Apache SkyWalking – License

Blog: [License Issue] Aliyun(阿里云)'s trace analysis service copied SkyWalking's trace profiling page.

Tue, 03 Jan 2023 00:00:00 +0000

Apache SkyWalking is an open-source APM for a distributed system, Apache Software Foundation top-level project.

On Jan. 3rd, 2023, we received reports about Aliyun Trace Analysis Service. It provides a cloud service compatible with SkyWalking trace APIs and agents.

On their product page, there is a best-practice document describing about their service is not SkyWalking OAP, but can work with SkyWalking agents to support SkyWalking’s In-Process(Trace) Profiling.

BUT, they copied the whole page of SkyWalking’s profiling UI, including page layout, words, and profiling task setup. The only difference is the color schemes.

SkyWalking UI

Aliyun Trace Analysis UI on their document page

The UI visualization is a part of the copyright. Aliyun declared their backend is NOT a re-distribution of SkyWalking repeatedly on their website, and they never mentioned this page is actually copied from upstream.

This is a LICENSE issue, violating SkyWalking’s copyright and Apache 2.0 License. They don’t respect Apache Software Foundation and Apache SkyWalking’s IP and Branding.

Blog: [Resolved][License Issue] Volcengine Inc.(火山引擎) violates the Apache 2.0 License when using SkyWalking.

Fri, 28 Jan 2022 00:00:00 +0000

Apache SkyWalking is an open-source APM for a distributed system, Apache Software Foundation top-level project.

On Jan. 28th, we received a License violation report from one of the committers (anonymously). They have a cloud service called Application Performance Monitoring - Distributed Tracing (应用性能监控全链路版). At the Java service monitoring section, it provides this agent download link

wget https://datarangers.com.cn/apminsight/repo/v2/download/java-agent/apminsight-java-agent_latest.tar.gz

We downloaded it at 23:15 Jan. 28th UTC+8(Beijing), and archived it at here

We have confirmed this is a distribution of SkyWalking Java agent.

We listed several pieces of evidence to prove this here, every reader could compare with the official SkyWalking source codes

The first and the easiest one is agent.config file, which is using the same config keys, and the same config format.

This is the Volcengine’s version, and check SkyWalking agent.config

In the apmplus-agent.jar, Volcengine’s agent core jar, you could easily find several core classes exactly as same as SkyWalking’s.

The ComponentsDefine class is unchanged, even with component ID and name. This is Volcengine’s version, and check SkyWalking’s version

The whole code names, package names, and hierarchy structure are all as same as SkyWalking 6.x version.

This is the Volcengine package hierarchy structure, and check the SkyWalking’s version

Volcengine Inc.’s team changed all package names, removed the Apache Software Foundation’s header, and don’t keep Apache Software Foundation and Apache SkyWalking’s LICENSE and NOTICE file in their redistribution.

Also, we can’t find anything on their website to declare they are distributing SkyWalking.

All above have proved they are violating the Apache 2.0 License, and don’t respect Apache Software Foundation and Apache SkyWalking’s IP and Branding.

We have contacted their legal team, and wait for their official response.

Resolution

On Jan. 30th night, UTC+8, 2022. We received a response from Volcengine’s APMPlus team. They admitted their violation behaviors, and made the following changes.

Volcengine’s APMPlus service page was updated on January 30th and stated that the agent is a fork version(re-distribution) of Apache SkyWalking agent. Below is the screenshot of Volcengine’s APMPlus product page.

Volcengine’s APMPlus agent distributions were also updated and include SkyWalking’s License and NOTICE now. Below is the screenshot of Volcengine’s APMPlus latest agent, you could download from the product page. We keep a copy of their Jan. 30th 2022 at here.

Volcengine’s APMPlus team had restored all license headers of SkyWalking in the agent, and the modifications of the project files are also listed in “SkyWalking-NOTICE”, which you could download from the product page.

We have updated the status to the PMC mail list. This license violation issue has been resolved for now.

Appendix

Inquiries of committers

Q: I hope Volcengine Inc. can give a reason for this license issue, not just an afterthought PR. This will not only let us know where the issue is but also avoid similar problems in the future.

