Investigate implications of new Packer licensing

[mboersma]

HashiCorp recently changed the license on some of their open source projects to BSL 1.1. This may or may not present legal issues to the use of Packer in the image-builder project.

Let's communicate with the CNCF to see if there's an official position on the new license, and determine whether there are implications for image-builder.

image-builder currently uses Packer v1.9.1 and is updating to v1.9.2, the last version under the MPL. The project will stay pinned there until we have a resolution to this issue.

image-builder/images/capi/hack/ensure-packer.sh

Lines 23 to 24 in d2a2af9

	# **DO NOT** change the Packer version: v1.9.2 is the last release under the MPL v2.0 license.
	_version="1.9.2"

See also:

• https://discuss.hashicorp.com/t/hashicorp-projects-changing-license-to-business-source-license-v1-1/57106
• https://www.hashicorp.com/blog/hashicorp-adopts-business-source-license
• https://www.hashicorp.com/license-faq

[AverageMarcus]

Some points of note:

• Security fixes will be backported under MPL 2.0 through December 31, 2023.

  Taken from https://www.hashicorp.com/license-faq

• If you need further clarification with respect to a particular use case, you can email licensing@hashicorp.com. Custom licensing terms are also available to provide more clarity and enable use cases beyond the BSL limitations.

  Taken from https://www.hashicorp.com/license-faq

• It seems some libraries and SDKs are still ok but doesn’t seem to include anything for Packer as far as I understand it. This would rule out switching to our own binary leveraging the Packer Go modules (e.g. resurrecting the cli project we recently got rid of)

• From what I understand, I don’t think the image-builder project itself would be considered a competitor but many of our users that run image-builder to create their images would be (e.g. Microsoft building for CAPZ). Maybe it would be possible for us as an OSS project to build and provide the images for the CAPI projects but that wouldn’t be ideal (cost, inflexible, maintenance burden).

[mboersma]

/cc @abhay-krishna

[jsturtevant]

thread in the cncf on this topic: cncf/foundation#617

[AverageMarcus]

Recommendations from CNCF: https://github.com/cncf/foundation/blob/main/source-available-recommendations.md

We've already pinned the version but thats a short term solution at best. I don't believe their is an alternative available to Packer that we could switch to, at least not without substantial work needing to be done.

[AverageMarcus]

As discussed in this slack thread: https://cloud-native.slack.com/archives/C0MP69YF4/p1692111612303149?thread_ts=1692108926.999039&cid=C0MP69YF4

We should submit a request for license exception from the CNCF Governing Board (not sure how to do that yet) just to be on the safe side. It's possible we won't need the exception but its best to check to be sure.

If no one else gets to it first I'll try and get the request in Thurs/Fri this week.

[BenTheElder]

We should submit a request for license exception from the CNCF Governing Board (not sure how to do that yet) just to be on the safe side.

From https://github.com/cncf/foundation/blob/main/source-available-recommendations.md:

In either case, while a project's maintainers may request a license exception from the CNCF Governing Board, it is extremely unlikely that one will be granted for the use of a dependency under a source available, non-open source license.

The CNCF has granted exceptions in the past for hashi libraries etc being under MPL, but that is still an "open source" license rather than "source available". I don't think they're likely to approve one here, the CNCF approved license list (no exceptions necessary) are all relatively free use license (ASLv2, MIT, ... https://github.com/cncf/foundation/blob/main/allowed-third-party-license-policy.md) and BUSL is pretty much the opposite.

That said, to file a request you file an issue at https://github.com/cncf/foundation/issues such as cncf/foundation#187

[lentzi90]

Has anyone looked at potential alternatives to packer? I was not aware of any but did a quick search and found linuxkit. Any ideas if it could replace packer? (Looks like they used to build OS images for Kubernetes with it in this project but it hasn't been updated in 5 years.)

[mboersma]

See also kubernetes-sigs/cluster-api#9181.

[AverageMarcus]

Opened exception request: cncf/foundation#625

[BenTheElder]

Linuxkit is used by docker desktop (see adopters list) which ships kubernetes.

It seems like switching would be a lot of work though.