44 ms·

Removed gem breaks Rails ActiveStorage

265 points by ldulcic 5y ago

verdverm 5y ago
Looking through the linked comments & issues, it will be interesting to see how many people blindly adopt (forced into) GPL2 license. I wonder how big the R for spreading is? All from an XML file for mimetype info
ivanbakel 5y ago
It's interesting how many commenters on the various issues around the license change seem to think that software licensing is an inconvenience, rather than a serious legal question.
- michaelt 5y ago
  Well, when viewed from the perspective of legal realism, a lot of software licensing is a joke. I'm an open source developer - but even if Oracle had violated my license terms and I had indisputable proof of it, I wouldn't take them to court. Arguing about the differences between GPL3 and WTFPL in a hypothetical court case is about as meaningful and productive as arguing about the differences between a chainsaw and a katana in a hypothetical zombie apocalypse.
  - ivanbakel 5y ago
    >I'm an open source developer - but even if Oracle had violated my license terms and I had indisputable proof of it, I wouldn't take them to court. Why do you use a license with those terms, then? Court cases over license violations are not hypothetical. Perhaps your stance is that licenses are frivolous, but there are plenty of people in software who don't share it. And those people, given "indisputable proof" of a significant license violation, would happily take you to court (with FSF support) to force compliance, if necessary.
    - michaelt 5y ago
      No, but situations where it would make sense for me to pursue a court case over a license violation are hypothetical. Look at Oracle vs Google - Multibillion dollar companies, getting advice from the absolute top legal experts, yet they still can't agree on what is and isn't allowed by law. And getting an answer for that has taken over a decade and an eyewatering amount of money. Now imagine I'm a Finnish developer living in South Korea who released code under an American-written license, and a Russian company infringed on it. It's inconceivable that I'd choose to take huge personal risk and expense, sacrificing years of my free time, pursuing litigation over something I was trying to give away for free anyway. That's not to say people can't do this stuff if they enjoy it - by all means, collect some katanas if that's your idea of fun!
      - skulbuny 5y ago
        Why not just use a license that explicitly says you won't use legal recourse, like the Unlicense or 0BSD, ie. release it to the public domain? If you use MIT even you are saying "I will litigate you if you do not comply with my demand that you include this license when you use this software."
  - xpe 5y ago
    Large organizations often are risk averse with regards to legal matters. They don't want to be sued for misusing a license. The threat of litigation has a real effect, even if one particular individual is unlikely to bring a case.
  - xpe 5y ago
    Saying "software licensing is a joke" and "hypothetical zombie apocalypse" may be provocative and/or funny, but it distracts attention from the underlying logic. In my view, when conversations start going down this path, they become less substantive and interesting, because the meaning becomes muddled. I try to always remember: * One person writes a comment one time. N people read it. N >> 1. Therefore strive to be clear. * "Comments should get more thoughtful and substantive, not less, as a topic gets more divisive." https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
  - riffraff 5y ago
    > I'm an open source developer - but even if Oracle had violated my license terms and I had indisputable proof of it, I wouldn't take them to court. that's one of the good reasons to assign copyright to a larger entity (Apache foundation, FSF, or whatever): they'll fight to defend the license when it is violated with means you do not have.
  - iso1631 5y ago
    So you're saying the legal system is stacked in favor of the large, so we shouldn't bother with laws at all? If you broke Oracle's license terms they'll be suing you.
misnome 5y ago
Is there any precedent to what happens, or could happen, if a project changes licence like this in a patch release? Is there any provision for mistakes like this in the GPL, or is everything that has ever used this package now considered "fair game" for classing as GPL and making source requests? (although I imagine rails being a web framework probably protects anything using rails and only serving the end results publicly, this sounds like the sort of nightmare scenario that would make legal departments nervous about open source)
- freedomben 5y ago
  IANAL so take with a grain of salt, but legal action is very rare under the GPL, and it's also expensive. In a case like this also I think it would be a tough case. I wouldn't worry about it, at least not currently.
  - misnome 5y ago
    I expect this whole discussion could have IANAL prepended to it - but it seems like an interesting question - what the licence strictly implies, beyond "It probably doesn't matter as probably nobody will take legal action against you". Or is lack of enforcement, in the end case, the only thing that matters - making most discussions about open licences and in-depth consideration meaningless?
- joshuaissac 5y ago
  GPL licensing of derived works is not automatic. Instead, distributing under incompatible terms is copyright infringement. It may be possible to remedy this infringement by releasing the source code under the GPL, but it also may not (e.g. source code contains un-relicenceable code from a third-party), in which case the only remedy is to not distribute the program at all.
  - misnome 5y ago
    Ah, right, so it doesn't make it automatically GPL2 unless they want to continue to distribute it - and presumably only the original GPL2 licence-holder(s) are in the position to raise the issue of past infringement-via-distribution. And so presumably unless rails was actively distributing bundles with it they'd would not be counted as "distributing" this GPL dependency. It does sound like exactly the sort of hole that AGPL is designed to close is the saving grace here?
freedomben 5y ago
TLDR: the mimemagic gem was MIT licensed, but an issue was opened where it was reported that mimemagic is using a GPLv2 source file. Legally (IANAL) this forces mimemagic to become GPLv2. The mimemagic gem was changed to GPLv2. However rails depends on mimemagic, and that means rails needs to be GPLv2, which is obviously a big problem. The discussion around this is taking place in the github repo for rails because mimemagic was archived for some reason (at least temporarily).
wokwokwok 5y ago
The reason this is happening is not obvious without reading https://github.com/minad/mimemagic/issues/97 https://github.com/minad/mimemagic/issues/97 > I've historically been the maintainer of shared-mime-info for around 15 years, and script/freedesktop.org.xml looks like it's a copy of the database shipped with shared-mime-info, which is released under the GPL, with shared-mime-info's translators work merged in, and the GPL header removed. > The license that you're shipping mimemagic under (MIT) isn't compatible with shared-mime-info's. Seems like quite a reasonable request, even if folk don’t like the results. ..and to be clear, I’m quite sure that rolling back to the commit before the license change does exactly nothing to address the issue. You don’t magically get your MIT license back by forking before the license change was added, that’s not how it works. If the previous version contains GPL code, it’s GPL. It doesn’t matter if you slap an MIT license file on it, or used it in “good faith” presuming it was MIT license.
- gedy 5y ago
  I guess this is subjective (though maybe not legally), but this lookup table of extensions to mimetypes doesn't feel like GPL "software". It's just a description of other software's conventions using the GPLed source as a reference: https://github.com/minad/mimemagic/blob/master/lib/mimemagic/tables.rb#L3 https://github.com/minad/mimemagic/blob/master/lib/mimemagic... To create a non-GPL version, you would have to do what? Research extensions without letting your eyes see this GPLed list?
  - imhoguy 5y ago
    vs this https://gitlab.freedesktop.org/xdg/shared-mime-info/-/blob/master/data/freedesktop.org.xml.in https://gitlab.freedesktop.org/xdg/shared-mime-info/-/blob/m...
    - Xylakant 5y ago
      In a twist of irony, the software for which the copyright claim breaking rails was made is hosted on the free edition of gitlab, which is based on rails.
imhoguy 5y ago
