Audit needed for the Hashicorp MPL -> BUSL license change

[frzifus]

Related CNCF issue: cncf/foundation#617

We need to ensure this will not affect our released binaries, and if it does we need to evaluate the impact.

Packages:

github.com/hashicorp/consul/api
github.com/hashicorp/consul/sdk
github.com/hashicorp/cronexpr
github.com/hashicorp/errwrap
github.com/hashicorp/go-cleanhttp
github.com/hashicorp/go-hclog
github.com/hashicorp/go-immutable-radix
github.com/hashicorp/golang-lru
github.com/hashicorp/go-msgpack
github.com/hashicorp/go-multierror
github.com/hashicorp/go-retryablehttp
github.com/hashicorp/go-rootcerts
github.com/hashicorp/go-sockaddr
github.com/hashicorp/go-syslog
github.com/hashicorp/go-uuid
github.com/hashicorp/go-version
github.com/hashicorp/logutils
github.com/hashicorp/mdns
github.com/hashicorp/memberlist
github.com/hashicorp/nomad/api
github.com/hashicorp/serf

[pavolloffay]

go mod why -m github.com/hashicorp/consul/api                                                                                                                                                                                                                                                                      ploffay@fedora
                                
# github.com/hashicorp/consul/api
github.com/open-telemetry/opentelemetry-operator/internal/manifests/collector
github.com/prometheus/prometheus/discovery/install
github.com/prometheus/prometheus/discovery/consul
github.com/hashicorp/consul/api

go mod why -m github.com/hashicorp/consul/sdk                                                                                                                                                                                                                                                                      ploffay@fedora
                               
# github.com/hashicorp/consul/sdk
github.com/open-telemetry/opentelemetry-operator/internal/manifests/collector
github.com/prometheus/prometheus/discovery/install
github.com/prometheus/prometheus/discovery/consul
github.com/hashicorp/consul/api
github.com/hashicorp/consul/api.test
github.com/hashicorp/consul/sdk/testutil

go mod why -m github.com/hashicorp/cronexpr                                                                                                                                                                                                                                                                    1 ↵ ploffay@fedora
                               
# github.com/hashicorp/cronexpr
github.com/open-telemetry/opentelemetry-operator/internal/manifests/collector
github.com/prometheus/prometheus/discovery/install
github.com/prometheus/prometheus/discovery/nomad
github.com/hashicorp/nomad/api
github.com/hashicorp/cronexpr

go mod why -m github.com/hashicorp/errwrap                                                                                                                                                                                                                                                                         ploffay@fedora
                             
# github.com/hashicorp/errwrap
github.com/open-telemetry/opentelemetry-operator/internal/manifests/collector
github.com/prometheus/prometheus/discovery/install
github.com/prometheus/prometheus/discovery/nomad
github.com/hashicorp/nomad/api
github.com/hashicorp/go-multierror
github.com/hashicorp/errwrap

go mod why -m github.com/hashicorp/go-cleanhttp                                                                                                                                                                                                                                                                    ploffay@fedora
                            
# github.com/hashicorp/go-cleanhttp
github.com/open-telemetry/opentelemetry-operator/internal/manifests/collector
github.com/prometheus/prometheus/discovery/install
github.com/prometheus/prometheus/discovery/consul
github.com/hashicorp/consul/api
github.com/hashicorp/go-cleanhttp

 go mod why -m github.com/hashicorp/go-hclog                                                                                                                                                                                                                                                                        ploffay@fedora
                                 
# github.com/hashicorp/go-hclog
github.com/open-telemetry/opentelemetry-operator/internal/manifests/collector
github.com/prometheus/prometheus/discovery/install
github.com/prometheus/prometheus/discovery/consul
github.com/hashicorp/consul/api
github.com/hashicorp/go-hclog

go mod why -m github.com/hashicorp/go-immutable-radix                                                                                                                                                                                                                                                              ploffay@fedora
                             
# github.com/hashicorp/go-immutable-radix
github.com/open-telemetry/opentelemetry-operator/internal/manifests/collector
github.com/prometheus/prometheus/discovery/install
github.com/prometheus/prometheus/discovery/consul
github.com/hashicorp/consul/api
github.com/hashicorp/serf/coordinate
github.com/armon/go-metrics
github.com/hashicorp/go-immutable-radix

[trask]

just checking in, I think this is the last repo we need to finish auditing, thx!

[frzifus]

I will have a more detailed view tomorrow 👍

[trask]

hi @frzifus, just following up, thx

[frzifus]

Hi @trask , here is a list of all the dependencies and their used version and License. I have checked all the packages. In almost none of the repositories there was a license change and in those where there was one, the current license was explicitly kept in the sub-package. E.g. github.com/hashicorp/nomad did change, but the package github.com/hashicorp/nomad/api that we use did not.

Dependency	Repository	License	Changed to BUSL?
github.com/hashicorp/consul/api	https://github.com/hashicorp/consul/blob/api/v1.22.0/api/LICENSE	MPL-2.0	No
github.com/hashicorp/cronexpr	https://github.com/hashicorp/cronexpr/blob/v1.1.2/LICENSE	Apache-2.0	No
github.com/hashicorp/errwrap	https://github.com/hashicorp/errwrap/blob/v1.1.0/LICENSE	MPL-2.0	No
github.com/hashicorp/go-cleanhttp	https://github.com/hashicorp/go-cleanhttp/blob/v0.5.2/LICENSE	MPL-2.0	No
github.com/hashicorp/go-hclog	https://github.com/hashicorp/go-hclog/blob/v1.5.0/LICENSE	MIT	No
github.com/hashicorp/go-immutable-radix	https://github.com/hashicorp/go-immutable-radix/blob/v1.3.1/LICENSE	MPL-2.0	No
github.com/hashicorp/go-multierror	https://github.com/hashicorp/go-multierror/blob/v1.1.1/LICENSE	MPL-2.0	No
github.com/hashicorp/go-retryablehttp	https://github.com/hashicorp/go-retryablehttp/blob/v0.7.4/LICENSE	MPL-2.0	No
github.com/hashicorp/go-rootcerts	https://github.com/hashicorp/go-rootcerts/blob/v1.0.2/LICENSE	MPL-2.0	No
github.com/hashicorp/go-version	https://github.com/hashicorp/go-version/blob/v1.6.0/LICENSE	MPL-2.0	No
github.com/hashicorp/golang-lru	https://github.com/hashicorp/golang-lru/blob/v0.6.0/LICENSE	MPL-2.0	No
github.com/hashicorp/nomad/api	https://github.com/hashicorp/nomad/blob/3a687930bd3e/api/LICENSE	MPL-2.0	No
github.com/hashicorp/serf/coordinate	https://github.com/hashicorp/serf/blob/v0.10.1/LICENSE	MPL-2.0	No