License update - AGPLv3 for Steampipe CLI & FDW, Apache 2.0 for plugins & mods

[e-gineer]

License Changes

After careful consideration, we have decided to update the open source licenses for various Steampipe components:

• Steampipe CLI (turbot/steampipe) - AGPLv3 (currently MPLv2.0)
• Steampipe Postgres FDW (turbot/steampipe-postgres-fdw) - AGPLv3 (currently MPLv2.0)
• Steampipe Plugin SDK - Apache 2.0 (currently MPLv2.0)
• Steampipe Plugins (many!) - Apache 2.0 (currently MPLv2.0)
• Steampipe Mods (new!) - Apache 2.0

Why are you changing?

We selected MPLv2.0 originally as a weak copyleft license, commonly used in similar ecosystems like Terraform. Working on Steampipe we've come to better understand the use and direction of the tool, so have decided to adjust our licensing ASAP to match those patterns.

Apache v2.0 is much more widely used and more permissive than MPL v2.0. Using this license for plugins and mods should increase confidence, clarity and contributions from our Steampipe community.

AGPLv3 is more appropriate choice for the Steampipe core (CLI + FDW) - showing our commitment to open source, but also establishing a path for commercialization. For our users nothing changes, and contributors can be even more confident in our project direction.

What's the impact?

For users - none! You can use Steampipe as you always have. You can use, remix and customize our plugins and mods with even more confidence.

Steampipe is a young project, so we believe the change to AGPLv3 for the CLI & FDW has no impact on our existing ecosystem. This article covers common questions about integrating with AGPLv3 projects, or we're happy to discuss.

When is it effective?

Steampipe CLI v0.5.0 will be covered by the AGPLv3. All prior versions were released under MPL-2.0.

Plugins will be progressively changed from MPL-2.0 to Apache 2.0 over the coming weeks.

Other questions

Why don't you just release the CLI & FDW under Apache 2.0 (or other permissive license)?

Open licenses are a great, valid choice for projects. But, we've seen a trend for companies to ride an open license for high growth and then switch on their community later (for good reasons). We're embracing open Apache 2.0 licenses for our ecosystem (plugins, mods) but wanted to balance and clarify our commercialization plans for Steampipe in our AGPLv3 license choice for the core components.

Why didn't you choose SSPL or another more protective source available license?

We're committed to open source, so wanted an OSI approved license. We prefer the clarity and community opportunity of the AGPLv3 license over the fuzzier aspects of "competing service" etc in SSPL licenses.

Will you have a contributor agreement?

Yes, all contributors to the CLI and FDW will be required to sign a Contributor License Agreement. Changes will be released under the AGPLv3 license, but Turbot will have the flexibility to pursue our commercialization goals.