The Business Source License explained.

The Business Source License, usually shortened to BSL, became a household name in infrastructure teams when HashiCorp adopted it. As of August 2023, HashiCorp moved Terraform, Vault, Consul, Nomad, and Packer from an open source license to the Business Source License 1.1. The community responded by forking Terraform into OpenTofu. To understand why a license change prompted a fork, you have to understand what the BSL actually does, because it is neither the open source license teams assumed they had nor the fully closed product they fear.

What is the Business Source License?

The Business Source License is a source available license. You can read the code, copy it, modify it, and redistribute it. What you cannot do, during the license term, is use it in a production way that the licensor has chosen to restrict. That restriction is the heart of the license and the reason it is not open source. The Open Source Initiative does not approve the Business Source License precisely because it limits the field of use. Source available means the source is visible. It does not mean you are free to use it for any purpose.

The license was designed to give a company a way to publish source while protecting its commercial model. The bargain it offers users is time. After a defined period, the restricted version becomes openly licensed. Whether that bargain works for you depends entirely on which version you depend on and what you do with it.

The additional use grant: where the real terms live

The Business Source License is a template, not a fixed set of rules. The critical clause is the additional use grant, where the licensor states what production use is permitted despite the general restriction. For HashiCorp, the grant broadly permits production use except where you provide a competitive offering to HashiCorp. That single clause is what most enterprise users actually need to read, because it decides whether your specific use is allowed. Two companies running the same software can land on opposite sides of the line depending on what they build with it.

Because the grant varies by project and can change between releases, you cannot assume the BSL means the same thing everywhere. The license name tells you the structure. The additional use grant tells you the rule. Whether your use falls inside or outside that grant is a question for your own counsel, and it deserves a careful reading rather than a quick assumption.

The change date and the conversion to open

Every Business Source License release carries a change date, commonly four years after that release. On the change date, that specific version converts to the open license named in the text, often an established permissive or copyleft license. This is the feature that lets the BSL describe itself as eventually open. The important detail is that only the specific version converts on its own schedule. Each newer release resets the clock with its own later change date. Staying on converted, freely licensed code therefore means staying on older software, with the security and feature tradeoffs that implies. The conversion is real, but it is not a free pass to run the latest release.

Why the Business Source License creates enterprise exposure

The exposure is rarely about the obvious case. Few enterprises set out to compete with HashiCorp. The risk is subtler. A product team may embed a BSL component in an offering in a way that edges toward the restricted use. A managed service built on top of the software may cross the competitive line without anyone framing it that way. And because the component sits in a dependency tree, the people who chose it are often not the people who decided how the product is sold. The license restriction and the commercial reality drift apart, and the gap is the exposure. Mapping where BSL components sit, and how each is used, is how you find that gap before a vendor does.

What to do about a BSL component

There are four broad paths. You can confirm your use sits safely inside the additional use grant and document why. You can move to a community fork such as OpenTofu, which carries an open license. You can stay on a version after its change date, accepting older code in exchange for open terms. Or you can negotiate a commercial license that matches your actual usage. The right path depends on how central the component is, how close your use sits to the restriction, and what migration would cost. None of these is automatically correct, which is why the decision starts with a clear map rather than a default.

From understanding the license to containing the risk

Understanding the Business Source License is the groundwork for our relicensing exposure review. For the full picture of the relicensing wave, read our pillar on open source relicensing. To see how the BSL plays out in a specific stack, read Consul, Nomad and Packer under the BSL and notice and effective dates in a relicense. To compare it with the other restrictive licenses, see the Business Source License, the Server Side Public License, and the GNU AGPL compared.