TL;DR This unfortunate chain of events is rooted in licensing violation: https://github.com/minad/mimemagic/issues/97 https://github.com/minad/mimemagic/issues/97 Mimemagic got its MIME tables source generated from `freedesktop.org.xml` file, which is licensed under GPL2, and the resulting source was released under permissive MIT license. All prior 0.3.6 mimemagic versions violated the GPL2 license. The author of mimemagic couldn't change the pre-0.3.6 versions so they simply deleted them. Unfortunately "the fix" has broken the dependent projects and such have to either: 1) upgrade to GPL2 compatible mimemagic 0.3.6 or 0.4.0, which conflicts with MIT licensed projects like Rails or 2) build/use other MIME resolving library with has permissive license or 3) fork mimemagic under MIT and implement dynamic loading of `freedesktop.org.xml` which wouldn't violate the license.
- gedy 5y ago
  Since the xml file is not included in the source, and was just a reference for a rb source file's lookup table, it just feels weird that 3 fixes the violation.
  - imhoguy 5y ago
    IANAL but it explicitly states it is derivative from the XML file: https://github.com/minad/mimemagic/blob/master/lib/mimemagic/tables.rb#L3 https://github.com/minad/mimemagic/blob/master/lib/mimemagic...
  - derefr 5y ago
    I think the pedantic interpretation of the GPL “depends on” clause is that burning a content-hash of a GPLed release of a work into your work, such that your work retrieves and installs the GPLed work-release by its content-hash (or retrieves the work-release by name + version and then verifies it by content hash — as a Bundler Gemfile.lock does), is “depending on” the GPLed release of the upstream work. Due to the explicitness of the reference, the only release that the downstream project could be depending on, is a GPLed release. (Remember, GPLed code releases need to embed the GPL license somewhere, so there’s no posssibility of a byte-for-byte identical dep being created by coincidence that isn’t GPLed.) Meanwhile, just saying “I’ll take whatever is in the environment at [path]” is a more plugin-like approach: a GPLed database could be placed there, but a differently-licensed database could be there instead. Because you’re not making any explicit reference to any particular release of any particular work, you aren’t infected by the copyright/licensing of the particular work/release that happens to be there. It’s a lot like the case-law of the DMCA’s “tool used for breaking copyright” clause: if the tool has features that exclusively help to break copyright, with no other uses, then it’s in violation of the DMCA; while if all features of the tool have other potential use-cases, then it doesn’t. In both cases, it’s a question of whether there’s a “reasonable doubt” on what exactly the project was aiming to achieve / link against. If the project is explicit and removes all doubt, then it’s in violation.
TomOwens 5y ago
This just bit me. The first thing that I noticed was that some people are not understanding the GPL. It's far more impactful to Rails than the vast majority of web applications built using Rails. The use of GPL'd files means that the gem itself has to be released under the GPL. Since the gem is now under the GPL, dependencies are also under the GPL. That would include Rails. However, even if Rails was under the GPL, organizations could still build closed-source web applications using Rails since network access is not distribution. That's the whole point of the AGPL. However, it does raise a lot of questions about when someone is allowed to yank a gem (or any library, really). It's been a while since I took a deep dive, but I was under the general impression that there was some leeway around not breaking the world when rectifying license issues. I would think that releasing new versions under the correct license and giving everyone notice and time (30 days?) to update would be fine for most copyright holders. I'd suspect that most open source developers wouldn't want to break the world. The sudden yanking with no warning caused builds to fail everywhere. The absolute worst thing, though, was that changing a license should not be a minor (or a major) version number increase. It should be a patch. The breaking was simply because Rails is pinned to 0.3.x, but the first release under the new license was 0.4.x. Fortunately, the author released a 0.3.6 patch with the correct license, so it's just a matter of a bundle update to get the latest version. But if he hadn't, Rails would have had to release a new version and anyone on legacy/unsupported Rails versions would be hosed if they had to rebuild and redeploy. This is a really good reason to stand up your own artifact repository and put all of your third-party dependencies in it, especially if you're a business.
- freedomben 5y ago
  After the "left-pad" fiasco, and a similar event on the Ruby side, I started vendoring my dependencies as standard practice. I have not been sorry yet, in fact I feel vindicated in that approach.
  - TomOwens 5y ago
    Vendoring is a good first step, too. As long as you have a local copy of all the dependencies, you're better off than needing to go pull them from the Internet every time you want them and risk having them gone. Potentially worse is having the same version but with modifications.
rubyist5eva 5y ago
vendor your dependencies people
- byroot 5y ago
  Or you know... just cache them. If your CI or deploys broke because of this, it basically means you're constantly re-installing all your dependencies from scratch, which is totally silly. Configure your CI & other tools to cache the bundler directory between builds and not only you'll be protected from this, you'll also make your systems faster.
  - ro_ro 5y ago
    What's even more silly is implying that caching your dependencies is some kind of a fix here. So you'll be able to deploy for a few more days, then what?
    - byroot 5y ago
      Then the 0.3.6 version was released, and we could update because the license isn't much of a problem in this case. Alternatively we could have continuee to deploy for a few more days until Rails core shipped a new version of Active Storage without that dependency. It's effectively the same as vendoring, except we're not blowing up our repositories with 10 years of dependencies.
      - ro_ro 5y ago
        I should clarify... Vendoring is a terrible solution. Caching is a general good practice but not a solution. All in all, this kind of thing happens once in a blue moon...
        byroot 5y ago
        I don't claim it's a long term solution, and that you should run of your cache for years. But having that cache means you have the time to get a clean solution rather than having to rush something because nobody can work anymore can you can't deploy fixes to production either. These yanking issues are really problematic, but if they interrupted your workflow, then there's something wrong with your build pipeline.
spijdar 5y ago
This is the sort of thing that makes some people really wary of the GPL and other "viral" licenses, and I don't think you can blame them. The "blame" for this falls on someone for throwing in GPL'd code into an MIT project, but the headache drops onto a whole bunch more people down the line. It seems other commenters think this will probably be alright, but I bet this is a lot of corporate type's worst nightmare, that some underling added some segment of GPL code to their product, and now the entire thing is "technically" GPL. One can only imagine if it was AGPL instead of GPL, and how people would debate if they should send source requests to all the sites running on rails ;-)
- misnome 5y ago
  > makes some people really wary of the GPL and other "viral" licenses It's worse than that surely - as in this case avoiding GPL doesn't prevent the problem. This sounds like for a medium-paranoid-legal perspective, that it would "prove" that even non-GPL code isn't safe, thus discouraging from usage of any open source software [edit: dependencies] > One can only imagine if it was AGPL instead of GPL Right, that seems like the only saving grace that avoids this being an potentially apocalyptic event.
  - qotgalaxy 5y ago
    Why would closed source software be safe? Say I copy shared-mime-info completely, compile it, sell it to you as MimeWizardPRO2000, you include it as part of your closed source web framework and sell that. You're still distributing GPL code without making your source available.
    - rocqua 5y ago
      I think it's different if you are re-using source (with GPL notices) or binaries (which don't have them)
- Tomte 5y ago
