On April third, Matt Asay revealed a chunk for InfoWorld titled OpenTofu could also be exhibiting us the unsuitable technique to fork. In it, he says:
that OpenTofu might have illegally taken HashiCorp’s code to maintain tempo. Not less than, it’s onerous to keep away from that conclusion, perusing OpenTofu’s GitHub repositories and evaluating them to HashiCorp’s.
The code in query is a brand new function in Terraform 1.7 that additionally landed in OpenTofu because the fork maintainers work to keep up parity. Asay claimed:
OpenTofu took this BUSL-licensed HashiCorp code, eliminated the headers, and tried to as an alternative relicense it underneath the Mozilla Public License (MPL 2.0).
As a beleaguered boxer would possibly say, “Them’s is preventing phrases.” So, it naturally prompted many armchair software program copyright legal professionals to research the code in query and decide whether or not or not it was really copy pasta. Sensible folks have landed on both facet of this concern. Dan Lorenc from ChainGuard says:
I did my very own audit and the samples bear no resemblance regardless of implementing related performance, which is truthfully onerous to do in Go the place there are so few methods to do issues. I can’t presumably see any validity to this declare.
In the meantime, Joe Duffy from Pulumi concluded:
There are three main sorts of taint, from worst to least worse
- Copied the code instantly
- Learn the supply and was influenced by it
- Copied the performance
I’ve seen this recreation sufficient to know that if the file, operate, and variable names, plus non-zero variety of statements, match, you’ve most likely received at the very least degree 2 (if not degree 1). And that’s an issue. That’s fairly clearly true of at the very least remove_statement.go.
Asay later issued this assertion about his article:
I remorse how strongly i expressed myself (pressure of behavior 😬),however grateful for individuals who expressed help in opposition to mob canine piling. Two are execs my put up put underneath fireplace. They didn’t agree w/ my conclusions however responded w/ kindness. They’re the form of OSS neighborhood I wish to be part of
Just a few days later, OpenTofu posted this on their LinkedIn web page:
OpenTofu Undertaking was just lately made conscious of a letter by HashiCorp’s legal professionals, alleging that OpenTofu was not respecting the phrases of its BSL license governing its Terraform codebase. OpenTofu vehemently disagrees with any suggestion that it misappropriated, mis-sourced, or in any other case misused HashiCorp’s BSL code. Certainly, evidently HashiCorp could also be conflating code that it had beforehand been open-sourced underneath the MPL and extra just lately developed code it revealed underneath the BSL. OpenTofu’s maintainers have investigated this matter, and intends to concern a written response offering a extra detailed clarification of its place within the coming days.
I’m excited to learn OpenTofu’s written response, however I’ve a sense it’s solely going to get uglier from right here. If I’m operating the OpenTofu challenge, I’d be significantly contemplating a change in technique from “function parity” to “differentiation” to any extent further…
