Hi, FWIW, I have been maintaining vagrant in Debian for several years. Thank you for raising this as I have been too lazy to push this discussion. I am copying the Debian Ruby team plus all the people that I could find listed as maintainer or uploader of vagrant related packages (mostly plugins, vagrant-*, but also other related packages) so that they are aware. TL;DR: I will not be maintaining vagrant anymore. On Fri, Aug 18, 2023 at 02:56:28PM +0900, Kentaro HAYASHI wrote: > Package: vagrant > Version: 2.3.4+dfsg-1 > Severity: normal > X-Debbugs-Cc: kenhys@xdump.org > > Dear Maintainer, > > * What led up to the situation? > > HashiCorp adopts the BSL. > > https://ir.hashicorp.com/news-releases/news-release-details/hashicorp-adopts- > business-source-license-future-releases-its This is the second time a package to which I dedicated extensive amount of my time is made effectively non-free by its corporate upstream. The first time was with Chef: while the license itself was not changed, they started imposing trademark-related requirements that would impose a large amount of busywork to keep something that looks like Chef (Cinc, their "community" fork) in Debian. I decided to just give up, and moved on to using something else. https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=959981 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=963750 This is now my second time with this, and this time HashiCorp actually made new versions of vagrant non-free. I have used Chef Inc and HashiCorp stuff for free for several years, but I also put in a large amount of work to make their tools available trivially to Debian users by taking care of those packages in the Debian archive. Both Chef Inc and HashiCorp care a lot about having people that use Debian consuming their products, so much so that they provide binary packages for Debian. But they don't care at all about the time of downstream maintainers, and why would they? They are private companies trying to maximize their profit at the expense of whoever is in their way. In this case, HashiCorp is apparently trying to counter other companies who are selling solutions based on their tools that compete with them, they have no incentive to care about the time of a few individuals. I don't see this change as a particularly evil move, but it effectively destroys my motivation to continue working on it. > Currently, vagrant 2.3.4+dfsg-1 was packaged in debian. > > * What exactly did you do (or not do) that was effective (or > ineffective)? > > Should we keep non-BSL licenced version (A) or drop it (B)? > > * What was the outcome of this action? > > Plan A. > > - Update to 2.3.7 and hold it. (2.3.7 is the last non-BSL licenced > version) > - Follow a newer version only when BSL limitation expired (4 years). > - As a result, we can't use newer feature in timely manner if you stick > on packaged vagrant in Debian. I had already looked into this, even before the relicensing being announced, and it turns out that vagrant 2.3.7 has a few extra dependencies that would need to be packaged too (something like 3 or 4 NEW packages), and I wasn't ready to put the necessary work in yet. After the news came out, I gave up on doing it entirely, since after this vagrant would be a dead end. > Plan B. > > - Drop vagrant because of that changed licence and no need to > keep older vagrant. > - No vagrant avaiable in Debian. Just use upstream's package. I think keeping a stale version of vagrant in the archive is worse than telling people to just use upstream packages. As far as my volunteer time is concerned, this is the most likely outcome. I have some private notes on my requirements for a vagrant replacement, and when I reach a conclusion I will most probably pursue this path and just move on. On Fri, Aug 18, 2023 at 09:37:54AM +0000, Gwili.Stifter@EasyMailer.live wrote: > Source: vagrant > Followup-For: Bug #1049999 > > Plan C. > > - Move BSL-licenced versions of vagrant into debian's non-free section. I will not maintain any packages in non-free. Hopefully, being burned a second time will teach me to not put my volunteer time in non-copyleft packages provided by a single corporation.
Attachment:
signature.asc
Description: PGP signature