  > and now the entire thing is "technically" GPL. The "thing" doesn't become GPL, though. They are in breach of the license, it's a major headache, and re-licensing the thing as GPL may be one way forward. That's not an automatism, though, and no court would declare the thing GPL. You may pay hefty "fictitious" licensing fees and (punitive) damages, you may have to stop distributing your thing, but you're not losing control.
crazypython 5y ago
Note that using a GPL dependency on servers is always allowed: "except executing it on a computer or modifying a private copy." Most Ruby on Rails projects are executed only on own servers. Smells like flamebait.
- Dangeranger 5y ago
  There are projects that redistribute the source code, such as Gitlab, and for those projects this is a significant problem.
mooreds 5y ago
I give my boss a hard time about our dependency management system because it is relatively unknown[0], but licensing is built into it from the ground up. You can't import any dependency (no matter how buried) without assigning a license to it. This lets us confidently know, via software, the open and closed source licenses in our code base. Licensing is one of those out of band concerns that doesn't burn you until it does. 0: https://github.com/savant-build/savant-core https://github.com/savant-build/savant-core
- Denvercoder9 5y ago
  > You can't import any dependency (no matter how buried) without assigning a license to it. That wouldn't help here. Mimemagic declared itself to be MIT, and only turned out to be GPL because it embedded a file derived from GPL sources. That file didn't even have a license header specifying it as GPL. Anyone importing it would mark it as MIT. EDIT: Mimemagic didn't even turn out to be GPL, it turned out to be infringing on the GPL, and the author solved that by relicensing it to GPL.
  - mooreds 5y ago
    Fair point. I guess software couldn't have helped this issue.
- Trasmatta 5y ago
  That's a good idea generally, but it wouldn't have saved you from this issue. The gem had an MIT license, and the offending file was copied in, not sourced through a dependency.
  - mooreds 5y ago
    Gotcha, fair point. I should have read deeper; I only read the Rails issue, but should have dove into the mimemagic one. My bad.
  - hakre 5y ago
    Depends on the process. If assigning a license means that there is a review of the dependency before use, this is normally seen.
CodesInChaos 5y ago
1. Is a database like that even copyrightable, especially in the US? > United States: Uncreative collections of facts are outside of Congressional authority under the Copyright Clause (Article I, § 8, cl. 8) of the United States Constitution, therefore no database right exists in the United States. Originality is the sine qua non of copyright in the United States (see Feist Publications v. Rural Telephone Service). https://en.wikipedia.org/wiki/Database_right#United_States https://en.wikipedia.org/wiki/Database_right#United_States 2. I'm skeptical that using a GPLed database makes this library a derivative work of the GPLed database, though the "distribute as a part of the whole" clause still applies > These requirements apply to the modified work as a whole. If identifiable sections of that work are not derived from the Program, and can be reasonably considered independent and separate works in themselves, then this License, and its terms, do not apply to those sections when you distribute them as separate works > But when you distribute the same sections as part of a whole which is a work based on the Program, the distribution of the whole must be on the terms of this License, whose permissions for other licensees extend to the entire whole, and thus to each and every part regardless of who wrote it.
- boleary-gl 5y ago
  Anytime you publish something, it is copyrighted. The data within may not be, but my presentation of it in a certain database certainly is.
  - ericb 5y ago
    When is my work protected? Your work is under copyright protection the moment it is created and fixed in a tangible form that it is perceptible either directly or with the aid of a machine or device. Source: https://www.copyright.gov/help/faq/faq-general.html https://www.copyright.gov/help/faq/faq-general.html
    - CodesInChaos 5y ago
      The relevant question is "What does copyright protect?" > Copyright, a form of intellectual property law, protects original works of authorship including literary, dramatic, musical, and artistic works, such as poetry, novels, movies, songs, computer software, and architecture. Copyright does not protect facts, ideas, systems, or methods of operation, although it may protect the way these things are expressed. See Circular 1, Copyright Basics, section "What Works Are Protected." You need to argue that such a database is an original work, and not merely an uncreative collections of facts. I would at least consider simple patterns uncreative facts, but complex patterns might be considered copyrightable original works.
boleary-gl 5y ago
Looks like there is a proposal to completely replace the gem: https://github.com/rails/rails/pull/41751/files https://github.com/rails/rails/pull/41751/files
forgingahead 5y ago
Outrageous move to just yank the gem and break builds everywhere.
- heax 5y ago
  It is not nice, but aside from hobbyists everyone who seriously develops software caches all dependencies in a own repository like nexus etc. It's similar to backups, if you don't have one your data must be worthless.
  - samb1729 5y ago
    > aside from hobbyists everyone who seriously develops software caches all dependencies in a own repository like nexus etc. This is a bold claim to make, and one that isn’t supported by my personal observations. Many ‘serious’ software developers have no such intermediate repository for their dependencies.
    - pskinner 5y ago
      We did and so this didn't cause us a major issue today. At my lost job we had the same. And the one before that. This mitigation of a risk that affects business continuity is something that all senior level people need to take seriously at any company, small or large.
crazypython 5y ago
This is flamebait.
xucheng 5y ago
If rails is now considered as GPL because this dependency, does this mean that GitHub Enterprise is now GPL?
- dathinab 5y ago
  > rails is now considered as GPL no > mean that GitHub Enterprise is now GPL? even less so --- Rails was in a license violating situation, which doesn't make it GPL at all. Then the outcome of a legal case trying to sue someone who is knowingly using rails which unknowingly pulls in a GPL licensed dependency might be less clean cut as you might think. Lastly depending on the version of GPL and other factors like non-clean cut interpretations you might be able to argue that a company building a service using rails wouldn't need to make the service GPL even if they use GPL software to do so (if that GPL software is in the backend only!, not if it's in the UI). The reason is that the service is not distributed by them, it stays internally even through it is communicating with a website(html,css,js, not! server side rendering) which was distributed to the user.
  - xucheng 5y ago
    The reason I mentioned GitHub Enterprise instead of GitHub website is because the former one is not a service. It is a software distributed to the end user. Based on your comments, it seems that the existing releases of the GitHub Enterprise are in GPL violation states due to the transitive dependency.
    - dathinab 5y ago
      I guess, yes. But then an interesting question is how transitive copyright violations apply (because this is what a GPL violation legally is, you use the license to use it, nothing more and nothing less). The reason I'm wondering about this is because the situation here is similar to a producer of e.g. cars buying a lets say seat to be put into the car and inside the seat they seat producer used some e.g. screws which violate copyright. Would it be possible that the car manufacturer is hold responsible for the copyright violation enacted by the seat producer? Unlikely I guess? Would it still have some consequences? Surely, but likely negligible: Violating GPL doesn't make any code become GPL (a common misconception) and copyright infringement laws are often based on monetary damage done by the infringement. And lets be honest how much damage is done in case the product is not sold, only given away for free and has competition which is also given away for free with even less constraints?
crazypython 5y ago
Reminder that GPLv3 gives you 30 days to "cure the violation," while the GPLv2 Linus Torvalds prefers immediately creates a copyright violation.
- Denvercoder9 5y ago
