Investigate Banana Cake Pop for open sourcing and provide NOTICE.md

[Aniruddh25]

From @JelteF : Did we take out the BananaCakePop code and/or talk to CELA about it? Because I remember that it wasn't using an open source license.

[seantleonard]

@Aniruddh25, where did you see that BCP was not using an open source license? The license https://github.com/ChilliCream/hotchocolate/blob/main/LICENSE is MIT and encompasses everything in the ChilliCream/hotchocolate repo.

[seantleonard]

BCP cloud https://eat.bananacakepop.com/ has an Elastic License, but not the source code in the repo mentioned above:

[seantleonard]

@michaelstaib can you shine any light here?

[Aniruddh25]

Provide a NOTICE.md file describing our usage of HotChocolate/BCP and other Third Party OSS.

[seantleonard]

according to discussion on HotChocolate/BCP Slack channel, BCP will be moved to a separate package (even the middleware included in HC) so that licensing will be less confusing. Ultimately, we may not even end up with BCP code at all and users will need to install and use BCP separately from DataAPIbuilder

[michaelstaib]

BCP was never part of the Hot Chocolate repro and was never under the MIT license. With version 11 and version and version 12, there was a minified version in the repository, but there was license information attached to it that is not included in the MIT license.

BCP is under the elastic license 2.0, which allows for the following:

The licensor grants you a non-exclusive, royalty-free, worldwide, non-sublicensable, non-transferable license to use, copy, distribute, make available, and prepare derivative works of the software, in each case subject to the limitations and conditions below.

But it guarantees to us that people do not remove the integration into our value add services.

You may not move, change, disable, or circumvent the license key functionality in the software, and you may not remove or obscure any functionality in the software that is protected by the license key.

https://www.elastic.co/licensing/elastic-license

In essence, BCP is free to use with a permissible license, but we do not allow people to swap out our services integration. We will soon enable users to integrate their services into it, though.

For me, it's important that what is under MIT never changes to another license. We are very clear with the community that everything under the MIT license will always stay under the MIT license (Hot Chocolate + Strawberry Shake).

We are moving BCP into its own NuGet package with 13.1, but already with 12, you can opt out of using it.

We can have a look at doing a backport of that change to 12 if that helps you.

We also provide it now as a separate npm package.
https://www.npmjs.com/package/@chillicream/bananacakepop-express-middleware

[yorek]

Thanks a lot for the clarification, Michael!