VC backed database company with a CLA on their "open source" project. Red flag.
Is there a community fork yet?
TiDB is Apache licensed, that should be enough no? Because if we ban all projects from VC-backed startups, you're going to clear your tech stack pretty quickly.
I'm afraid that they can always do that with or without a CLA. Apache is quite a permissive license.
So if I make a contribution under some very restrictive license, but sign a CLA allowing relicensing, all bets for the future are off.
Therefore, it doesn't make a difference to have a CLA or not. What you trying to avoid is already allowed as per the license.
However, some CLAs require you to declare the originality and ownership of your contributions. Maybe that's why they require a CLA to be signed for contributions.
I think the best way would be something similar to the Linux Foundation. Companies in need of a certain type of database would pool resources to develop and maintain it.
PostgreSQL was a community developed database that was funded in something approaching this way as most of the developers were either students or worked for someone who paid them while they worked on it.
> TiDB is Apache licensed, that should be enough no?
It's good enough to use it with the knowledge that it isn't truly free (libre) because the CLA gives the owning company the right to change that at any time. So you can use it but don't build a business around it or make it a critical part of your infrastructure as they might pull the rug out from under you.
Do you have any links to the Core Storage CNCF project? I couldn't find it on the CNCF website under the Database and Cloud Native Storage sections?
It isn't copyleft, so even without a CLA, they could make a proprietary or open core version of the product, as can anyone else.
Disclaimer: I currently work at PingCAP and previously worked at the Linux Foundation.
Foundation (whether it's the LF or others) isn't a panacea either. It's fine when projects get started and there are plenty of willing member companies, but for many projects, companies often lose interest, need to cut down on open source related investments, etc. and the project funding dwindles. The reality is that the member companies need to both fund and provide software developers for projects, and it's difficult to expect them to keep the same commitment for more than a few years these days....
A popular more lightweight solution is the DCO[0].
A side aspect of this is that they also destroy any motivation for developing free software other than as a marketing tool, a way to drive growth. While that is perfectly fine for companies to do this, it has long term consequences that lead to bad behavior that mean you should be extra wary of relying on them.