  Note that GPLv3 still immediately creates a copyright violation. It just states that if you cure the violation within 30 days, the license is reinstated. Under GPLv2 you forfeit your license immediately and in perpetuity if you infringe on it.
CodesInChaos 5y ago
How does yanking work for rubygems? In Rust a yanked version can still be downloaded when compiling (you have a lock-file referencing it), but isn't chosen when adding it as a new (transitive) dependency to your application. So yanking shouldn't break any existing applications. (Though since is about a copyright violation, a DMCA notice against the package registry could result in a hard removal, and not just a yanked package)
- packrat386 5y ago
  A yanked gem won't be downloaded for a `bundle install` or anything of that sort. Aside from a record that it once existed it's basically gone.
  - lamontcg 5y ago
    I'm kind of surprised that nobody is talking more about this right now. Everyone with a Gemfile.lock that does a `bundle install` as part of autoscaling (without having vendored gems or a rubygems mirror which doesn't obey yanks) is now broken, potentially in production.
    - quesera 5y ago
      This is true, and important, but: You should never depend on GitHub or RubyGems for deployments. If your deployment failed today due to this gem yank, it has exposed a bug in your systems that you should fix. EDIT: I should not speak in such absolutes. "Never" is a big word and clearly this does not apply in all cases! Depending on third-parties for deployments is a risk -- but might be tolerable, if a multi-hour outage would not be devastating.
      - Toutouxc 5y ago
        What's the solution? Having a mirror/archive of some kind of the gems I use?
        5y ago
Benjamin_Dobell 5y ago
Technically everyone using Rails right now may be in violation of the GPL. It doesn't matter that the version of the gem being used claims to be MIT, that's not how licensing/copyright works. Github Enterprise licensees could try hit-up GitHub for source code! EDIT: License in question is GPL, not Affero GPL. So github.com is not covered. However, Github Enterprise is. In all likelihood, Github wouldn't comply, as Github Enterprise licensees have no such license/clause in effect with Github. It'd then be down to the shared-mime-info's copyright holders to take the matter to court. Would be an interesting court case. Some people in the Github issue commented that the XML "database" in question could be used under fair use. That'd be the logical defense. There's been many court cases where the "copyrighted material" is a representation of facts, as opposed to a "creative work", and thus has not been eligible for copyright protection. It's probably also worth noting that "ignorance" is rarely an accepted defense in court.
- crazypython 5y ago
  > everyone using Rails right now is in violation of the GPL. Not if your use of Rails is limited to your own/your company's own servers, which I imagine most Rails users are. Please don't fall for the flamebait. If they were using GPLv3, they would have an entire month (30 days) to cure the violation. GitHub Enterprise is in violation as it is distributed to third-parties.
  - Benjamin_Dobell 5y ago
    Thanks, edited for clarity. In this case it's GPLv2, so no "cure the violation" clause. However, even if this were GPLv3, and you were to "cure the violation" that only reinstates your license i.e. the GPLv3 license. Replacing a dependency won't make previously infringing releases any less infringing.
toomanybeersies 5y ago
It's like left-pad all over again. I wonder how much software will be unbuildable in 10 years time, due to dependencies that can no longer be downloaded. Is there an archive.org for packages?
- sosodev 5y ago
  I really do wonder about the long term sustainability of package systems. The oldest business software, think COBOL, still works because it can still run the way it did when it was created. Will I be able to say the same about my software in 50+ years?
- commandlinefan 5y ago
  At least this dependency makes sense: mime type parsing is nontrivial and something you'd logically want to leverage a library for. I can't comprehend how somebody could ever have said "I need left padding. I wonder if there's a library for that somewhere?"
- hu3 5y ago
  This is why I commit vendor directories. I don't mind if CI ignores it but it's nice to have a fallback that ensures the project is buildable at all times.
- pjmlp 5y ago
  Always vendor software instead of relying on public repositories.
deleted 5y ago
[deleted]
- jahewson 5y ago
  > could a library author claim their old code infringed on copyright to force users to upgrade to a paid version? Anybody can claim anything. Only the holder of the infringed copyright has standing to sue, so the library author in your example has no power to force anything. They may also be civilly liable for damages to the library users and, if unlicensed code was planted deliberately, then also criminally (extortion).
cstrahan 5y ago
This was handled quite poorly -- a different course of action could have avoided all the chaos while also resolving the GPL violation. As the GPL FAQ states: > If a programming language interpreter has a license that is incompatible with the GPL, can I run GPL-covered programs on it? (#InterpreterIncompat) > When the interpreter just interprets a language, the answer is yes. The interpreted program, to the interpreter, is just data; the GPL doesn't restrict what tools you process the program with. In mimemagic's case, similar logic could apply: * mimemagic could redistribute the GPL licensed freedesktop.org.xml file. This redistributed file would retain the original GPL license and its terms. * mimemagic could then read the freedesktop.org.xml file at run time and generate whatever data structures it needs. mimemagic would continue to be MIT licensed without violating the GPL license. The problem is that mimemagic includes Ruby code generated from the GPL licensed XML file, and it could be argued that this makes part of mimemagic a derivative of a GPL licensed work. They just needed to stop doing that. Of course I can't point this out to the repository owner now that the repo has been archived and thus commenting is now disabled.
- thedanbob 5y ago
  That approach is roughly being taken in this fork: https://github.com/jellybob/mimemagic/issues/1 https://github.com/jellybob/mimemagic/issues/1 With the difference that the gem will by default download the XML file at runtime, with the option of using a local copy specified by an environment variable. I guess they are operating under the belief that including any GPL file taints the library, or perhaps they're just playing it safe.
  - Dangeranger 5y ago
    Yes, this approach can work, unless the system which Rails/mimemagic is deployed to has restricted network settings. Under a restricted network setting, I believe the only solution which will work is to use a different package offering similar behavior, under a non-GPL license, or to re-implement the existing behavior using the freedesktop.org.xml as an input/output specification, rather than a source for derived code.
lawwantsin17 5y ago
Rails should have zero dependencies. Hot take.
protomyth 5y ago
So, this gem uses the mime database provided by freedesktop.org when the gem could have got the database from http://www.iana.org/assignments/media-types/media-types.xhtml http://www.iana.org/assignments/media-types/media-types.xhtm... which wouldn't be GPL? What manipulation is done by freedesktop.org?
- devrand 5y ago
  The gem is basically a database of mime type, file extension, and magic bytes. The last two are not included in the linked iana database.
  - protomyth 5y ago
    Where did freedesktop.org get the magic bytes? I assume (probably stupidly) that some of that has to be in a file command on some BSD.
    - garblegarble 5y ago
      Here's what the magic bytes look like in FreeBSD, as an example I've linked to the definition of PNG. You can see it's a fair bit more complicated but it does have mime and extension data. https://github.com/freebsd/freebsd-src/blob/master/contrib/file/magic/Magdir/images#L421 https://github.com/freebsd/freebsd-src/blob/master/contrib/f...
rushb 5y ago
Can someone please explain how it is possible to license a database of such sort in the first place? Pretty much all file types have some documentation on how to identify them by reading specific bytes, it's not like the folks from freedesktop invented those methods. On top of that, having the DB licensed under GPL would mean that every line of it is also under GPL, thus forcing the same GPL to all libraries out there that do even a simple PNG check using a magical byte check? I'm really curious to understand how it this licensing works.

