Investigate Hashicorp MPL -> BUSL Changes/Impact

[trask]

See cncf/foundation#617

We may have some projects that may be impacted by a license change.

We should investigate the impact on our projects and provide guidance if they are impacted.

Relevant Links: https://www.hashicorp.com/blog/hashicorp-adopts-business-source-license https://github.com/cncf/foundation/blob/main/allowed-third-party-license-policy.md https://github.com/cncf/foundation/blob/main/agpl-recommendations.md #187 (License exception for hashicorp/terraform projects)

I've done an initial search of "hashicorp" and "terraform" to narrow down possibly affected repositories (please let me know if you think I should expand the terms of this search):

• https://github.com/search?q=org%3Aopen-telemetry%20hashicorp&type=code
• https://github.com/search?q=org%3Aopen-telemetry%20terraform&type=code

Checking off repos which have been verified to not be impacted:

• opentelemetry-collector Investigate Hashicorp MPL -> BUSL Changes/Impact #1643 (comment)
• opentelemetry-collector-builder (archived)
• opentelemetry-collector-contrib Investigate Hashicorp MPL -> BUSL Changes/Impact #1643 (comment)
• opentelemetry-demo Investigate Hashicorp MPL -> BUSL Changes/Impact #1643 (comment)
• opentelemetry-ebpf Investigate Hashicorp MPL -> BUSL Changes/Impact #1643 (comment)
• opentelemetry-go Investigate Hashicorp MPL -> BUSL Changes/Impact #1643 (comment)
• opentelemetry-go-build-tools Investigate Hashicorp MPL -> BUSL Changes/Impact #1643 (comment)
• opentelemetry-go-contrib Investigate Hashicorp MPL -> BUSL Changes/Impact #1643 (comment)
• opentelemetry-go-instrumentation Investigate Hashicorp MPL -> BUSL Changes/Impact #1643 (comment)
• opentelemetry-lambda Investigate Hashicorp MPL -> BUSL Changes/Impact #1643 (comment)
• opentelemetry-log-collection (archived)
• opentelemetry-opamp-go Investigate Hashicorp MPL -> BUSL Changes/Impact #1643 (comment)
• opentelemetry-operator Investigate Hashicorp MPL -> BUSL Changes/Impact #1643 (comment)
• otel-arrow-collector Investigate Hashicorp MPL -> BUSL Changes/Impact #1643 (comment)
• prometheus-sidecar (private)

Pinging related maintainers:

• @open-telemetry/collector-maintainers
• @open-telemetry/collector-contrib-maintainer
• @open-telemetry/demo-maintainers
• @open-telemetry/ebpf-maintainers
• @open-telemetry/go-maintainers
• @open-telemetry/go-instrumentation-maintainers
• @open-telemetry/lambda-extension-maintainers
• @open-telemetry/opamp-go-maintainers
• @open-telemetry/operator-maintainers
• @open-telemetry/operator-ta-maintainers
• @open-telemetry/arrow-maintainers

Please review your repository if you are a maintainer for any of the repositories listed above and add a comment below with your preliminary analysis.

We'll discuss next steps in next week's maintainer meeting.

[MrAlias]

Issue tracking investigation in opentelemetry-go-instrumentation: open-telemetry/opentelemetry-go-instrumentation#254

[MrAlias]

Issue tracking investigation in opentelemetry-go-instrumentation: open-telemetry/opentelemetry-go-instrumentation#254

Our audit of opentelemetry-go-instrumentation did not find any dependencies that are being used where the license is changing. It should be considered complete.

[codeboten]

Followed @MrAlias's audit for the collector and collector-contrib repos. I don't believe either of those repos include impacted dependencies

The opentelemetry-collector-builder repo has been archived, so i did not audit it.

[MrAlias]

The following have been audited:

• opentelemetry-go: Investigate Hashicorp MPL -> BUSL Changes/Impact opentelemetry-go#4453
• opentelemetry-go-build-tools: Investigate Hashicorp MPL -> BUSL Changes/Impact opentelemetry-go-build-tools#389
• opentelemetry-go-contrib: Investigate Hashicorp MPL -> BUSL Changes/Impact opentelemetry-go-contrib#4201

No dependencies were using a license that is changing. They should be considered complete.

[julianocosta89]

I've validated the opentelemetry-demo and the dependencies used within the go services continue to be MPL-2.0.
open-telemetry/opentelemetry-demo#1055

[frzifus]

Operator tracking issue: open-telemetry/opentelemetry-operator#2038

[Aneurysm9]

I've validated that opamp-go does not use any relicensed modules. It has an indirect dependency on github.com/hashicorp/hcl, which I understand to be remaining under the MPL-2.0 license.

[jmacd]

I've checked that otel-arrow-adapter does not use terraform. This repo is a fork of the opentelemetry-collector repo so most of the analysis already done applies.

[Aneurysm9]

I've validated that opentelemetry-lambda does not use any relicensed modules. It does provide terraform infrastructure declarations but does not distribute terraform.

[atoulme]

The opentelemetry-ebpf project does not depend on hashicorp libraries, it uses packer for local development environment purposes.

See my comment on open-telemetry/opentelemetry-network#232 as well.

[frzifus]

I have checked the opentelemetry-operator packages (list) and as far as I understand, no dependency is affected.

[trask]

closing, thanks everyone!!