Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Removed gem breaks Rails ActiveStorage

github.com

Post reply on HN
Print view View original

21–30 of 189 posts

Re: Removed gem breaks Rails ActiveStorage

#21

Post by CodesInChaos »

1. Is a database like that even copyrightable, especially in the US?

> United States: Uncreative collections of facts are outside of Congressional authority under the Copyright Clause (Article I, § 8, cl. 8) of the United States Constitution, therefore no database right exists in the United States. Originality is the sine qua non of copyright in the United States (see Feist Publications v. Rural Telephone Service). https://en.wikipedia.org/wiki/Database_right#United_States

2. I'm skeptical that using a GPLed database makes this library a derivative work of the GPLed database, though the "distribute as a part of the whole" clause still applies

> These requirements apply to the modified work as a whole. If identifiable sections of that work are not derived from the Program, and can be reasonably considered independent and separate works in themselves, then this License, and its terms, do not apply to those sections when you distribute them as separate works

> But when you distribute the same sections as part of a whole which is a work based on the Program, the distribution of the whole must be on the terms of this License, whose permissions for other licensees extend to the entire whole, and thus to each and every part regardless of who wrote it.

Re: Removed gem breaks Rails ActiveStorage

#22

Post by Denvercoder9 »

gedy wrote: post #9
wokwokwok wrote: post #7

The reason this is happening is not obvious without reading https://github.com/minad/mimemagic/issues/97 > I've historically been the maintainer of shared-mime-info for around 15 years, and script/freedesktop.org.xml looks like it's a copy of the database shipped with shared-mime-info, which is released under the GPL, with shared-mime-info's translators work merged in, and the GPL header removed. > The license that y…

I guess this is subjective (though maybe not legally), but this lookup table of extensions to mimetypes doesn't feel like GPL "software". It's just a description of other software's conventions using the GPLed source as a reference: https://github.com/minad/mimemagic/blob/master/lib/mimemagic... To create a non-GPL version, you would have to do what? Research extensions without letting your eyes see this GPLed list?

> this lookup table of extensions to mimetypes doesn't feel like GPL "software".

Copyright nor the GPL are limited to software, collections of data are copyrightable as well; and thus they can fall under the GPL as well.

> To create a non-GPL version, you would have to do what? Research extensions without letting your eyes see this GPLed list?

Yes.

Re: Removed gem breaks Rails ActiveStorage

#23

Post by misnome »

spijdar wrote: post #14

This is the sort of thing that makes some people really wary of the GPL and other "viral" licenses, and I don't think you can blame them. The "blame" for this falls on someone for throwing in GPL'd code into an MIT project, but the headache drops onto a whole bunch more people down the line. It seems other commenters think this will probably be alright, but I bet this is a lot of corporate type's worst nightmare, tha…

> makes some people really wary of the GPL and other "viral" licenses

It's worse than that surely - as in this case avoiding GPL doesn't prevent the problem. This sounds like for a medium-paranoid-legal perspective, that it would "prove" that even non-GPL code isn't safe, thus discouraging from usage of any open source software [edit: dependencies]

> One can only imagine if it was AGPL instead of GPL

Right, that seems like the only saving grace that avoids this being an potentially apocalyptic event.

Re: Removed gem breaks Rails ActiveStorage

#24

Post by joshuaissac »

misnome wrote: post #4

Is there any precedent to what happens, or could happen, if a project changes licence like this in a patch release? Is there any provision for mistakes like this in the GPL, or is everything that has ever used this package now considered "fair game" for classing as GPL and making source requests? (although I imagine rails being a web framework probably protects anything using rails and only serving the end results pu…

GPL licensing of derived works is not automatic. Instead, distributing under incompatible terms is copyright infringement.

It may be possible to remedy this infringement by releasing the source code under the GPL, but it also may not (e.g. source code contains un-relicenceable code from a third-party), in which case the only remedy is to not distribute the program at all.