265 points by ldulcic 5y ago

Looking through the linked comments & issues, it will be interesting to see how many people blindly adopt (forced into) GPL2 license. I wonder how big the R for spreading is? All from an XML file for mimetype info

ivanbakel 5y ago

It's interesting how many commenters on the various issues around the license change seem to think that software licensing is an inconvenience, rather than a serious legal question.

michaelt 5y ago
Well, when viewed from the perspective of legal realism, a lot of software licensing is a joke. I'm an open source developer - but even if Oracle had violated my license terms and I had indisputable proof of it, I wouldn't take them to court. Arguing about the differences between GPL3 and WTFPL in a hypothetical court case is about as meaningful and productive as arguing about the differences between a chainsaw and a katana in a hypothetical zombie apocalypse.
- ivanbakel 5y ago
  >I'm an open source developer - but even if Oracle had violated my license terms and I had indisputable proof of it, I wouldn't take them to court. Why do you use a license with those terms, then? Court cases over license violations are not hypothetical. Perhaps your stance is that licenses are frivolous, but there are plenty of people in software who don't share it. And those people, given "indisputable proof" of a significant license violation, would happily take you to court (with FSF support) to force compliance, if necessary.
  - michaelt 5y ago
    No, but situations where it would make sense for me to pursue a court case over a license violation are hypothetical. Look at Oracle vs Google - Multibillion dollar companies, getting advice from the absolute top legal experts, yet they still can't agree on what is and isn't allowed by law. And getting an answer for that has taken over a decade and an eyewatering amount of money. Now imagine I'm a Finnish developer living in South Korea who released code under an American-written license, and a Russian company infringed on it. It's inconceivable that I'd choose to take huge personal risk and expense, sacrificing years of my free time, pursuing litigation over something I was trying to give away for free anyway. That's not to say people can't do this stuff if they enjoy it - by all means, collect some katanas if that's your idea of fun!
    - skulbuny 5y ago
      Why not just use a license that explicitly says you won't use legal recourse, like the Unlicense or 0BSD, ie. release it to the public domain? If you use MIT even you are saying "I will litigate you if you do not comply with my demand that you include this license when you use this software."
- xpe 5y ago
  Large organizations often are risk averse with regards to legal matters. They don't want to be sued for misusing a license. The threat of litigation has a real effect, even if one particular individual is unlikely to bring a case.
- xpe 5y ago
  Saying "software licensing is a joke" and "hypothetical zombie apocalypse" may be provocative and/or funny, but it distracts attention from the underlying logic. In my view, when conversations start going down this path, they become less substantive and interesting, because the meaning becomes muddled. I try to always remember: * One person writes a comment one time. N people read it. N >> 1. Therefore strive to be clear. * "Comments should get more thoughtful and substantive, not less, as a topic gets more divisive." https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
- riffraff 5y ago
  > I'm an open source developer - but even if Oracle had violated my license terms and I had indisputable proof of it, I wouldn't take them to court. that's one of the good reasons to assign copyright to a larger entity (Apache foundation, FSF, or whatever): they'll fight to defend the license when it is violated with means you do not have.
- iso1631 5y ago
  So you're saying the legal system is stacked in favor of the large, so we shouldn't bother with laws at all? If you broke Oracle's license terms they'll be suing you.

misnome 5y ago

Is there any precedent to what happens, or could happen, if a project changes licence like this in a patch release? Is there any provision for mistakes like this in the GPL, or is everything that has ever used this package now considered "fair game" for classing as GPL and making source requests? (although I imagine rails being a web framework probably protects anything using rails and only serving the end results publicly, this sounds like the sort of nightmare scenario that would make legal departments nervous about open source)

freedomben 5y ago
IANAL so take with a grain of salt, but legal action is very rare under the GPL, and it's also expensive. In a case like this also I think it would be a tough case. I wouldn't worry about it, at least not currently.
- misnome 5y ago
  I expect this whole discussion could have IANAL prepended to it - but it seems like an interesting question - what the licence strictly implies, beyond "It probably doesn't matter as probably nobody will take legal action against you". Or is lack of enforcement, in the end case, the only thing that matters - making most discussions about open licences and in-depth consideration meaningless?
joshuaissac 5y ago
GPL licensing of derived works is not automatic. Instead, distributing under incompatible terms is copyright infringement. It may be possible to remedy this infringement by releasing the source code under the GPL, but it also may not (e.g. source code contains un-relicenceable code from a third-party), in which case the only remedy is to not distribute the program at all.
- misnome 5y ago
  Ah, right, so it doesn't make it automatically GPL2 unless they want to continue to distribute it - and presumably only the original GPL2 licence-holder(s) are in the position to raise the issue of past infringement-via-distribution. And so presumably unless rails was actively distributing bundles with it they'd would not be counted as "distributing" this GPL dependency. It does sound like exactly the sort of hole that AGPL is designed to close is the saving grace here?

freedomben 5y ago

TLDR: the mimemagic gem was MIT licensed, but an issue was opened where it was reported that mimemagic is using a GPLv2 source file. Legally (IANAL) this forces mimemagic to become GPLv2. The mimemagic gem was changed to GPLv2. However rails depends on mimemagic, and that means rails needs to be GPLv2, which is obviously a big problem. The discussion around this is taking place in the github repo for rails because mimemagic was archived for some reason (at least temporarily).

wokwokwok 5y ago

The reason this is happening is not obvious without reading https://github.com/minad/mimemagic/issues/97 https://github.com/minad/mimemagic/issues/97 > I've historically been the maintainer of shared-mime-info for around 15 years, and script/freedesktop.org.xml looks like it's a copy of the database shipped with shared-mime-info, which is released under the GPL, with shared-mime-info's translators work merged in, and the GPL header removed. > The license that you're shipping mimemagic under (MIT) isn't compatible with shared-mime-info's. Seems like quite a reasonable request, even if folk don’t like the results. ..and to be clear, I’m quite sure that rolling back to the commit before the license change does exactly nothing to address the issue. You don’t magically get your MIT license back by forking before the license change was added, that’s not how it works. If the previous version contains GPL code, it’s GPL. It doesn’t matter if you slap an MIT license file on it, or used it in “good faith” presuming it was MIT license.

gedy 5y ago
I guess this is subjective (though maybe not legally), but this lookup table of extensions to mimetypes doesn't feel like GPL "software". It's just a description of other software's conventions using the GPLed source as a reference: https://github.com/minad/mimemagic/blob/master/lib/mimemagic/tables.rb#L3 https://github.com/minad/mimemagic/blob/master/lib/mimemagic... To create a non-GPL version, you would have to do what? Research extensions without letting your eyes see this GPLed list?
- imhoguy 5y ago
  vs this https://gitlab.freedesktop.org/xdg/shared-mime-info/-/blob/master/data/freedesktop.org.xml.in https://gitlab.freedesktop.org/xdg/shared-mime-info/-/blob/m...
  - Xylakant 5y ago
    In a twist of irony, the software for which the copyright claim breaking rails was made is hosted on the free edition of gitlab, which is based on rails.