A(apmplus apmplus@volcengine.com):

The developers neglected this repository during submitting compliance
assessment.
Currently, APMPlus team had introduced advanced tools provided by the
company for compliance assessment, and we also strengthened training for
our developers.
In the future, the compliance assessment process will be further improved
from tool assessment and manual assessment.

Blog: OpenSearch, a new storage option to avoid ElasticSearch's SSPL

Sun, 09 May 2021 00:00:00 +0000

We posted our Response to Elastic 2021 License Change blog 4 months ago. It doesn’t have a big impact in the short term, but because of the incompatibility between SSPL and Apache 2.0, we lost the chance of upgrading the storage server, which concerns the community and our users. So, we have to keep looking for a new option as a replacement.

There was an open source project, Open Distro for Elasticsearch, maintained by the AWS team. It is an Apache 2.0-licensed distribution of Elasticsearch enhanced with enterprise security, alerting, SQL, and more. After Elastic relicensed its projects, we talked with their team, and they have an agenda to take over the community leadship and keep maintaining Elasticsearch, as it was licensed by Apache 2.0. So, they are good to fork and continue.

On April 12th, 2021, AWS announced the new project, OpenSearch, driven by the community, which is initialized from people of AWS, Red Hat, SAP, Capital One, and Logz.io. Read this Introducing OpenSearch blog for more detail.

Once we had this news in public, we begin to plan the process of evaluating and testing OpenSearch as SkyWalking’s storage option. Read our issue.

Today, we are glad to ANNOUNCE, OpenSearch could replace ElastcSearch as the storage, and it is still licensed under Apache 2.0.

This has been merged in the main stream, and you can find it in the dev doc already.

OpenSearch

OpenSearch storage shares the same configurations as Elasticsearch 7. In order to activate Elasticsearch 7 as storage, set storage provider to elasticsearch7. Please download the apache-skywalking-bin-es7.tar.gz if you want to use OpenSearch as storage.

SkyWalking community will keep our eyes on the OpenSearch project, and look forward to their first GA release.

NOTE: we have to add a warning NOTICE to the Elasticsearch storage doc:

NOTICE: Elastic announced through their blog that Elasticsearch will be moving over to a Server Side Public License (SSPL), which is incompatible with Apache License 2.0. This license change is effective from Elasticsearch version 7.11. So please choose the suitable Elasticsearch version according to your usage.

Blog: [Resolved][License Issue] Tencent Cloud TSW service violates the Apache 2.0 License when using SkyWalking.

Fri, 22 Jan 2021 00:00:00 +0000

Apache SkyWalking is an open source APM for distributed system, Apache Software Foundation top-level project.

At Jan. 11th, 2021, we noticed the Tencent Cloud Service, Tencent Service Watcher - TSW, for first time. Due to the similar short name, which SkyWalking is also called SW in the community, we connected with the service team of Tencent Cloud, and kindly asked.

They used to replay, TSW is purely developed by Tencent team itself, which doesn’t have any code dependency on SkyWalking.. We didn’t push harder.

But one week later, Jan 18th, 2021, our V.P., Sheng got the report again from Haoyang SkyWalking PMC member, through WeChat DM(direct message),. He provided complete evidence to prove TSW actually re-distributed the SkyWalking’s Java agent. We keep one copy of their agent’s distribution(at Jan. 18th), you could be downloaded here.

Some typically evidences are here

ServiceManager is copied and package-name changed in the TSW’s agent.
ContextManager is copied and ackage-name changed in the TSW’s agent.

At the same time, we checked their tsw-client-package.zip, it didn’t include the SkyWalking’s LICENSE and NOTICE. Also, they didn’t mention TSW agent is the re-ditribution SkyWalking on their website.

With all above information, we had enough reason to believe, from the tech perspective, they were violating the Apache 2.0 License.

From the 18th Jan., 2021, we sent mail [Apache 2.0 License Violation] Tencent Cloud TSW service doesn't follow the Apache 2.0 License to brief the SkyWalking PMC, and took the following actions to connect with Tencent.

