EdgeX plan for Hashicorp change from MPL-2.0 to BSL 1.1 license

[dmocek]

Given the upcoming license changes in Vault, is there a known replacement for it? I'm aware of the "Bring your own Vault" effort.

[cloudxxx8]

@dmocek do you have any reference about this license change?

[bnevis-i]

I have found references to it here:

https://www.hashicorp.com/blog/hashicorp-adopts-business-source-license

The actual license is here:

https://www.hashicorp.com/bsl

This license change affects all future releases of Hashicorp products.

[cloudxxx8]

As a result, we should replace Consul, too

[farshidtz]

I don't think replacing it is strictly necessary. The license of the API code is still MPL 2.0. So this really affects the deployments with docker compose which deploy Consul as well as the edgexfoundry snap which bundles it. The snap needs to add BSL to its licenses.

[lenny-goodell]

As a result, we should replace Consul, too

As a result, we should replace Consul, too

As a result, we should replace Consul, too

Good point. Or at lease an alternative for adopters that are going to commercialize

[bnevis-i]

Good point. Or at [least] an alternative for adopters that are going to commercialize

EdgeX is distributed under an OSI-approved open source license (Apache-2.0), and dependencies need to be compatible with EdgeX license policy. The current EdgeX license policy is that BSD, MIT, Apache-2.0 OSI licenses for dependencies are approved, GPL v1/v2 is forbidden, and all others require TSC approval.

[lenny-goodell]

@bnevis-i , Consul is a HashiCorp product also, which will fall under their new BSL license.

[cloudxxx8]

I guess another way is to have TSC approval for the new BSL license.
However, adopters could potentially get caught under the license restriction that we “cannot offer the Licensed Work [eg Vault] to third parties on a hosted or embedded basis which is competitive with HashiCorp’s products”
In the future, if they claimed EdgeX is the competitier of their old or new product, we can't continue to use it, as well as any adopters who embed EdgeX to their product in the future.

[bnevis-i]

@cloudxxx8 That's not what I am saying at all. Specifically, I did not get into any specific terms and conditions of any particular license. I just said that the decision should be based on the project's license policy.

[cloudxxx8]

Sorry, that’s my misunderstanding

[farshidtz]

Note that even though Consul now has BSL 1.1 license, the Consul API (in the same git repo) maintains its MPL 2.0 license. The MPL license file has simply been moved to /api/LICENSE.

Need to update EdgeX Attribution.txt files for the new license path.

[bnevis-i]

Potential alternatives to Vault

• Openstack Keystone for authentication and JWT for identity (active project, Apache-2.0, Python)
• Openstack Barbican for key and secret management ((active project, Apache-2.0, Python), potentially sqlite backend.

[cloudxxx8]

They are both large images. Are the following links correct?
https://hub.docker.com/r/openstackhelm/barbican/tags
https://hub.docker.com/r/openstackhelm/keystone/tags

[bnevis-i]

Those containers seem to have a lot of weird stuff in them like ceph libraries, remote desktop stuff, etc. Looks like may be also based on an ubuntu base image.

However, I did a manual install of both of these components and here is what I found:

• Based on some pretty hold technology: apache2 + wsgi + python handlers -- would take some time to bundle this up as a container.
• Performance wasn't the greatest
• Secrets are assigned HREFs rather than navigating to them in a KV store. See https://docs.openstack.org/barbican/latest/install/verify.html
• If you have keystone issue a JWT instead of a fernet token, it is still pretty opaque, much more so than the tokens issued by Vault.
  There is not enough to actually identify the whose token it is without making a call back to keystone:

{
  "typ": "JWT",
  "alg": "ES256"
}.{
  "sub": "625b2f7e22344d38bf0349b84d9e3630",
  "iat": 1693606516,
  "exp": 1693610116,
  "openstack_methods": [
    "password"
  ],
  "openstack_audit_ids": [
    "YSRuCwsQQ-mUtljj_44uBw"
  ],
  "openstack_project_id": "c070d9a2af174faf8df788eaba036b67"
}.[Signature]

So I'm thinking keystone/barbican isn't probably what we want.