Update madmin-go to version 3

[acolombier]

Upgrade madmin-go to version 3

This PR upgrade madmin-go to version 3. This required in order to allow the provider supporting more feature that Minio provide.

Reference

• See also: Add support for server-side replication  #513

[felladrin]

Thank you for updating it!

[BuJo]

Note @acolombier and @felladrin :

• Upgrade minio/aws dependencies #429 (comment)
• Update module github.com/minio/madmin-go to v3 #472 (comment)

Our current Licenses via go-licenses:

      1 AGPL-3.0
     18 Apache-2.0
      3 BSD-2-Clause
     14 BSD-3-Clause
     20 MIT
     14 MPL-2.0

[acolombier]

Hi @BuJo, I understand this causes issue as the project doesn't support AGPL just yet. Do you think this something we can work with or do you reckon we will need to downgrade this package?
Just curiosity, since I have started the implementation of replication relying on top of features added by madmin v3

[BuJo]

Hey @acolombier , I think it's problematic only on distributing the combined work. Right now the state of the source code is "ok" I think.
I'm not a lawyer, however I think that we could run afoul the AGPL license and the current copyright holder (MinIO, Inc.) if we were to distribute the result as before.

https://min.io/compliance contains a little bit of guidance:

If you distribute, host or create derivative works of the MinIO software over the network, the GNU AGPL v3 license requires that you also distribute the complete, corresponding source code of the combined work under the same GNU AGPL v3 license.

Which means, on the next release to the terraform registry, we need to handle that somehow.
Reading up a little, the LICENSE file in the repository seems to be used for that somehow?

[felladrin]

My fault, @BuJo. I wasn't paying attention to license compatibility.

Based on what you said here and in the other comment, I'd say it's ok for us to change the repo's LICENSE to some other allowed license, if it will give us a chance to use the new features from madmin-go and would solve the licensing conflicts.

Alternatively, we could downgrade madmin-go, look for a package that could replace it, publish a new provider version and unpublish (if possible) the erroneous versions from MinIO registry.

[felladrin]

unpublish (if possible) the erroneous versions from MinIO registry

Actually, now I'm thinking nothing is published to MinIO registry. The registry just lists the releases from the repositories releases.

[BuJo]

Yeah @felladrin , like I said, I think it "should" be ok. Re-licensing software is... hard without a CLA as we would need to get an agreement from all previous committers. But I hope we don't really need to re-license the current body of code, only the combined work for distribution. My brain... 🤯

How about doing it like https://softwareengineering.stackexchange.com/a/371435:

• Putting LICENSE: Apache-2.0 OR AGPL-3.0
• Adding two files: LICENSE.Apache-2.0 and LICENSE.AGPL-3.0 containing the licenses
• Adding notes to the README.md:

## License

This work is dual-licensed under Apache 2.0 and AGPL 3.0.
The source contained within this repository is Apache 2.0 licensed, however due to `mdadm` being AGPL 3.0, the combined work must be distributed as AGPL 3.0.

`SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later`

I have no idea if that satisfies all the requirements...

[felladrin]

Good point! And that solution is brilliant!
Could you open a PR with this change? Then, the discussion will be open to others' opinions.

Meanwhile, I'll publish v1.18.1, which contains the fix for empty service account policy but doesn't contain the update of madmin-go. It will be a branch of tag v1.18.0 instead of main branch.