[License Exception Request] [Crossplane] [MPL-2.0]

[jeanduplessis]

Component details

The https://github.com/crossplane/upjet/ project relies on MPL licensed code from Hashicorp for integration with their Terraform providers.

The list of MPL licensed code referenced in the project are:

Direct dependencies

• github.com/hashicorp/hcl/ v2.19.1
• github.com/hashicorp/terraform-json v0.17.1
• github.com/hashicorp/terraform-plugin-framework v1.4.1
• github.com/hashicorp/terraform-plugin-go v0.19.0
• github.com/hashicorp/terraform-plugin-sdk v2.30.0

Indirect dependencies

• github.com/hashicorp/go-plugin v1.5.1
• github.com/hashicorp/go-uuid v1.0.3
• github.com/hashicorp/go-version v1.6.0
• github.com/hashicorp/logutils v1.0.0
• github.com/hashicorp/terraform-plugin-log v0.9.0
• github.com/hashicorp/terraform-registry-address v0.2.2
• github.com/hashicorp/terraform-svchost v0.1.1
• github.com/hashicorp/yamux v0.0.0-20181012175058-2f1d1f20f75d

License name

Mozilla Public License (MPL) version 2.0

Code modified?

The dependencies are referenced externally and remains unmodified. https://github.com/crossplane/upjet/blob/main/go.mod

Changes contributed?

Not applicable currently, but if changes are needed we would look to contribute directly upstream as a first step.

Any alternatives?

We looked at OpenTofu, but since OpenTofu project is also MPL licensed and depends on many of the same dependencies as we do from github.com/hashicorp/, there are no viable alternatives currently.

Integrates with other components?

The MPL licensed components are used by Upjet to be able to integrate with the Terraform providers and generate Crossplane-compatible providers.

[jeanduplessis]

In addition to the MPL licensed dependencies used by crossplane/upjet the following dependencies are used by the providers generated by Upjet:

• crossplane-contrib/provider-upjet-aws
• crossplane-contrib/provider-upjet-azure
• crossplane-contrib/provider-upjet-azuread
• crossplane-contrib/provider-upjet-gcp

Dependencies

• github.com/hashicorp/aws-cloudformation-resource-schema-sdk-go
• github.com/hashicorp/aws-sdk-go-base
• github.com/hashicorp/awspolicyequivalence
• github.com/hashicorp/errwrap
• github.com/hashicorp/go-checkpoint
• github.com/hashicorp/go-cleanhttp
• github.com/hashicorp/go-multierror
• github.com/hashicorp/hc-install
• github.com/hashicorp/terraform-exec
• github.com/hashicorp/terraform-plugin-framework-jsontypes
• github.com/hashicorp/terraform-plugin-framework-timeouts
• github.com/hashicorp/terraform-plugin-framework-timetypes
• github.com/hashicorp/terraform-plugin-framework-validators
• github.com/hashicorp/terraform-plugin-mux
• github.com/hashicorp/terraform-plugin-testing
• github.com/hashicorp/terraform-provider-aws
• github.com/hashicorp/terraform-provider-azurerm
• github.com/hashicorp/terraform-provider-google
• github.com/hashicorp/terraform-provider-azuread
• github.com/hashicorp/go-azure-helpers
• github.com/hashicorp/go-azure-sdk/resource-manager
• github.com/hashicorp/go-azure-sdk/sdk
• github.com/hashicorp/go-retryablehttp

[jeanduplessis]

@krook Would it be accurate to assume this, #619 (comment), applies here as well?

[jeanduplessis]

Also if an MPL licensed repo was forked and modified, but not vendored, and still linked to at build time, I assume it is still in compliance with the granted exception.

[krook]

@krook Would it be accurate to assume this, #619 (comment), applies here as well?

Yes, the GB approval of a license exception for Issue #619 does apply to all CNCF projects, but the conditions of the prior GB approval still apply (i.e., "used in unmodified form by linking to the dependency at build time").

[krook]

Also if an MPL licensed repo was forked and modified, but not vendored, and still linked to at build time, I assume it is still in compliance with the granted exception.

Unfortunately not. The exception granted by the GB for Issue #619 was only for use of those dependencies "so long as they are used in unmodified form by linking to the dependency at build time." If an exception is desired for a modified fork, the project needs to open a separate license exception request.