imhoguy 5y ago

TL;DR This unfortunate chain of events is rooted in licensing violation: https://github.com/minad/mimemagic/issues/97 https://github.com/minad/mimemagic/issues/97 Mimemagic got its MIME tables source generated from `freedesktop.org.xml` file, which is licensed under GPL2, and the resulting source was released under permissive MIT license. All prior 0.3.6 mimemagic versions violated the GPL2 license. The author of mimemagic couldn't change the pre-0.3.6 versions so they simply deleted them. Unfortunately "the fix" has broken the dependent projects and such have to either: 1) upgrade to GPL2 compatible mimemagic 0.3.6 or 0.4.0, which conflicts with MIT licensed projects like Rails or 2) build/use other MIME resolving library with has permissive license or 3) fork mimemagic under MIT and implement dynamic loading of `freedesktop.org.xml` which wouldn't violate the license.

gedy 5y ago
Since the xml file is not included in the source, and was just a reference for a rb source file's lookup table, it just feels weird that 3 fixes the violation.
- imhoguy 5y ago
  IANAL but it explicitly states it is derivative from the XML file: https://github.com/minad/mimemagic/blob/master/lib/mimemagic/tables.rb#L3 https://github.com/minad/mimemagic/blob/master/lib/mimemagic...
- derefr 5y ago
  I think the pedantic interpretation of the GPL “depends on” clause is that burning a content-hash of a GPLed release of a work into your work, such that your work retrieves and installs the GPLed work-release by its content-hash (or retrieves the work-release by name + version and then verifies it by content hash — as a Bundler Gemfile.lock does), is “depending on” the GPLed release of the upstream work. Due to the explicitness of the reference, the only release that the downstream project could be depending on, is a GPLed release. (Remember, GPLed code releases need to embed the GPL license somewhere, so there’s no posssibility of a byte-for-byte identical dep being created by coincidence that isn’t GPLed.) Meanwhile, just saying “I’ll take whatever is in the environment at [path]” is a more plugin-like approach: a GPLed database could be placed there, but a differently-licensed database could be there instead. Because you’re not making any explicit reference to any particular release of any particular work, you aren’t infected by the copyright/licensing of the particular work/release that happens to be there. It’s a lot like the case-law of the DMCA’s “tool used for breaking copyright” clause: if the tool has features that exclusively help to break copyright, with no other uses, then it’s in violation of the DMCA; while if all features of the tool have other potential use-cases, then it doesn’t. In both cases, it’s a question of whether there’s a “reasonable doubt” on what exactly the project was aiming to achieve / link against. If the project is explicit and removes all doubt, then it’s in violation.

TomOwens 5y ago

This just bit me. The first thing that I noticed was that some people are not understanding the GPL. It's far more impactful to Rails than the vast majority of web applications built using Rails. The use of GPL'd files means that the gem itself has to be released under the GPL. Since the gem is now under the GPL, dependencies are also under the GPL. That would include Rails. However, even if Rails was under the GPL, organizations could still build closed-source web applications using Rails since network access is not distribution. That's the whole point of the AGPL. However, it does raise a lot of questions about when someone is allowed to yank a gem (or any library, really). It's been a while since I took a deep dive, but I was under the general impression that there was some leeway around not breaking the world when rectifying license issues. I would think that releasing new versions under the correct license and giving everyone notice and time (30 days?) to update would be fine for most copyright holders. I'd suspect that most open source developers wouldn't want to break the world. The sudden yanking with no warning caused builds to fail everywhere. The absolute worst thing, though, was that changing a license should not be a minor (or a major) version number increase. It should be a patch. The breaking was simply because Rails is pinned to 0.3.x, but the first release under the new license was 0.4.x. Fortunately, the author released a 0.3.6 patch with the correct license, so it's just a matter of a bundle update to get the latest version. But if he hadn't, Rails would have had to release a new version and anyone on legacy/unsupported Rails versions would be hosed if they had to rebuild and redeploy. This is a really good reason to stand up your own artifact repository and put all of your third-party dependencies in it, especially if you're a business.

freedomben 5y ago
After the "left-pad" fiasco, and a similar event on the Ruby side, I started vendoring my dependencies as standard practice. I have not been sorry yet, in fact I feel vindicated in that approach.
- TomOwens 5y ago
  Vendoring is a good first step, too. As long as you have a local copy of all the dependencies, you're better off than needing to go pull them from the Internet every time you want them and risk having them gone. Potentially worse is having the same version but with modifications.

rubyist5eva 5y ago

vendor your dependencies people

byroot 5y ago
Or you know... just cache them. If your CI or deploys broke because of this, it basically means you're constantly re-installing all your dependencies from scratch, which is totally silly. Configure your CI & other tools to cache the bundler directory between builds and not only you'll be protected from this, you'll also make your systems faster.
- ro_ro 5y ago
  What's even more silly is implying that caching your dependencies is some kind of a fix here. So you'll be able to deploy for a few more days, then what?
  - byroot 5y ago
    Then the 0.3.6 version was released, and we could update because the license isn't much of a problem in this case. Alternatively we could have continuee to deploy for a few more days until Rails core shipped a new version of Active Storage without that dependency. It's effectively the same as vendoring, except we're not blowing up our repositories with 10 years of dependencies.
    - ro_ro 5y ago
      I should clarify... Vendoring is a terrible solution. Caching is a general good practice but not a solution. All in all, this kind of thing happens once in a blue moon...
      - byroot 5y ago
        I don't claim it's a long term solution, and that you should run of your cache for years. But having that cache means you have the time to get a clean solution rather than having to rush something because nobody can work anymore can you can't deploy fixes to production either. These yanking issues are really problematic, but if they interrupted your workflow, then there's something wrong with your build pipeline.

spijdar 5y ago

This is the sort of thing that makes some people really wary of the GPL and other "viral" licenses, and I don't think you can blame them. The "blame" for this falls on someone for throwing in GPL'd code into an MIT project, but the headache drops onto a whole bunch more people down the line. It seems other commenters think this will probably be alright, but I bet this is a lot of corporate type's worst nightmare, that some underling added some segment of GPL code to their product, and now the entire thing is "technically" GPL. One can only imagine if it was AGPL instead of GPL, and how people would debate if they should send source requests to all the sites running on rails ;-)

misnome 5y ago
> makes some people really wary of the GPL and other "viral" licenses It's worse than that surely - as in this case avoiding GPL doesn't prevent the problem. This sounds like for a medium-paranoid-legal perspective, that it would "prove" that even non-GPL code isn't safe, thus discouraging from usage of any open source software [edit: dependencies] > One can only imagine if it was AGPL instead of GPL Right, that seems like the only saving grace that avoids this being an potentially apocalyptic event.
- qotgalaxy 5y ago
  Why would closed source software be safe? Say I copy shared-mime-info completely, compile it, sell it to you as MimeWizardPRO2000, you include it as part of your closed source web framework and sell that. You're still distributing GPL code without making your source available.
  - rocqua 5y ago
    I think it's different if you are re-using source (with GPL notices) or binaries (which don't have them)
Tomte 5y ago
> and now the entire thing is "technically" GPL. The "thing" doesn't become GPL, though. They are in breach of the license, it's a major headache, and re-licensing the thing as GPL may be one way forward. That's not an automatism, though, and no court would declare the thing GPL. You may pay hefty "fictitious" licensing fees and (punitive) damages, you may have to stop distributing your thing, but you're not losing control.

crazypython 5y ago

Note that using a GPL dependency on servers is always allowed: "except executing it on a computer or modifying a private copy." Most Ruby on Rails projects are executed only on own servers. Smells like flamebait.