Made direct call to Tencent Open Source Office.
Connected with Tencent Cloud TVP program committee, as Sheng Wu(Our VP) is a Tencent Cloud TVP.
Talked with the Tencent Cloud team lead.

In all above channels, we provided the evidences of copy-redistribution hebaviors, requested them to revaluate their statements on the website, and follow the License’s requirements.

Resolution

At Jan. 19th night, UTC+8, 2021. We received response from the Tencent cloud team. They admited their violation behaviors, and did following changes

Tencent Cloud TSW service page states, the agent is the fork version(re-distribution) of Apache SkyWalking agent.
TSW agent distributions include the SkyWalking’s License and NOTICE. Below is the screenshot, you could download from their product page. We keep a copy of their Jan. 19th 2021 at here.

We have updated the status to the PMC mail list. This license violation issue has been resolved for now.

The SkyWalking community and program management committee will keep our eyes on Tencent TSW.

Blog: Response to Elastic 2021 License Change

Sun, 17 Jan 2021 00:00:00 +0000

Elastic announced their license change, Upcoming licensing changes to Elasticsearch and Kibana.

We are moving our Apache 2.0-licensed source code in Elasticsearch and Kibana to be dual licensed under Server Side Public License (SSPL) and the Elastic License, giving users the choice of which license to apply. This license change ensures our community and customers have free and open access to use, modify, redistribute, and collaborate on the code. It also protects our continued investment in developing products that we distribute for free and in the open by restricting cloud service providers from offering Elasticsearch and Kibana as a service without contributing back. This will apply to all maintained branches of these two products and will take place before our upcoming 7.11 release. Our releases will continue to be under the Elastic License as they have been for the last three years.

Also, they provide the FAQ page for more information about the impact for the users, developers, and vendors.

In the perspective of Apache Software Foundation, SSPL has been confirmed as a Catalog X LICENSE(https://www.apache.org/legal/resolved.html#category-x), which means hard-dependency as a part of the core is not allowed. With that, we can’t only focus on it anymore. We need to consider other storage options. Right now, we still have InfluxDB, TiDB, H2 server still in Apache 2.0 licensed. Right now, we still have InfluxDB, TiDB, H2 server as storage options still in Apache 2.0 licensed.

As one optional plugin, we need to focus on the client driver license. Right now, we are only using ElasticSearch 7.5.0 and 6.3.2 drivers, which are both Apache 2.0 licensed. So, we are safe. For further upgrade, here is their announcement. They answer these typical cases in the FAQ page.

I build a SaaS application using Elasticsearch as the backend, how does this affect me?

This source code license change should not affect you - you can use our default distribution or develop applications on top of it for free, under the Elastic License. This source-available license does not contain any copyleft provisions and the default functionality is free of charge. For a specific example, you can see our response to a question around this at Magento.

Our users still could use, redistribute, sale the products/services, based on SkyWalking, even they are using self hosting Elastic Search unmodified server.

I’m using Elasticsearch via APIs, how does this change affect me?

This change does not affect how you use client libraries to access Elasticsearch. Our client libraries remain licensed under Apache 2.0, with the exception of our Java High Level Rest Client (Java HLRC). The Java HLRC has dependencies on the core of Elasticsearch, and as a result this client library will be licensed under the Elastic License. Over time, we will eliminate this dependency and move the Java HLRC to be licensed under Apache 2.0. Until that time, for the avoidance of doubt, we do not consider using the Java HLRC as a client library in development of an application or library used to access Elasticsearch to constitute a derivative work under the Elastic License, and this will not have any impact on how you license the source code of your application using this client library or how you distribute it.

The client driver license incompatible issue will exist, we can’t upgrade the driver(s) until they release the Apache 2.0 licensed driver jars. But users are still safe to upgrade the drivers by themselves.

Apache SkyWalking will discuss the further actions here. If you have any question, welcome to ask. In the later 2021, we will begin to invest the posibility of creating SkyWalking’s observability database implementation.