Re: Removed gem breaks Rails ActiveStorage

#25

Post by graywh »

freedomben wrote: post #13
TomOwens wrote: post #10

This just bit me. The first thing that I noticed was that some people are not understanding the GPL. It's far more impactful to Rails than the vast majority of web applications built using Rails. The use of GPL'd files means that the gem itself has to be released under the GPL. Since the gem is now under the GPL, dependencies are also under the GPL. That would include Rails. However, even if Rails was under the GPL,…

After the "left-pad" fiasco, and a similar event on the Ruby side, I started vendoring my dependencies as standard practice. I have not been sorry yet, in fact I feel vindicated in that approach.

we get a form of this with our two-stage image building process -- the first stage installs all dependencies and we only update it when dependencies change

Re: Removed gem breaks Rails ActiveStorage

#26

Post by crazypython »

TomOwens wrote: post #10

This just bit me. The first thing that I noticed was that some people are not understanding the GPL. It's far more impactful to Rails than the vast majority of web applications built using Rails. The use of GPL'd files means that the gem itself has to be released under the GPL. Since the gem is now under the GPL, dependencies are also under the GPL. That would include Rails. However, even if Rails was under the GPL,…

> The use of GPL'd files means that the gem itself has to be released under the GPL. Since the gem is now under the GPL, dependencies are also under the GPL.

No, that's not true. You can dual-license dependent software under GPL and MIT. The GPL merely requires a license at least as permissive as it.

Re: Removed gem breaks Rails ActiveStorage

#27

Post by sc00ty »

mooreds wrote: post #20

I give my boss a hard time about our dependency management system because it is relatively unknown[0], but licensing is built into it from the ground up. You can't import any dependency (no matter how buried) without assigning a license to it. This lets us confidently know, via software, the open and closed source licenses in our code base. Licensing is one of those out of band concerns that doesn't burn you until it…

How do you handle transitive dependencies?

Re: Removed gem breaks Rails ActiveStorage

#28

Post by Denvercoder9 »

mooreds wrote: post #20

I give my boss a hard time about our dependency management system because it is relatively unknown[0], but licensing is built into it from the ground up. You can't import any dependency (no matter how buried) without assigning a license to it. This lets us confidently know, via software, the open and closed source licenses in our code base. Licensing is one of those out of band concerns that doesn't burn you until it…

> You can't import any dependency (no matter how buried) without assigning a license to it.

That wouldn't help here. Mimemagic declared itself to be MIT, and only turned out to be GPL because it embedded a file derived from GPL sources. That file didn't even have a license header specifying it as GPL.

Anyone importing it would mark it as MIT.

EDIT: Mimemagic didn't even turn out to be GPL, it turned out to be infringing on the GPL, and the author solved that by relicensing it to GPL.

Re: Removed gem breaks Rails ActiveStorage

#29

Post by Trasmatta »

mooreds wrote: post #20

I give my boss a hard time about our dependency management system because it is relatively unknown[0], but licensing is built into it from the ground up. You can't import any dependency (no matter how buried) without assigning a license to it. This lets us confidently know, via software, the open and closed source licenses in our code base. Licensing is one of those out of band concerns that doesn't burn you until it…

That's a good idea generally, but it wouldn't have saved you from this issue. The gem had an MIT license, and the offending file was copied in, not sourced through a dependency.

Re: Removed gem breaks Rails ActiveStorage

#30

Post by imhoguy »

gedy wrote: post #18
imhoguy wrote: post #8

TL;DR This unfortunate chain of events is rooted in licensing violation: https://github.com/minad/mimemagic/issues/97 Mimemagic got its MIME tables source generated from `freedesktop.org.xml` file, which is licensed under GPL2, and the resulting source was released under permissive MIT license. All prior 0.3.6 mimemagic versions violated the GPL2 license. The author of mimemagic couldn't change the pre-0.3.6 versions…

Since the xml file is not included in the source, and was just a reference for a rb source file's lookup table, it just feels weird that 3 fixes the violation.

IANAL but it explicitly states it is derivative from the XML file: https://github.com/minad/mimemagic/blob/master/lib/mimemagic...
Post reply on HN