Dangeranger 5y ago
There are projects that redistribute the source code, such as Gitlab, and for those projects this is a significant problem.

mooreds 5y ago

I give my boss a hard time about our dependency management system because it is relatively unknown[0], but licensing is built into it from the ground up. You can't import any dependency (no matter how buried) without assigning a license to it. This lets us confidently know, via software, the open and closed source licenses in our code base. Licensing is one of those out of band concerns that doesn't burn you until it does. 0: https://github.com/savant-build/savant-core https://github.com/savant-build/savant-core

Denvercoder9 5y ago
> You can't import any dependency (no matter how buried) without assigning a license to it. That wouldn't help here. Mimemagic declared itself to be MIT, and only turned out to be GPL because it embedded a file derived from GPL sources. That file didn't even have a license header specifying it as GPL. Anyone importing it would mark it as MIT. EDIT: Mimemagic didn't even turn out to be GPL, it turned out to be infringing on the GPL, and the author solved that by relicensing it to GPL.
- mooreds 5y ago
  Fair point. I guess software couldn't have helped this issue.
Trasmatta 5y ago
That's a good idea generally, but it wouldn't have saved you from this issue. The gem had an MIT license, and the offending file was copied in, not sourced through a dependency.
- mooreds 5y ago
  Gotcha, fair point. I should have read deeper; I only read the Rails issue, but should have dove into the mimemagic one. My bad.
- hakre 5y ago
  Depends on the process. If assigning a license means that there is a review of the dependency before use, this is normally seen.

CodesInChaos 5y ago

1. Is a database like that even copyrightable, especially in the US? > United States: Uncreative collections of facts are outside of Congressional authority under the Copyright Clause (Article I, § 8, cl. 8) of the United States Constitution, therefore no database right exists in the United States. Originality is the sine qua non of copyright in the United States (see Feist Publications v. Rural Telephone Service). https://en.wikipedia.org/wiki/Database_right#United_States https://en.wikipedia.org/wiki/Database_right#United_States 2. I'm skeptical that using a GPLed database makes this library a derivative work of the GPLed database, though the "distribute as a part of the whole" clause still applies > These requirements apply to the modified work as a whole. If identifiable sections of that work are not derived from the Program, and can be reasonably considered independent and separate works in themselves, then this License, and its terms, do not apply to those sections when you distribute them as separate works > But when you distribute the same sections as part of a whole which is a work based on the Program, the distribution of the whole must be on the terms of this License, whose permissions for other licensees extend to the entire whole, and thus to each and every part regardless of who wrote it.

boleary-gl 5y ago
Anytime you publish something, it is copyrighted. The data within may not be, but my presentation of it in a certain database certainly is.
- ericb 5y ago
  When is my work protected? Your work is under copyright protection the moment it is created and fixed in a tangible form that it is perceptible either directly or with the aid of a machine or device. Source: https://www.copyright.gov/help/faq/faq-general.html https://www.copyright.gov/help/faq/faq-general.html
  - CodesInChaos 5y ago
    The relevant question is "What does copyright protect?" > Copyright, a form of intellectual property law, protects original works of authorship including literary, dramatic, musical, and artistic works, such as poetry, novels, movies, songs, computer software, and architecture. Copyright does not protect facts, ideas, systems, or methods of operation, although it may protect the way these things are expressed. See Circular 1, Copyright Basics, section "What Works Are Protected." You need to argue that such a database is an original work, and not merely an uncreative collections of facts. I would at least consider simple patterns uncreative facts, but complex patterns might be considered copyrightable original works.

boleary-gl 5y ago

Looks like there is a proposal to completely replace the gem: https://github.com/rails/rails/pull/41751/files https://github.com/rails/rails/pull/41751/files

forgingahead 5y ago

Outrageous move to just yank the gem and break builds everywhere.

heax 5y ago
It is not nice, but aside from hobbyists everyone who seriously develops software caches all dependencies in a own repository like nexus etc. It's similar to backups, if you don't have one your data must be worthless.
- samb1729 5y ago
  > aside from hobbyists everyone who seriously develops software caches all dependencies in a own repository like nexus etc. This is a bold claim to make, and one that isn’t supported by my personal observations. Many ‘serious’ software developers have no such intermediate repository for their dependencies.
  - pskinner 5y ago
    We did and so this didn't cause us a major issue today. At my lost job we had the same. And the one before that. This mitigation of a risk that affects business continuity is something that all senior level people need to take seriously at any company, small or large.

crazypython 5y ago

This is flamebait.

xucheng 5y ago

If rails is now considered as GPL because this dependency, does this mean that GitHub Enterprise is now GPL?

dathinab 5y ago
> rails is now considered as GPL no > mean that GitHub Enterprise is now GPL? even less so --- Rails was in a license violating situation, which doesn't make it GPL at all. Then the outcome of a legal case trying to sue someone who is knowingly using rails which unknowingly pulls in a GPL licensed dependency might be less clean cut as you might think. Lastly depending on the version of GPL and other factors like non-clean cut interpretations you might be able to argue that a company building a service using rails wouldn't need to make the service GPL even if they use GPL software to do so (if that GPL software is in the backend only!, not if it's in the UI). The reason is that the service is not distributed by them, it stays internally even through it is communicating with a website(html,css,js, not! server side rendering) which was distributed to the user.
- xucheng 5y ago
  The reason I mentioned GitHub Enterprise instead of GitHub website is because the former one is not a service. It is a software distributed to the end user. Based on your comments, it seems that the existing releases of the GitHub Enterprise are in GPL violation states due to the transitive dependency.
  - dathinab 5y ago
    I guess, yes. But then an interesting question is how transitive copyright violations apply (because this is what a GPL violation legally is, you use the license to use it, nothing more and nothing less). The reason I'm wondering about this is because the situation here is similar to a producer of e.g. cars buying a lets say seat to be put into the car and inside the seat they seat producer used some e.g. screws which violate copyright. Would it be possible that the car manufacturer is hold responsible for the copyright violation enacted by the seat producer? Unlikely I guess? Would it still have some consequences? Surely, but likely negligible: Violating GPL doesn't make any code become GPL (a common misconception) and copyright infringement laws are often based on monetary damage done by the infringement. And lets be honest how much damage is done in case the product is not sold, only given away for free and has competition which is also given away for free with even less constraints?

crazypython 5y ago

Reminder that GPLv3 gives you 30 days to "cure the violation," while the GPLv2 Linus Torvalds prefers immediately creates a copyright violation.

Denvercoder9 5y ago
Note that GPLv3 still immediately creates a copyright violation. It just states that if you cure the violation within 30 days, the license is reinstated. Under GPLv2 you forfeit your license immediately and in perpetuity if you infringe on it.

