The HashiCorp Business Source License is the source-available licence under which HashiCorp publishes the free community editions of its products. On 2023-08-10 HashiCorp announced a move from the Mozilla Public License v2.0 (MPL 2.0) to the Business Source License v1.1 (BSL, or BUSL) for future releases of all its products and several libraries. Its APIs, SDKs, Terraform providers and almost all other libraries stayed on MPL 2.0.[1] The BSL text is a MariaDB Corporation licence template. HashiCorp fills in its own parameters, most importantly an Additional Use Grant that allows production use except in competing hosted or embedded offerings.[2] HashiCorp states that it regards its licensing FAQ as binding. Users “should feel assured in relying on them as our official positions now and in the future.”[1] For a software asset manager, the licence matters in two ways. Internal use is free, including in production. Third-party platforms and managed services that host or embed the products may, however, need a commercial licence. For the general background, see open-source software licensing.
Editions
The BSL covers the products HashiCorp now calls “community” editions. HashiCorp no longer calls them “open source”, because the BSL does not meet the Open Source Initiative definition.[1] The products are Terraform, Packer, Vault, Boundary, Consul, Nomad, Waypoint and Vagrant.[1] Each has a last release under MPL 2.0. Every later release is BSL 1.1 (catalog rule):
| Product | Final MPL 2.0 release[1] |
|---|---|
| Terraform | 1.5.7 |
| Packer | 1.9.5 |
| Vault | 1.14.8 |
| Boundary | 0.13.1 |
| Consul | 1.16.4 |
| Nomad | 1.6.5 |
| Waypoint | 0.11.4 |
| Vagrant | 2.3.7 |
Product documentation states the same licence for the current community editions. For example, Nomad Community Edition “is licensed under the Business Source License (BSL / BUSL)”.[6] Terraform Community Edition is described as “a free, downloadable tool”.[7] The commercial editions (HCP services and the self-managed Enterprise editions) are not licensed under the BSL. HashiCorp said its commercial customers “get our technology under separately negotiated licenses”.[1]
Licensor
The licence page on hashicorp.com names HashiCorp, Inc. as Licensor, with the Licensed Work “(c) 2023 HashiCorp, Inc.”[2] The LICENSE file in the Terraform repository names International Business Machines Corporation (IBM) as Licensor. Its Licensed Work is “Terraform Version 1.6.0 or later”, and the competition test refers to IBM Corp.’s paid versions.[3] Check the LICENSE file shipped with the specific release in use, because the BSL applies separately to each version.[2]
Metrics
The BSL has no licence metric and no fee. Use is either inside the grant, and free, or outside it, in which case a commercial licence is needed.[2] The metrics on the commercial editions (managed resources, Vault clients and so on) do not apply to community editions. Count community installations in inventory, but do not reconcile them against an Order Form.
Counting / floors
The licence grants the right to copy, modify, create derivative works, redistribute and make non-production use of the Licensed Work. The Additional Use Grant extends this to production use.[2] The test is set out in the grant (catalog rule):
- Production use is allowed if it “does not include offering the Licensed Work to third parties on a hosted or embedded basis in order to compete with HashiCorp’s paid version(s)”.[2]
- A “competitive offering” is a Product offered to third parties on a paid basis, including through paid support arrangements, that significantly overlaps with the capabilities of HashiCorp’s paid versions. Products not provided on a paid basis are not competitive.[2]
- “Embedded” means including source or executable code from the Licensed Work in a competitive offering. It also covers packaging the offering so that the Licensed Work must be accessed or downloaded for it to operate.[2]
- A Product that was not competitive when first made generally available does not become competitive later because HashiCorp adds capabilities to a new version.[2]
The FAQ adds three clarifications. A “paid support arrangement” is any paying relationship under which the user can get support for the Licensed Work, even if the support is sold generally for many products. A free service supported as part of a broader paid offering therefore counts as paid (catalog rule).[1] A provisioning service that lets customers invoke Terraform counts as embedding Terraform. This applies whether the service is managed, self-hosted or a bring-your-own-container mechanism.[1] The licence does not stop anyone using HashiCorp tools to build a competing product. For example, a Vault competitor may deploy its product with Terraform. It forbids only hosting or embedding a product to compete with that same product.[1]
Internal use and affiliates
Hosting or using the Licensed Work for internal purposes within an organization is not a competitive offering. The organization includes all affiliates under common control (catalog rule).[2] The FAQ gives the example that one division can host a HashiCorp product for use by another internal division.[1] Consultants and systems integrators may help customers run the products for the customers’ own use. Embedding or hosting the products in an offering made available to multiple customers that competes with HashiCorp products is not permitted.[1]
Terraform providers and libraries
The BSL change did not alter the licensing of Terraform providers. Provider maintainers choose their own licences. The providers HashiCorp builds and maintains remain MPL 2.0, as do the SDKs and frameworks for plugin and provider authors (catalog rule).[1] BSL code may be combined with code under other licences if each component keeps its own licence. It may not be mixed with strong copyleft code such as the GPL.[1]
Virtualization & partitioning
The BSL has no virtualization or partitioning rules. The only test is whether a use is internal or a competitive offering to third parties.[2]
Cloud / BYOL
Running a community edition on a public cloud for the organization’s own use is internal use and falls within the grant.[2] A cloud or platform provider that offers a hosted or embedded HashiCorp product to its customers on a paid basis, in a way that significantly overlaps HashiCorp’s paid versions, is outside the grant.[2] Such a provider needs a commercial licence from the Licensor, its affiliates or authorized resellers, or must stop using the Licensed Work (catalog rule).[2] HashiCorp has invited providers who are unsure about a use case to contact it and offered “custom licensing terms”.[1]
Programs
Change date and MPL 2.0 conversion
Each version converts to the Change License, MPL 2.0. This happens on the Change Date or on the fourth anniversary of its first public distribution under the BSL, whichever comes first. At that point the BSL grant for that version ends (catalog rule).[2] HashiCorp’s parameters set the Change Date at four years from publication.[2] The licence applies separately to each version, so the Change Date may differ between releases.[2]
Earlier MPL 2.0 releases
The change is not retroactive. Source code and releases before the change remain under MPL 2.0 and may be used indefinitely under that licence (catalog rule).[1] HashiCorp said it would backport critical security patches to the MPL 2.0 versions until 2023-12-31. Patches after that date would be provided under the new licence.[1]
Breach and termination
Any use in violation of the licence automatically ends the user’s rights for the current version and all other versions of the Licensed Work (catalog rule).[2] A modified version may not be redistributed under another licence. It is a derivative work and stays under the BSL.[1] The licence must be displayed conspicuously on each original or modified copy.[2] Only those who embed or host the products competitively breach the licence. An open-source project that uses HashiCorp products non-competitively does not have to monitor how others use it.[1]
Relationship to commercial agreements
HashiCorp’s commercial agreements exclude “unsupported source-available versions of IBM products that IBM makes available to users at no charge (i.e., “Community Versions”)” from the purchased software.[4] Using paid IBM support for a Community Version is a material breach of the agreement.[4] The General Terms also exclude Community Versions from the definition of Products.[5] Inventory should therefore record whether each installation is a community or an Enterprise binary.
Out of scope
This article does not cover the licences of third-party Terraform providers, which their maintainers choose,[1] or forks of MPL 2.0 releases maintained by other organizations. It also leaves out trademark use, which the BSL does not grant,[2] and the commercial HCP and Enterprise terms described in HashiCorp licensing.