MinIO was frozen last year as a result of a unilateral relicense
to AGPL, where some external contributors complained[0] about the
legality of the relicense done by MinIO Incorporated, as well as
doubts from the Alpine license review community about the motives
of MinIO Incorporated with regards to the license change[1].
When MinIO was frozen, we were expecting the community to respond
with a fork that retained the old license, which appears to not have
happened a year later (instead users appear to have just switched
to other packages, such as Ceph, for their object storage needs),
but MinIO itself still does not have default behaviour that complies
with the AGPL section 13 requirements.
MinIO Incorporated's position on AGPL compliance concerns is that
"MinIO Commercial Licensing is the best option for applications
that trigger AGPLv3 obligations,"[2] which, when combined with default
behaviour that is not compliant with AGPL section 13[3], seems to act
as a compliance trap, in other words the AGPL is being abused by
MinIO Incorporated as a tool to extract revenue from its users,
through the threat of possible litigation. This is not an acceptable
legal risk for the Alpine community, as Alpine offers its packages
to any entity to use for any purpose under the OSI/FSF guidelines.
Accordingly, minio remains frozen, as we cannot ship the AGPL version
due to the problems with the package offering no mechanism to actually
comply with AGPL section 13, but the package itself has to be removed
due to having unpatchable CVEs.
Fixes (for some definition of "fix") #13229.
[0]: https://github.com/minio/minio/issues/12143
[1]: https://github.com/minio/minio/issues/12142
[2]: https://github.com/minio/minio/blob/master/COMPLIANCE.md
[3]: https://github.com/minio/minio/discussions/12156
2f3cbd59cf