I’m Stéphane Graber, former LXD engineering manager at Canonical and one of the maintainers of the Incus fork of LXD.
Through the latter, I’m the owner of several significant pieces of LXD code (that was imported from Incus) which I contributed under the Apache2 license. I never signed the Canonical CLA or any similar document allowing Canonical to re-license my code to AGPLv3.
However it seems that following the LXD 5.20 announcement, the decision was made to mark the lxd snap package as being under the AGPLv3 license.
This is factually incorrect as it contains a fair amount of Apache2 code.
Please have the license correctly amended to whatever is appropriate, likely some combination of Apache2 and AGPLv3 with SPDX data for each chunk of code in the codebase which remains under Apache2.
I’d also like to point out that other than the issue with the lxd part itself, there is also the fact that this snap bundles a variety of other projects, including their binaries:
criu => GPLv2
dqlite => LGPLv3
seabios => LGPLv3
edk2 => BSD
libmnl => LGPLv2
libnftnl => GPLv2
libseccomp => LGPLv2.1
libtmps => custom
liburing => LGPLv2.1
libusb => LGPLv2.1
minio => AGPLv3
nasm => BSD
nftables => GPLv2
libnvidia-container => GPLv3
ovs => Apache2
ovn => Apache2
spice => LGPLv2.1
swtpm => BSD
qemu => LGPLv2.1
raft => LGPLv3
sqlite => custom
squashfstools-ng => GPLv3+ / LGPLv3
virtiofsd => APACHE / BSD
zfs => CDDL
lxc => GPL2 (binaries) and LGPL2.1 (library)
lxcfs => LGPL-2.1+
Of those, I have significant contributions in at least lxc, lxcfs and libnvidia-container so would appreciate that those be properly covered in this package’s licensing information.
