Hashicorp Mozilla Public License v2.0 (MPL 2.0) to the Business Source License v1.1 (BSL or BUSL) change

[bryantbiggs]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request. Searching for pre-existing feature requests helps us consolidate datapoints for identical requirements into a single place, thank you!
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request.
• If you are interested in working on this issue or have submitted a pull request, please leave a comment.

---

Overview of the Issue

• Not a bug, more of seeking guidance. Do we know how the change in licensing will affect this project, and if so, what actions need to be taken?

https://www.hashicorp.com/blog/hashicorp-adopts-business-source-license

[solutiongeek]

The licensing for Atlantis will remain unaffected by the changes.

[jamengual]

but would this change limit Atlantis development in any way? Luke and Mishra are Hashicorp employees, how that could affect future features in atlantis that are similar to TFC? @solutiongeek

[mattjamesaus]

How much of a guarantee on that do we get? Perhaps we're better to move this to a Discussion?

[kevcube]

https://www.hashicorp.com/license-faq#What-is-considered-a-competitive-offering

Based on Hashi's definition of a "competitive offering" I wouldn't expect Atlantis to be affected.

There is no commercial product in Atlantis and it is not provided as a hosted service.

[ricardosilva86]

yes, I agree. And also, Atlantis is totally opensource, which shouldn't be a problem as Hashicorp is targeting commercial tools. I know, everything could change, but its not something I think will ever happen - maybe I am just naive, but that's what I think.

[alex067]

I don't think there's much similarity in feature sets between Atlantis to TFC, but commenting to keep a close eye on this thread.

[GenPage]

The maintainer team has spoken with Luke and we can confirm that the Atlantis codebase is unaffected by the licensing change.

As stated in the blog post:

That is why today we are announcing that HashiCorp is changing its source code license from Mozilla Public License v2.0 (MPL 2.0) to the Business Source License (BSL, also known as BUSL) v1.1 on all future releases of HashiCorp products. HashiCorp APIs, SDKs, and almost all other libraries will remain MPL 2.0.

The last sentence highlights the Atlantis library and APIs:

HashiCorp APIs, SDKs, and almost all other libraries will remain MPL 2.0.

Atlantis is not considered a Hashicorp product nor do we offer a managed option. Atlantis codebase will remain Apache 2.0 as stated by @solutiongeek previously in this thread. If anything should change, the team will do its best to ensure the continuation of the project as humanly possible for our community.

IANAL, but it seems to me this really affects any commercial offering that utilizes the core Terraform product as part of its own. That is the main target of this change. That would include Atlantis since it uses Terraform under the hood. However, it does not matter since we do not plan to offer a managed solution. See: https://www.hashicorp.com/license-faq#What-are-the-usage-limitations-for-HashiCorp's-products-under-BSL

10. What are the usage limitations for HashiCorp’s products under BSL?
    All non-production uses are permitted. All production uses are allowed other than hosting or embedding the software in an offering competitive with HashiCorp products or services.

[bryantbiggs]

Awesome - thank you all for the clarification and guidance!

[osterman]

What's odd to me is the contradictory FAQ on MariaDB's site. MariaDB wrote the BSL that HashiCorp is adopting. =)

https://mariadb.com/bsl-faq-adopting/#closed

Can I use BSL software with an Open Source project?
A: No. The BSL has a usage limitation that is not allowed with Open Source software. However, you can usually mix BSL, Open Source and closed source code within an application as long as you don’t release or distribute the code to third parties. You can eliminate the usage limitation by purchasing a software license for the BSL code.

And note, Atlantis distributes open source with a Docker image that contains Atlantis and Terraform.

[leg100]

There is no clarity here.

The maintainer team has spoken with Luke and we can confirm that the Atlantis codebase is unaffected by the licensing change.

Atlantis is ostensibly in the clear because you've received "a nod and wink" from your man at Hashicorp. On what basis is it unaffected?

