries to relicense to a more permissive license like Apache 2 (rather than less in the case of BSL) license we might see some fireworks.

tedivm 3y ago
The CNCF has made exceptions on their license policy before, specifically for MPL based software. It'll probably be easier for OpenTF to go through that process than to relicense (which is likely not even possible for anyone other than Hashicorp). - https://github.com/cncf/foundation/tree/main/license-exceptions https://github.com/cncf/foundation/tree/main/license-excepti... - https://github.com/cncf/foundation/blob/main/license-exceptions/cncf-exceptions-2023-06-27.json https://github.com/cncf/foundation/blob/main/license-excepti...
- richardfontana 3y ago
  Disclosure: I'm on the CNCF legal committee, which mainly makes recommendations to the CNCF board on things like exceptions to CNCF's fairly strict licensing policy. This is correct, but I believe MPL has never been approved as a main project license for a CNCF project before, as opposed to a license of a third party dependency (the default rule is that such projects must be under the Apache License 2.0). FWIW I would not hesitate to support such a request for a policy exception.
  - _msw_ 3y ago
    In my personal opinion, there's no good reason to have a license policy at the CNCF, or any Linux Foundation directed fund, that makes using copyleft licenses so burdensome, especially when they are as "weak" as MPL 2.0 is. I know that there are Reasons. I just don't think they are good ones.
    - richardfontana 3y ago
      I agree, though that probably would not shock you. :)
  - bcantrill 3y ago
    That's great to hear. We at Oxide are huge fans of the MPLv2 and it's our default license for everything; I think it's reasonable that the default expectation for CNCF is Apache 2.0, but would love for MPLv2 to also be considered a first-class license!

tedivm 3y ago

The CNCF has made exceptions on their license policy before, specifically for MPL based software. It'll probably be easier for OpenTF to go through that process than to relicense (which is likely not even possible for anyone other than Hashicorp). - https://github.com/cncf/foundation/tree/main/license-exceptions https://github.com/cncf/foundation/tree/main/license-excepti... - https://github.com/cncf/foundation/blob/main/license-exceptions/cncf-exceptions-2023-06-27.json https://github.com/cncf/foundation/blob/main/license-excepti...

richardfontana 3y ago
Disclosure: I'm on the CNCF legal committee, which mainly makes recommendations to the CNCF board on things like exceptions to CNCF's fairly strict licensing policy. This is correct, but I believe MPL has never been approved as a main project license for a CNCF project before, as opposed to a license of a third party dependency (the default rule is that such projects must be under the Apache License 2.0). FWIW I would not hesitate to support such a request for a policy exception.
- _msw_ 3y ago
  In my personal opinion, there's no good reason to have a license policy at the CNCF, or any Linux Foundation directed fund, that makes using copyleft licenses so burdensome, especially when they are as "weak" as MPL 2.0 is. I know that there are Reasons. I just don't think they are good ones.
  - richardfontana 3y ago
    I agree, though that probably would not shock you. :)
- bcantrill 3y ago
  That's great to hear. We at Oxide are huge fans of the MPLv2 and it's our default license for everything; I think it's reasonable that the default expectation for CNCF is Apache 2.0, but would love for MPLv2 to also be considered a first-class license!