Licensing question

[olivere]

I'm the maintainer of github.com/olivere/elastic, which is a Go driver for Elasticsearch. As part of that repository, I'm offering (experimental support for) tracing with OpenCensus.

A user of elastic recently used Fossa to check for licensing issues, and it raised two issues that he tracked down to opencensus-go, claiming it uses a version of Thrift that had a reference to LGPL-3.0 / LGPL-2.1 in it (see olivere/elastic#1001).

IANAL so I asked on the Fossa Slack if this maybe is a false positive, and Carlos of the Fossa team replied:

Carlos (FOSSA)

Depending on which version of Thrift project you were on if it's before 0.9.3 than there were traces of LGPL. It looks like we matched a mention of LGPL in the "Changes" Folder -> https://github.com/apache/thrift/blob/master/CHANGES You can ignore the issue if you're using the latest version.

CHANGES

Apache Thrift Changelog

Breaking Changes since 0.11.0 [for 0.12.0]:
--------------------------------------------------------------------------------
   * [THRIFT-4529] - Rust enum variants are now camel-cased instead of uppercased to conform to Rust naming conventions
   * [THRIFT-4448] - Support for golang 1.6 and earlier has been dropped.
...

Hope that helps!

Now I just want to get feedback on your standpoint regarding these legal issues. Thanks in advance.

[mtwo]

@jparsana uh oh, looks like we need to update a Thrift dependency ASAP

[sjkaris]

We should be fine I think, go.mod has thrift pinned to this commit which appears to be in between 0.11.0 and 0.12.0. As a side note, we should probably just pin to 0.12.0 now since it was released recently, and includes the commit to which we were previously pinned.

[mtwo]

Thanks @sjkaris, sounds like we’re good then!

@rghetia FYI, you may want to pin to 0.12.0

[rghetia]

ok.

[rghetia]

after #1118 it doesn't depend on thrift anymore.