tegioz
commented
1 year ago Hi @caniszczyk
We've been discussing this a few times and we have some concerns about how this might work or if it could be misleading for users.
Open source filter
AH already allows publishers to provide the license under which their content is published. There is a filter on the packages search page (on the left side column) to filter by license and, when available, it's displayed on the package's view.
However, one of the problems we see with it as it is, and that we could make a bit worse with an open source filter, is that often there is more software behind the artifact itself that may have different licensing terms. Let's take the MongoDB chart below as an example:
This chart is provided by Bitnami and released under the Apache 2 license. But the chart in this case is a means to easily install on K8S the underlying product, MongoDB, which has a completely different license. IMHO listing this package as Apache-2 or open source could be misleading to some users. Bitnami does a good job explaining this on the package's README file (see screenshot below), but it could be easily overlooked and other publishers may not include a similar disclaimer.
This is something very common in Helm charts, which can install software from multiple vendors with different licenses. So categorizing them as open source can be tricky.
In addition to this, at the moment less than 10% of the content listed on artifacthub.io provides a license. Most of the time the artifacts are actually using an open source license, but it's not included in the artifact itself, so it's hard to identify it properly. This happens often in Helm charts, where publishers do not include the LICENSE file in the chart. The MongoDB chart mentioned above is actually an example of this.
CNCF project filter
If we were handling this at the package level, what would it mean for a package to match this filter? Should it be "related" to a CNCF project? Published directly by the project itself? In AH, all content with the exception of the official status is provided directly by the publishers, with no manual curation at all. Orgs/users can list their repositories from the control panel and they'll be automatically processed and listed. So at the package level, this new status would need to be provided by the publisher as well, with the risk of not being included when it should (like the license case above), or included when it shouldn't if the criteria wasn't clear.
Another option would be to handle this at the repository kind level. At the moment most of the supported kinds (except Tekton and Container images IIRC) are artifacts from CNCF projects, so filtering by this criteria could be of limited use right now but maybe handy in the future.
caniszczyk
I'd like to see a couple new filtering options:
1) if it's a CNCF project or not 2) if it's open source