Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Removed gem breaks Rails ActiveStorage

github.com

Post reply on HN
Print view View original

31–40 of 189 posts

Re: Removed gem breaks Rails ActiveStorage

#31

Post by TomOwens »

Denvercoder9 wrote: post #16
TomOwens wrote: post #10

This just bit me. The first thing that I noticed was that some people are not understanding the GPL. It's far more impactful to Rails than the vast majority of web applications built using Rails. The use of GPL'd files means that the gem itself has to be released under the GPL. Since the gem is now under the GPL, dependencies are also under the GPL. That would include Rails. However, even if Rails was under the GPL,…

> The absolute worst thing, though, was that changing a license should not be a minor (or a major) version number increase. The license didn't change. It was always already GPL, due to the usage of GPL-licensed code, regardless of what the metadata said. The change just made the metadata correctly reflect reality. [EDIT: I should clarify that technically mimemagic wasn't already GPL, but the only legal way to use it…

Yeah. That's a better way of putting it. The author didn't opt to change the license. He corrected a licensing error.

I do agree that making the downstream users aware is important, I just don't agree that immediately yanking is the right solution. Putting out a new version would have been nice. Adding a post-install message to the new versions would have been good to start to get the word out. Not sure how far to take it, but opening issues with dependencies (RubyGems provides this information) would have also been nice, giving the major dependencies a good notice before yanking.

Re: Removed gem breaks Rails ActiveStorage

#32

Post by majewsky »

mooreds wrote: post #20

I give my boss a hard time about our dependency management system because it is relatively unknown[0], but licensing is built into it from the ground up. You can't import any dependency (no matter how buried) without assigning a license to it. This lets us confidently know, via software, the open and closed source licenses in our code base. Licensing is one of those out of band concerns that doesn't burn you until it…

You're correctly getting downvoted for your thinly-veiled advertisement because it's besides the point. The gem was labeled as "license: MIT" all the time, but that label was just factually wrong. Garbage in, garbage out.

Re: Removed gem breaks Rails ActiveStorage

#33

Post by imhoguy »

freedomben wrote: post #13
TomOwens wrote: post #10

This just bit me. The first thing that I noticed was that some people are not understanding the GPL. It's far more impactful to Rails than the vast majority of web applications built using Rails. The use of GPL'd files means that the gem itself has to be released under the GPL. Since the gem is now under the GPL, dependencies are also under the GPL. That would include Rails. However, even if Rails was under the GPL,…

After the "left-pad" fiasco, and a similar event on the Ruby side, I started vendoring my dependencies as standard practice. I have not been sorry yet, in fact I feel vindicated in that approach.

Whoever has missed the event: https://www.theregister.com/2016/03/23/npm_left_pad_chaos/

Re: Removed gem breaks Rails ActiveStorage

#34

Post by boleary-gl »

gedy wrote: post #9
wokwokwok wrote: post #7

The reason this is happening is not obvious without reading https://github.com/minad/mimemagic/issues/97 > I've historically been the maintainer of shared-mime-info for around 15 years, and script/freedesktop.org.xml looks like it's a copy of the database shipped with shared-mime-info, which is released under the GPL, with shared-mime-info's translators work merged in, and the GPL header removed. > The license that y…

I guess this is subjective (though maybe not legally), but this lookup table of extensions to mimetypes doesn't feel like GPL "software". It's just a description of other software's conventions using the GPLed source as a reference: https://github.com/minad/mimemagic/blob/master/lib/mimemagic... To create a non-GPL version, you would have to do what? Research extensions without letting your eyes see this GPLed list?

Or use another source that is non-GPL - that's proposed here: https://github.com/rails/rails/issues/41750#issuecomment-805...

