OTel .NET AutoInstrumentation - MySql.Data license dependency verification

[Kielek]

OpenTelemetry .NET Automatic Instrumentation provides instrumentation functionality to MySql.Data nuget package.

The production code does not contain any reference to MySql.Data nor /MySql.Data.OpenTelemetry. It is listening only on events/activities created by MySql.Data. It is handled by this substription.

MySql.Data library is referenced only in the testing applications.

Nuget packages are marked as License GPL-2.0-only license licenseWITH license licenseUniversal-FOSS-exception-1.0 license.

We have a request to validate if it is fine to keep such dependency in our code, what are the implications of this?

[trask]

hi @Kielek! I can't find an answer about test dependencies in https://github.com/cncf/foundation. We have examples similar to this in Java instrumentation as well. I'll open a CNCF Service Desk legal ticket to ask for clarification.

[trask]

oh sorry @danielgblanco I missed that you self-assigned this

[danielgblanco]

Yeah, we triaged this yesterday and I said I will open a Service Desk ticket for this. Will do now :)

[danielgblanco]

This is being looked at, to see if a license exception request is needed in this case.

[trask]

In the Java repositories we currently only run license scanning against published artifacts and their dependencies. Running license scanning against the build and test infrastructure doesn't make sense to me (but IANAL), e.g. the JDK itself is GNU General Public License, version 2, with the Classpath Exception.

[danielgblanco]

I will ping CNCF on this to see what the status is.

[trask]

I found this, which is almost on point https://github.com/cncf/foundation/blob/main/recommendations-for-attribution.md#scope-and-nature-of-dependencies

For use case 4, because the CNCF project is not distributing build and test tooling as described above, notice and attribution requirements typically will not apply.

Update: I posted this to the cncf service desk ticket to see if it helps move things along at all...

[danielgblanco]

I've pinged the Service Desk ticket again. Still awaiting response.