HashiCorp BSL: what changed and what it means.

The HashiCorp BSL change is the clearest single example of the relicensing wave reaching software that almost every infrastructure team runs. As of August 2023, HashiCorp moved Terraform, Vault, Consul, Nomad, Packer, and other products from an open source license to the Business Source License 1.1. The code stayed visible and the tools kept working, which led many teams to assume little had changed. What changed was the set of rights governing production use, and for a company that provisions infrastructure with Terraform and manages secrets with Vault, that is not a small detail.

This article explains what moved, what the Business Source License actually does, why HashiCorp chose it, and what it means for buyers in practice. For the full cluster of HashiCorp specific guidance, the pillar on HashiCorp and Terraform license risk is the hub.

What the HashiCorp BSL change actually moved

The change covered the core HashiCorp product line. Terraform for provisioning, Vault for secrets, Consul for service networking, Nomad for scheduling, and Packer for image building all moved to the Business Source License 1.1 as of August 2023. Crucially, the new license applies to new versions rather than retroactively to releases already published, so the license that governs your use depends on which versions you actually run. A deployment pinned to a pre change release keeps its old open license. The moment you take a newer release, your use of that product is governed by the Business Source License.

Terraform draws the most attention, but the companion products carry the same terms and often more concentrated risk, because Vault and Consul tend to sit deep in production. We cover the others specifically in Consul, Nomad, and Packer under the BSL.

What the Business Source License does

The Business Source License is source available, not OSI approved open source. It has two defining features. First, it restricts production use that competes with the licensor, while permitting most other use, including internal use, development, and testing. Second, it is time limited: each version carries a change date, commonly four years out, on which that version converts to a named open license. So the license is neither fully open nor fully proprietary. It is a middle position that keeps source readable and most use permitted, while reserving the competitive case and putting an expiry on the restriction.

The phrase that does the work is competitive use, and it is also the phrase that creates uncertainty, because what counts as competing with HashiCorp is not always obvious for an enterprise that simply runs the tools internally. That specific question deserves its own analysis, which we provide in is your Terraform use competitive under the BSL.

Why HashiCorp made the change

The stated reason was commercial. HashiCorp pointed to vendors that built businesses on its open source products, particularly by offering them as managed services, without contributing proportionally to their development. The Business Source License was the lever to restrict that competitive use while keeping the source open to read and most use unaffected. IBM later acquired HashiCorp, which adds a further consideration for buyers weighing long term dependence on the product line, since ownership and commercial strategy can continue to evolve. None of this is unusual in the wider relicensing wave, where commercial pressure from managed service providers was the common driver across HashiCorp, Redis, Elastic, and MongoDB.

The community response was a fork. OpenTofu emerged as an openly licensed continuation of Terraform, giving buyers a path that does not depend on the Business Source License at all. The fork is real and usable, though adopting it is a migration rather than a drop in swap.

What it means for buyers

For most enterprises the practical question is narrow: does your use fall inside the competitive restriction, and which versions do you actually run. Answering it starts with an inventory of every HashiCorp product in your estate, the versions in use, and where each sits relative to the August 2023 change. From there you can judge whether you have an active exposure, a future one tied to upgrades, or none at all. Where exposure exists, the options are familiar: migrate to OpenTofu or another tool, hold on a clean version with its security trade, or negotiate commercial terms with HashiCorp. The compliance obligations that follow from the license are set out in HashiCorp BSL compliance obligations, and the migration path is covered in migrating from Terraform to OpenTofu step by step.

The HashiCorp BSL change is significant but manageable. It is not a reason to panic, and it is not a change to ignore. It is a prompt to inventory what you run, understand where the competitive line sits for your use, and decide on a path with the facts in hand. This article is commercial and licensing risk advisory, not legal advice. For interpretation of a specific license and your compliance position, your own counsel is the right place to turn.