Re:K6: Like unit testing, for performance
by robingustafsson on Saturday November 28, 2020 @10:17AM
(#25238019)
Agree that it's important to be aware of licensing implications of dependencies.
As I mentioned in reply to another comment, from a first look at MPLv2 it seems like it could be a good fit for k6 as well.
You said: > We chose MPLv2 specifically to address licensing concerns.
Is that something you've encountered while building Artillery? We've not met a lot of pushback from legal teams at companies using k6.
That's unfortunately not the case for AGPL. There's a reason a lot of companies have policies banning any AGPL dependencies outright, Google probably being the most prominent example: https://opensource.google/docs/using/agpl-policy
AGPL is designed to be extremely viral and has not been tested in court. The definitions of boundaries between your code and AGPL-licensed code are not well understood. Consider that MongoDB, probably the most popular AGPL-licensed project in use before 2018 when they switched to SSPL, had to explicitly publish their drivers under Apache because communicating with an AGPL dependency over a network was not sufficiently distant enough to prevent infection. https://www.mongodb.com/blog/post/the-agpl
As engineers we need to be aware of licensing implications of code we depend on. I am obviously not a lawyer, and obviously your employer's legal team are the people you should be talking to if you have an absolutely critical dependency on an AGPL-licensed project.