CodesInChaos 5y ago

How does yanking work for rubygems? In Rust a yanked version can still be downloaded when compiling (you have a lock-file referencing it), but isn't chosen when adding it as a new (transitive) dependency to your application. So yanking shouldn't break any existing applications. (Though since is about a copyright violation, a DMCA notice against the package registry could result in a hard removal, and not just a yanked package)

packrat386 5y ago
A yanked gem won't be downloaded for a `bundle install` or anything of that sort. Aside from a record that it once existed it's basically gone.
- lamontcg 5y ago
  I'm kind of surprised that nobody is talking more about this right now. Everyone with a Gemfile.lock that does a `bundle install` as part of autoscaling (without having vendored gems or a rubygems mirror which doesn't obey yanks) is now broken, potentially in production.
  - quesera 5y ago
    This is true, and important, but: You should never depend on GitHub or RubyGems for deployments. If your deployment failed today due to this gem yank, it has exposed a bug in your systems that you should fix. EDIT: I should not speak in such absolutes. "Never" is a big word and clearly this does not apply in all cases! Depending on third-parties for deployments is a risk -- but might be tolerable, if a multi-hour outage would not be devastating.
    - Toutouxc 5y ago
      What's the solution? Having a mirror/archive of some kind of the gems I use?
      - 5y ago

Benjamin_Dobell 5y ago

Technically everyone using Rails right now may be in violation of the GPL. It doesn't matter that the version of the gem being used claims to be MIT, that's not how licensing/copyright works. Github Enterprise licensees could try hit-up GitHub for source code! EDIT: License in question is GPL, not Affero GPL. So github.com is not covered. However, Github Enterprise is. In all likelihood, Github wouldn't comply, as Github Enterprise licensees have no such license/clause in effect with Github. It'd then be down to the shared-mime-info's copyright holders to take the matter to court. Would be an interesting court case. Some people in the Github issue commented that the XML "database" in question could be used under fair use. That'd be the logical defense. There's been many court cases where the "copyrighted material" is a representation of facts, as opposed to a "creative work", and thus has not been eligible for copyright protection. It's probably also worth noting that "ignorance" is rarely an accepted defense in court.

crazypython 5y ago
> everyone using Rails right now is in violation of the GPL. Not if your use of Rails is limited to your own/your company's own servers, which I imagine most Rails users are. Please don't fall for the flamebait. If they were using GPLv3, they would have an entire month (30 days) to cure the violation. GitHub Enterprise is in violation as it is distributed to third-parties.
- Benjamin_Dobell 5y ago
  Thanks, edited for clarity. In this case it's GPLv2, so no "cure the violation" clause. However, even if this were GPLv3, and you were to "cure the violation" that only reinstates your license i.e. the GPLv3 license. Replacing a dependency won't make previously infringing releases any less infringing.

toomanybeersies 5y ago

It's like left-pad all over again. I wonder how much software will be unbuildable in 10 years time, due to dependencies that can no longer be downloaded. Is there an archive.org for packages?

sosodev 5y ago
I really do wonder about the long term sustainability of package systems. The oldest business software, think COBOL, still works because it can still run the way it did when it was created. Will I be able to say the same about my software in 50+ years?
commandlinefan 5y ago
At least this dependency makes sense: mime type parsing is nontrivial and something you'd logically want to leverage a library for. I can't comprehend how somebody could ever have said "I need left padding. I wonder if there's a library for that somewhere?"
hu3 5y ago
This is why I commit vendor directories. I don't mind if CI ignores it but it's nice to have a fallback that ensures the project is buildable at all times.
pjmlp 5y ago
Always vendor software instead of relying on public repositories.

deleted 5y ago

[deleted]

jahewson 5y ago
> could a library author claim their old code infringed on copyright to force users to upgrade to a paid version? Anybody can claim anything. Only the holder of the infringed copyright has standing to sue, so the library author in your example has no power to force anything. They may also be civilly liable for damages to the library users and, if unlicensed code was planted deliberately, then also criminally (extortion).

cstrahan 5y ago

This was handled quite poorly -- a different course of action could have avoided all the chaos while also resolving the GPL violation. As the GPL FAQ states: > If a programming language interpreter has a license that is incompatible with the GPL, can I run GPL-covered programs on it? (#InterpreterIncompat) > When the interpreter just interprets a language, the answer is yes. The interpreted program, to the interpreter, is just data; the GPL doesn't restrict what tools you process the program with. In mimemagic's case, similar logic could apply: * mimemagic could redistribute the GPL licensed freedesktop.org.xml file. This redistributed file would retain the original GPL license and its terms. * mimemagic could then read the freedesktop.org.xml file at run time and generate whatever data structures it needs. mimemagic would continue to be MIT licensed without violating the GPL license. The problem is that mimemagic includes Ruby code generated from the GPL licensed XML file, and it could be argued that this makes part of mimemagic a derivative of a GPL licensed work. They just needed to stop doing that. Of course I can't point this out to the repository owner now that the repo has been archived and thus commenting is now disabled.

thedanbob 5y ago
That approach is roughly being taken in this fork: https://github.com/jellybob/mimemagic/issues/1 https://github.com/jellybob/mimemagic/issues/1 With the difference that the gem will by default download the XML file at runtime, with the option of using a local copy specified by an environment variable. I guess they are operating under the belief that including any GPL file taints the library, or perhaps they're just playing it safe.
- Dangeranger 5y ago
  Yes, this approach can work, unless the system which Rails/mimemagic is deployed to has restricted network settings. Under a restricted network setting, I believe the only solution which will work is to use a different package offering similar behavior, under a non-GPL license, or to re-implement the existing behavior using the freedesktop.org.xml as an input/output specification, rather than a source for derived code.

lawwantsin17 5y ago

Rails should have zero dependencies. Hot take.

protomyth 5y ago

So, this gem uses the mime database provided by freedesktop.org when the gem could have got the database from http://www.iana.org/assignments/media-types/media-types.xhtml http://www.iana.org/assignments/media-types/media-types.xhtm... which wouldn't be GPL? What manipulation is done by freedesktop.org?

devrand 5y ago
The gem is basically a database of mime type, file extension, and magic bytes. The last two are not included in the linked iana database.
- protomyth 5y ago
  Where did freedesktop.org get the magic bytes? I assume (probably stupidly) that some of that has to be in a file command on some BSD.
  - garblegarble 5y ago
    Here's what the magic bytes look like in FreeBSD, as an example I've linked to the definition of PNG. You can see it's a fair bit more complicated but it does have mime and extension data. https://github.com/freebsd/freebsd-src/blob/master/contrib/file/magic/Magdir/images#L421 https://github.com/freebsd/freebsd-src/blob/master/contrib/f...

rushb 5y ago

Can someone please explain how it is possible to license a database of such sort in the first place? Pretty much all file types have some documentation on how to identify them by reading specific bytes, it's not like the folks from freedesktop invented those methods. On top of that, having the DB licensed under GPL would mean that every line of it is also under GPL, thus forcing the same GPL to all libraries out there that do even a simple PNG check using a magical byte check? I'm really curious to understand how it this licensing works.