1 |
On Wed, Sep 11, 2019 at 05:05:50PM -0700, Alec Warner wrote: |
2 |
> On Wed, Sep 11, 2019 at 4:48 PM William Hubbs <williamh@g.o> wrote: |
3 |
> |
4 |
> > On Wed, Sep 11, 2019 at 04:34:27PM -0700, Alec Warner wrote: |
5 |
> > > On Wed, Sep 11, 2019 at 10:39 AM Michael Orlitzky <mjo@g.o> |
6 |
> > wrote: |
7 |
> > > |
8 |
> > > > On 9/11/19 1:21 PM, William Hubbs wrote: |
9 |
> > > > > +++ b/dev-vcs/hub/hub-2.12.3.ebuild |
10 |
> > > > > ... |
11 |
> > > > > |
12 |
> > > > > LICENSE="MIT" |
13 |
> > > > |
14 |
> > > > This license is wrong, as it's pretty much guaranteed to be every time |
15 |
> > > > you commit one of these packages. I find it pretty troubling that one |
16 |
> > > > corporation is able to force this stuff through even though it's a |
17 |
> > > > security and legal hazard for everyone else. |
18 |
> > > > |
19 |
> > > |
20 |
> > > How is it wrong? |
21 |
> > > |
22 |
> > > https://github.com/github/hub/blob/master/LICENSE |
23 |
> > |
24 |
> > The argument is that because of the vendoring, LICENSE= needs to list |
25 |
> > all licenses for the vendored dependencies that are different from MIT |
26 |
> > as well. |
27 |
> > |
28 |
> |
29 |
> I see, I tend to believe that argument in that case. |
30 |
> |
31 |
> |
32 |
> > |
33 |
> > Personally I don't have a comment about this, but that's what is being |
34 |
> > pushed for. I'll let you guys debate this but it isn't really relevant |
35 |
> > to the eclass. ;-) |
36 |
> > |
37 |
> |
38 |
> I think it's difficult to put instructions in the eclass like: |
39 |
> |
40 |
> +# $ cd /my/clone/of/upstream |
41 |
> +# $ git checkout <release> |
42 |
> +# $ go mod vendor |
43 |
> +# $ tar cvf project-version-vendor.tar.gz vendor |
44 |
> |
45 |
> And then not mention this fairly easy trap (it's so easy to fall into you |
46 |
> did it twice.) |
47 |
|
48 |
In the case of hub, I didn't make a vendor tarball because upstream does |
49 |
the vendoring, so I don't see how these two things are related. |
50 |
|
51 |
In other words, the way I see this is a tree-wide issue. LICENSE= for |
52 |
any package should list every license for every package it links to or |
53 |
uses. |
54 |
|
55 |
William |