It went after Nutanix and now it’s going after Weka – MinIO has revoked Weka’s Apache License v2 and GNU AGPL v3 licenses to use its open source object storage software. Weka, for its part, says it doesn’t use the AGPL license and MinIO cannot revoke the Apache license which it does use.
- Update. Weka question response added. 27 March 2023.
- Update. Nutanix response added. 30 March 2023.
MinIO produces the most widely distributed open source software in the world. It is licensed for use under the terms of the Apache v2 license and the GNU AGPL v3 versions of MinIO. These require licensees to openly attribute their use of MinIO software. Weka has developed extremely high-performance scale-out and parallel Matrix file system software.
Garima Kapoor, MinIO co-founder and COO, writes in a blog that Weka is: “Distributing the entire MinIO binary in their product, without attribution, to implement their object storage functionality. Weka’s violations include the server, the client and even the WARP benchmarking tool. Confusingly, Weka’s advertising claims its unacknowledged redistribution of MinIO software is somehow faster than MinIO.
“As a result of the open source license violations, MinIO revokes Weka’s license to any and all MinIO software, effective immediately. … We are exercising our right to terminate and revoke any license or sublicense under Apache License v2 and the GNU AGPL v3 in accordance with the terms of those licenses.”
For Weka customers, a warning: “Weka may not be providing you sufficient IP protection or indemnification. MinIO recommends uninstalling Weka entirely from your infrastructure.”
Kapoor’s blog includes instructions showing how it believes Weka is using its software, complete with screenshots. “The Minio binary is located under container-s3-weka-release. …. You can now visit the link at http://64.71.151.66:9000 and interact with MinIO using the object browser.”
Comment
MinIO, Nutanix and Weka are all fine and excellent companies. On the face of it, this is a minor infraction that can be put right quickly and and amicably. But there are aspects of this that we don’t understand: why would companies such as MinIO, Nutanix and Weka argue, especially in public, over simple and trivial attribution issues?
In May 2021 MinIO, until then using the Apache v2 open source license, announced AGPL license adoption: “With RELEASE.2021-05-11T23-27-41Z MinIO has completed its transition to the GNU Affero General Public License v3.0 (GNU AGPL v3) license, meaning that the server, client and gateway will also be licensed under GNU AGPL v3. … Despite the presence of some Apache License 2.0 code, the license for the MinIO server, gateway and client is now AGPL v3.”
The code transition began in October 2019 and is now complete. The client SDKs remain under Apache v2. MinIO says the GNU AGPL v3 is designed for developers who are building open source applications in compliance with the GNU AGPL v3 license and are able to support themselves. A MinIO FAQ says it offers a commercial license, in two flavors – standard and enterprise – as well as AGPL licensing.
The AGPL ensures that open-source-developed code stays openly available and prevents others from repackaging and selling open source software. Minio says: “If you distribute, host or create derivative works of the MinIO software over the network, the GNU AGPL v3 license requires that you also distribute the complete, corresponding source code of the combined work under the same GNU AGPL v3 license.” In effect this means if you combine the MinIO software with other software, and then use it as a product or hosted software service, then you must provide the source code of the entire combined software. That would mean that Nutanix Objects would effectively become open sourced.
We could well see how Nutanix, and Weka, would object to that. In that case the dispute between MinIO and Nutanix/Weka is about distributing their source code if it includes MinIO software, and not simply about attributing MinIO code use.
But Reddit user Variant posted: “MinIO is leveraging their switch to the AGPL license as a vehicle to extract immense seven figure plus licensing agreements from ‘big’ companies who relied on non-AGPL versions of the code in the past.”
Reddit user throwauua posted in July 2022: “In 2019: Minio Sales contacted Nutanix (like this user mentioned) hoping for a nice big cheque.
- 2019–2021: Nutanix cites Apache-2 license and refused to pay.
- 2021: Minio changed its license to AGPL (probably few others like Nutanix).
- 2021: Nutanix knows this and refuses to use AGPL version with their product.
- 2022: Discussion went on for another year and nothing came out from Nutanix.
- Now: Minio decided to publicly shame the company.”
There is nothing in MinIO’s public AGPL statements or Nutanix’s responses that mention either charging for MinIO software use or distributing the entire source code for Nutanix products that include MinIO code. We have asked MinIO, Nutanix and Weka about both points.
MinIO CMO Jonathan Symons said: ” We think the blog post has everything we wanted to say here.” In other words we choose not to answer your questions.
A Nutanix spokesperson told us: “We have been transparent about the small amount of MinIO open source usage for a small set of ancillary functionality in our Objects solution under the Apache license, and believe MinIO’s claims against this limited use were misleading. Furthermore, on November 2nd, 2022, we released version 3.6 of Nutanix Objects, which completely removed all such use of open source MinIO components without impact to the functionality of our industry-recognized solution.” Take that MinIO
Weka’s reply is below.
Weka’s response
Nilesh Patel, chief product officer at Weka, told me: “Weka’s software only uses MinIO open source software licensed under Apache 2.0. All code forked by Weka was derived exclusively from Apache 2.0 licensed code – no MinIO code subject to the AGPL v3 license is being used in Weka’s software.”
He emphasized that “MinIO’s allegations that Weka is out of compliance with the terms of its Apache 2.0 open source license are entirely baseless and false – nor does MinIO have the authority to revoke WEKA’s Apache 2.0 license. MinIO did not investigate its allegations or give Weka sufficient time to respond before publishing them publicly, in what we believe was a reckless publicity stunt and an attempt to cause harm to Weka.”
Patel asserted that “MinIO has no authority to revoke Weka’s license, which per the terms of the Apache 2.0 license, is perpetual and irrevocable.” He cites Apache license terms to back this up:
“2. Grant of Copyright License. Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare Derivative Works of, publicly display, publicly perform, sublicense, and distribute the Work and such Derivative Works in Source or Object form.”
Finally Patel says: “Our customers and partners can be assured that Weka’s Apache 2.0 licenses are valid and protected.”
A Weka spokesperson told me: “Unlike the Nutanix situation, we had not previously been in conversation with MinIO. Their blog post was published on Friday COB Pacific Time – before they made direct contact with us.”
Comment
If MinIO want to discourage software developers from including its code in their products it is managing this very well.
