Revert commit that removed Russian providers by JustMarfix · Pull Request #824 · opentofu/registry

2 min read Original article ↗

Explanation

Yesterday, pull request #817 was successfully approved and merged into the main branch. As part of this pull request, all providers affiliated with or based in Russia were removed from the project's repository.

To explain this change, @cam72cam provided two links: README.md and TSC_SUMMARY.md.

Additionally, as part of the discussion in issue #823, @DicsyDel provided information that "it was deemed appropriate to block access from certain territories to avoid any legal issues", citing sanctions on a Russian legal entity.

Why this decision is absolutely wrong and the arguments in its favor do not confirm its correctness

  1. README.md, as well as TSC_SUMMARY.md, mention only the restriction on access from Russian IPs to the registry, but not the removal of Russian-related providers from the registry.
  2. Here, the U.S. Treasury Office of Foreign Assets Control explains how the restriction on the provision of information technology to Russia should be interpreted. The presence of files from Russian providers in the registry clearly does not fall under these interpretation.
  3. Here, the U.S. Treasury Office of Foreign Assets Control explains the nuances of providing information technology to companies affiliated with Russian companies. In particular, Yandex LLC, whose provider was removed from the register, has a subsidiary in Kazakhstan that uses the same provider, which makes it absolutely wrong to exclude the Yandex LLC provider from the register due to US sanctions.

What should be done

The restriction on access to the registry from Russian IP addresses is absolutely justified by the need to comply with US sanctions. However, the removal of Russian-linked providers has nothing to do with compliance with sanctions, which I explained above.

Therefore, these providers should be returned to the registry. I kindly ask you not to close this PR without a full explanation of the reason for such deletion, as well as an answer to my counterarguments. After all, this is an open source, and the community would like to get a good explanation of what happened.