René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"[License Exception Request] [Cozystack] [MPL-2.0] HashiCorp Terraform plugin libraries statically linked into terraform-provider-cozystack","articleBody":"### For which CNCF project are you requesting exceptions?\n\nCozystack\n\n### Are you an official maintainer of this project?\n\nYes\n\n### List of components requiring an exception\n\n| Component | Upstream URL | Project Usage URL | License(s) | Purpose |\n|---|---|---|---|---|\n| github.com/hashicorp/terraform-plugin-framework | https://github.com/hashicorp/terraform-plugin-framework | https://github.com/cozystack/terraform-provider-cozystack/blob/main/go.mod | MPL-2.0 | The SDK every Terraform provider is built on: resource, data source and schema definitions |\n| github.com/hashicorp/terraform-plugin-framework-validators | https://github.com/hashicorp/terraform-plugin-framework-validators | https://github.com/cozystack/terraform-provider-cozystack/blob/main/go.mod | MPL-2.0 | Attribute validators (allowed values, ranges) |\n| github.com/hashicorp/terraform-plugin-framework-jsontypes | https://github.com/hashicorp/terraform-plugin-framework-jsontypes | https://github.com/cozystack/terraform-provider-cozystack/blob/main/go.mod | MPL-2.0 | JSON-typed attributes |\n| github.com/hashicorp/terraform-plugin-go | https://github.com/hashicorp/terraform-plugin-go | https://github.com/cozystack/terraform-provider-cozystack/blob/main/go.mod | MPL-2.0 | Low-level Terraform plugin protocol, used by the framework |\n| github.com/hashicorp/terraform-plugin-log | https://github.com/hashicorp/terraform-plugin-log | https://github.com/cozystack/terraform-provider-cozystack/blob/main/go.mod | MPL-2.0 | Provider logging to Terraform |\n| github.com/hashicorp/terraform-registry-address | https://github.com/hashicorp/terraform-registry-address | https://github.com/cozystack/terraform-provider-cozystack/blob/main/go.mod | MPL-2.0 | Provider address parsing, transitive via the framework |\n| github.com/hashicorp/terraform-svchost | https://github.com/hashicorp/terraform-svchost | https://github.com/cozystack/terraform-provider-cozystack/blob/main/go.mod | MPL-2.0 | Registry host handling, transitive via the framework |\n\n### Distribution and integration model\n\n- [x] **CNCF-Distributed**: The CNCF project will distribute the dependency or the resulting combined artifacts to users.\n- [ ] **User-Fetched Dependency**\n- [ ] **System Component**\n- [ ] **Not Distributed + Not Needed by End User (Internal Project Tooling)**\n\n### Please explain\n\nterraform-provider-cozystack lets users manage Cozystack tenants and applications from Terraform. Per Cozystack's [GOVERNANCE.md](https://github.com/cozystack/cozystack/blob/main/GOVERNANCE.md) it is independent tooling governed by the project but not part of the Cozystack distribution. The provider itself is Apache-2.0; the libraries above are compiled into the provider binaries published on GitHub Releases (https://github.com/cozystack/terraform-provider-cozystack/releases) and the Terraform Registry. There is no practical alternative: these libraries are HashiCorp's official SDK for writing Terraform providers.\n\n`github.com/hashicorp/go-hclog`, `go-plugin`, `go-uuid` and `yamux` (MPL-2.0) are also linked; they are already covered by existing all-projects exceptions and are not part of this request.\n\n### Modification status\n\n- [ ] **Modified Upstream**\n- [ ] **Modified Downstream**\n- [x] **Unmodified**: The CNCF project will use the dependency exactly as provided by the upstream maintainers without any changes to its source code.\n\n### Please explain\n\nAll modules are consumed at their upstream tagged versions through Go modules, with no `replace` directives.\n\n### Structural separation\n\n- [x] **Separated Component**: The dependency's code will either be (a) kept in a distinct directory or module clearly separated from CNCF project code, or (b) retrieved at build/installation time from a third-party repository and never stored in the CNCF project repository.\n- [ ] **Intermingled Code**\n\n### Please explain\n\nThe dependencies are not stored in the repository (no `vendor/` directory); they are fetched from the upstream module proxy at build time and referenced only via `go.mod` / `go.sum`.\n\n### Communication mechanism\n\n- [x] **Static Linking**: The dependency and the CNCF project code will be combined into a single binary or similar type of artifact during the build process.\n- [ ] **Dynamic Linking**\n- [ ] **Separate Process**\n- [ ] **Network Interaction**\n\n### Please explain\n\nAs with any Go program, the imported packages are statically linked into the provider binary. At runtime Terraform starts the provider as a separate process and talks to it over gRPC.\n\n### Data exchange\n\n- [x] **Tightly Coupled**\n- [ ] **Arms-Length Only**\n\n### Please explain\n\nWithin the binary, the provider implements the framework's Go interfaces. Across the process boundary, all exchange with Terraform is Protobuf over gRPC.\n\n### Additional information\n\nMPL-2.0 is file-level copyleft: it does not extend to the provider's own Apache-2.0 source files, and the MPL-covered files remain available unmodified from upstream. Other CNCF projects that build Terraform providers rely on the same SDK. Identified by the project's FOSSA scan during Incubation due diligence (cncf/toc#1916).\n","author":{"url":"https://github.com/tym83","@type":"Person","name":"tym83"},"datePublished":"2026-10-16T01:58:40Z","url":"https://github.com/cncf/foundation/issues/1571"}