Connect Clawsmith to your coding agent. Ship products like crazy.Unlimited usage during betaGet API Key โ†’
โ† Back to dashboard
clawsmith.com/signal/terraform-hashicorp-bsl-monorepo-scanner
โš  IssueWide Opendev_tool_cliLive

HashiCorp relicensed Terraform and its entire toolchain to BSL in August 2023, leaving large IaC monorepos with no tool to audit which files and provider references are BSL-tainted

In August 2023 HashiCorp switched Terraform, Vault, Consul, Nomad, and Packer from MPL-2.0 to Business Source License v1.1 which restricts competing commercial use. The community forked Terraform as OpenTofu under the Linux Foundation (accepted into CNCF Sandbox April 2025). The OpenTF manifesto gathered 33000 GitHub stars in under 2 weeks. 38 percent of Terraform users are evaluating migration. The binary swap itself is trivial but auditing a large monorepo is the real work: provider registry references pointing to registry.terraform.io instead of the open registry, hardcoded terraform binary calls in bash scripts and Makefiles, CI runner configs using Terraform commands, and post-fork HashiCorp provider plugins released under BSL that must be replaced. OpenTofu docs say to manually grep for these. No dedicated CLI scanner traverses a monorepo holistically for BSL-tainted IaC artifacts and generates an OpenTofu-ready migration manifest with a diff. tfmigrate handles state files only. For teams with hundreds of Terraform modules this is days of manual audit work.

Score Breakdown

HN
281

Gap Assessment

Wide OpenNo dedicated solution exists

No dedicated BSL-impact scanner exists for IaC monorepos. tfmigrate is state-file-only. OpenTofu docs prescribe manual grep. For large teams with hundreds of modules spanning CI configs, shell scripts, and provider lockfiles, no tool automates the audit and produces a migration manifest.