chicken-hackers
[Top][All Lists]
Advanced

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [Chicken-hackers] Re: Backdoor GPL in message-digest


From: Peter Bex
Subject: Re: [Chicken-hackers] Re: Backdoor GPL in message-digest
Date: Tue, 24 Aug 2010 11:59:39 +0200
User-agent: Mutt/1.4.2.3i

On Tue, Aug 24, 2010 at 10:41:02AM +0100, Alaric Snell-Pym wrote:
> Relatedly, I've been wondering about how to neatly handle "optional
> dependencies" in eggs.
> 
> Take Ugarit, for example. It has pluggable hash functions and
> compression engines and storage backends. If I want to offer the ability
> to use some GPL-ed storage backend - creating a GPL-ed Ugarit binary - I
> don't want to then taint Ugarit.
> 
> Yes, I know I can work around it by making Ugarit containg a plugin
> registry, and then having separate GPL-ed backend eggs that depend on
> Ugarit and work by registering themselves as plugins somehow, but that's
> Extra Work.

I don't see how that Extra Work is more Extra Work than testing every
possible permutation of options you would have in order to verify it
works in all those cases, let alone testing those permutations on
different OS/architecture combinations.  I think that's even harder
to test consistently.  What do we tell Salmonella to test?

This is similar to the mess I described with PHP (when Kon suggested
adding compile-time options to Chicken).  It's more hassle than it's
worth.

> AIUI, the GPL issue is this: We can have BSD or GPL licenses on source
> code to our heart's content, but a binary that contains GPL code *or
> dynamically links to GPL code* is then a GPL binary, and all source code
> that went into it must be released?
...
> But by that interpretation, a BSD egg could have an optional GPL
> dependency, and thus be able to generate BSD and GPL binaries, depending
> on whether the optional dependency was used. Right?!?

I think that's correct.

> chicken-install might be extended with a 'viral' flag on an egg's
> license, and then compute a license for every *installed compiled egg*,
> which will be the intersection of the egg's own license and the viral
> licenses of all its dependencies, and a viral flag if the egg's own
> license is viral. This could be easily represented as a symbol (the
> egg's native license) and a list of viral licenses (which may include
> the egg's own license if it's viral, and which all dependent eggs inherit).

This would be useful, but not general enough.  There's not just the
virality of the GPL to consider. There may also simply be incompatible
licenses.  For the GPL, FSF maintains a list of free software licenses
that are incompatible with it:
http://www.gnu.org/licenses/license-list.html#GPLIncompatibleLicenses

There are probably similar lists for the BSD license, but I don't know
any offhand.

Also note that the LGPL is incompatible with the GPL in that you cannot
link a LGPL library or program to a GPL library(!)   I think if we build
a license checking feature into chicken-install, it should handle
incompatible licenses in general.

> Then people can easily know if they've just built a GPL binary!

Eww! :)

Cheers,
Peter
-- 
http://sjamaan.ath.cx
--
"The process of preparing programs for a digital computer
 is especially attractive, not only because it can be economically
 and scientifically rewarding, but also because it can be an aesthetic
 experience much like composing poetry or music."
                                                        -- Donald Knuth



reply via email to

[Prev in Thread] Current Thread [Next in Thread]