IANAL, but it seems to me this really affects any commercial offering that utilizes the core Terraform product as part of its own. That is the main target of this change. That would include Atlantis since it uses Terraform under the hood. However, it does not matter since we do not plan to offer a managed solution. See: https://www.hashicorp.com/license-faq#What-are-the-usage-limitations-for-HashiCorp's-products-under-BSL

That is a fair interpretation to be drawn from the FAQ's. But there is no reference to "commercial offering" nor "managed solution" in the new license.

Open source operates with transparency at its heart. Not smoke and mirrors. I maintain an open source project not dissimilar to Atlantis. I've sent an email to [email protected] requesting clarity:

---

Dear Hashicorp

I'm seeking further clarification regarding your new license 1.

I maintain an open source project 2. In terms of its use of your
"Licensed Works", it integrates with Terraform, automating its
execution in response to API calls and VCS events. I think it would be
fair to say that the project's capabilities significantly overlap
those of your products, in particular Terraform Enterprise. It is
non-commercial and I have no intention of commercialising it. Please
confirm whether this project is in compliance with your new license.

Yours sincerely

Louis Garman

P.S. I think the open source community at large would welcome further
clarification. The FAQ's 3 imply that it is commercial products that
the license expressly impacts but the license itself makes no such
distinction. If it's determined that non-commercial open source
projects are in compliance with the license, then it would be much
appreciated if it is explicitly stated in the additional use grant, if
not in the license itself, for the avoidance of all doubt.

[leg100]

OK, I received a response (promptly, and on a Saturday...). Hashicorp pointed me to an FAQ they've added:

https://www.hashicorp.com/license-faq#I'm-building-(or-have-built)-a-product-that-embeds-one-or-more-HashiCorp-products-and-I'm-concerned-you-may-view-it-as-competitive.-How-can-I-get-clarity-as-to-whether-my-product-will-violate-the-new-BSL-license.

That would appear to confirm Atlantis is in compliance (they confirmed my project is "completely fine"). But I have requested that they provide further clarity still, because the terms "competitive" and "production environment" can still be liberally interpreted, and that "non-commercial" and "SaaS" might be clearer distinctions.

[GenPage]

So to clarify one last time. Atlantis code license is not changing to BSL 1.1. It is staying Apache 2.0. This was stated in the first reply to the discussion by the Director of Community Development at Hashicorp. We secondarily confirmed with Luke, the original founder of Atlantis. The license is not changing.

And note, Atlantis distributes open source with a Docker image that contains Atlantis and Terraform.

This is the crux of the matter. All future releases of the Terraform binary ("product") are subjected to BSL 1.1. Since Atlantis uses Terraform and calls to it as part of its code, any Atlantis release that uses future Terraform releases cannot be used in a competitive offering.

That is a fair interpretation to be drawn from the FAQ's. But there is no reference to "commercial offering" nor "managed solution" in the new license. Open source operates with transparency at its heart. Not smoke and mirrors. I maintain an open-source project not dissimilar to Atlantis.

The wording is purposefully unclear to allow Hashicorp liberal interpretation of the license should anyone try and make money from using Terraform as the core engine. Unfortunately, this is the direction Hashicorp decided to take as a business.

That would appear to confirm Atlantis is in compliance (they confirmed my project is "completely fine"). But I have requested that they provide further clarity still, because the terms "competitive" and "production environment" can still be liberally interpreted, and that "non-commercial" and "SaaS" might be clearer distinctions.

Glad you got your own "a nod and wink" from Hashicorp about your own project. Hashicorp will never provide further clarity as it is not in their best interest to do so to have the upper hand in declaring what is or is not "competitive."

I will leave a final comment to re-iterate that if anything should change, the Atlantis maintainer team will do its best to ensure the continuation of the project as humanly possible. We are fully committed to open-source and will continue to help provide the community with a free, open, and simple way to manage and control infrastructure.

[jeffmccune]

So to clarify one last time. Atlantis code license is not changing to BSL 1.1. It is staying MSL 2.0.

Atlantis is licensed under Apache 2.0 not the MSL correct?

[jamengual]

we are not changing our license period.
yes it is Apache 2.0

[GenPage]

I have fixed the comments to clarify that.