tracking existing PR for vault

[jmls]

First - Great news regarding the announcement of this project. Will be switching to this as soon as possible.

There is a PR on vault that would make a great addition to openbao (hashicorp/vault-plugin-auth-jwt#131) and I was wondering in general what the process should be to see if openbao could get the author to create the same PR for openbao

In fact, there may be other open PR's (or PR's merged since the 1.14 release ) that may be useful ...

[joewxboy]

Greetings and welcome @jmls . Looks like we need to get a CONTRIBUTING.md file posted. :)

In the meantime and while we're incubating under Open Horizon, we can start with their guidelines:
https://github.com/open-horizon/.github/blob/master/CONTRIBUTING.md

One additional caution or caveat ... we need to ensure that any contributions here are not copied from code contributed to Hashicorp Vault's BSL-licensed code. For Vault plug-in authors wishing to also contribute here, we'll want to consult with legal counsel to ensure we're not running afoul of any legislation. I'm assuming that their MPL-licensed code can also be contributed here, but I'll confirm.

[joewxboy]

And if you haven't seen it, the project FAQ we're slowly compiling is at https://wiki.lfedge.org/display/OH/OpenBao+%28Hashicorp+Vault+Fork+effort%29+FAQ

[drawks]

IANAL, but... any open PRs that are based on code that predates the license change implicitly adopt the license of the target code and are considered a derivative work based on the current github terms of service which have been in place since at least 2017.

So, it /should/ generally be possible to programmatically determine which PRs (also issues and other "user generated content"), merged or not, predate the adoption of BSL via merge on Aug 11 2023 @01:14 UTC and use the content of those PRs within the terms of the MPLv2 which they would be implicitly licensed as.

[drawks]

It should also be noted that would include PRs and issues opened by contributors who have not agreed/signed the CLA which hashicorp requires before accepting contributions. The CLA language references "present and future" contributions which probably requires some legal analysis to interpret more specifically, but I would presume that it is probably safest to consider all contributions predating the license change to be covered by the CLA.

TLDR; predated contributions are MPLv2 and probably also have yielded copywrite and patent license to hashicorp.

[adrien-f]

Greetings !

It's been nearly two years that I maintain this PR: hashicorp/vault#16580

If I wanted to also bring it to OpenBao, would that be possible? How would you think that could fit with the legal discussion happening?

[cipherboy]

@adrien-f Do note we ended up splitting out external plugins; see #64 for rationale and #134 for our request for maintainers. We've not yet had anyone step forward for the AWS engines yet

[joewxboy]

I'm not a lawyer, but my impression is that if this is your code, and it has not been merged into Hashicorp's codebase, and you are willing to contribute it here with the MPL v2 license, then go ahead. Just make sure that you've read and agreed to the DCO, and that you signoff on all commits (-s flag). If this is part of your official duties at a company, ensure that they have a signed CLA with the Linux Foundation.

[joewxboy]

@adrien-f ^^^

[DrDaveD]

The vault PR at the top of this discussion is mine, and I just discovered openbao and plan to contribute it here also.

[cipherboy]

Perfect, thank you @DrDaveD! Happy to have you :-)

[DrDaveD]

Now submitted as openbao/openbao-plugin-auth-jwt#2

[DrDaveD]

That was the wrong place. It is now resubmitted as #319.