Need legal review, licenses compatibility of third party dependencies with the OpenTelemetry license

[marcalff]

Context

In the opentelemetry-cpp repository, all the code is covered by the Apache-2.0 License.

For a new feature, to implement the yaml file configuration as defined in the opentelemetry-configuration repository, we need ... a YAML parser in C++.

Not many parsers are available in the C++ world, and after evaluating several, the library that meets our technical requirements is rapidyaml.

This parser, rapidyaml, is covered by the MIT License.

This raises the question whether the MIT and Apache-2.0 licenses are compatible, and can be used in the same product (the OpenTelemetry-cpp library).

Request

Disclaimer: I am not a layer.

Hence, we need some legal advice, to clarify if using:

• code covered by the Apache-2.0 License
• code covered by the MIT License
  in the same project, is valid and complies with both licenses.

Furthermore, it would be very desirable to document a list of licenses that are pre-approved to be used with Apache-2.0 and OpenTelemetry, to provide early guidance to maintainers.

This will help every SIG, when evaluating candidate third party dependencies, to make sure these dependencies not only meet technical requirements but also legal requirements.

Thanks for your help.

cc @open-telemetry/cpp-maintainers @open-telemetry/configuration-maintainers @svrnm

[lalitb]

According to the CNCF policy outlined here, it appears that the MIT license is included in the approved set of licenses for third-party components.
disclaimer - I am not a legal expert on licensing or copyright matters :)

[marcalff]

Thanks @lalitb , this is exactly what I was looking for.

[trask]

@marcalff does this address your issue? thanks!

[marcalff]

Yes, and closing this issue then.