[jameshart]

In home-brew core.

And the reasoning is that home-brew isn't strictly a package manager, it is a dependency installer and builder - it pulls down sources and everything they depend upon (as source packages too, usually), and builds them locally. So as a user of home-brew you're trusting the formulae you install from to be for things you are allowed to pull down and build locally. Licenses matter.

Hashicorp (or anyone else) can maintain a source tap of their own - when you opt in to using a third party tap you're trusting that tap's licensing as well. And there's also 'casks' which are for non-source distributions, which home-brew can install as well, where source licensing isn't important.