Re: Removed gem breaks Rails ActiveStorage

#35

Post by boleary-gl »

CodesInChaos wrote: post #21

1. Is a database like that even copyrightable, especially in the US? > United States: Uncreative collections of facts are outside of Congressional authority under the Copyright Clause (Article I, § 8, cl. 8) of the United States Constitution, therefore no database right exists in the United States. Originality is the sine qua non of copyright in the United States (see Feist Publications v. Rural Telephone Service). h…

Anytime you publish something, it is copyrighted. The data within may not be, but my presentation of it in a certain database certainly is.

Re: Removed gem breaks Rails ActiveStorage

#36

Post by Tomte »

spijdar wrote: post #14

This is the sort of thing that makes some people really wary of the GPL and other "viral" licenses, and I don't think you can blame them. The "blame" for this falls on someone for throwing in GPL'd code into an MIT project, but the headache drops onto a whole bunch more people down the line. It seems other commenters think this will probably be alright, but I bet this is a lot of corporate type's worst nightmare, tha…

> and now the entire thing is "technically" GPL.

The "thing" doesn't become GPL, though.

They are in breach of the license, it's a major headache, and re-licensing the thing as GPL may be one way forward.

That's not an automatism, though, and no court would declare the thing GPL.

You may pay hefty "fictitious" licensing fees and (punitive) damages, you may have to stop distributing your thing, but you're not losing control.

Re: Removed gem breaks Rails ActiveStorage

#37

Post by derefr »

gedy wrote: post #18
imhoguy wrote: post #8

TL;DR This unfortunate chain of events is rooted in licensing violation: https://github.com/minad/mimemagic/issues/97 Mimemagic got its MIME tables source generated from `freedesktop.org.xml` file, which is licensed under GPL2, and the resulting source was released under permissive MIT license. All prior 0.3.6 mimemagic versions violated the GPL2 license. The author of mimemagic couldn't change the pre-0.3.6 versions…

Since the xml file is not included in the source, and was just a reference for a rb source file's lookup table, it just feels weird that 3 fixes the violation.

I think the pedantic interpretation of the GPL “depends on” clause is that burning a content-hash of a GPLed release of a work into your work, such that your work retrieves and installs the GPLed work-release by its content-hash (or retrieves the work-release by name + version and then verifies it by content hash — as a Bundler Gemfile.lock does), is “depending on” the GPLed release of the upstream work. Due to the explicitness of the reference, the only release that the downstream project could be depending on, is a GPLed release. (Remember, GPLed code releases need to embed the GPL license somewhere, so there’s no posssibility of a byte-for-byte identical dep being created by coincidence that isn’t GPLed.)

Meanwhile, just saying “I’ll take whatever is in the environment at [path]” is a more plugin-like approach: a GPLed database could be placed there, but a differently-licensed database could be there instead. Because you’re not making any explicit reference to any particular release of any particular work, you aren’t infected by the copyright/licensing of the particular work/release that happens to be there.

It’s a lot like the case-law of the DMCA’s “tool used for breaking copyright” clause: if the tool has features that exclusively help to break copyright, with no other uses, then it’s in violation of the DMCA; while if all features of the tool have other potential use-cases, then it doesn’t.

In both cases, it’s a question of whether there’s a “reasonable doubt” on what exactly the project was aiming to achieve / link against. If the project is explicit and removes all doubt, then it’s in violation.

Re: Removed gem breaks Rails ActiveStorage

#38

Post by judofyr »

spijdar wrote: post #14

This is the sort of thing that makes some people really wary of the GPL and other "viral" licenses, and I don't think you can blame them. The "blame" for this falls on someone for throwing in GPL'd code into an MIT project, but the headache drops onto a whole bunch more people down the line. It seems other commenters think this will probably be alright, but I bet this is a lot of corporate type's worst nightmare, tha…

> but I bet this is a lot of corporate type's worst nightmare, that some underling added some segment of GPL code to their product, and now the entire thing is "technically" GPL.

IANAL, but I'm pretty sure this is _not_ how it works. Your code doesn't magically "become" licensed under GPL if you use GPL code. Your code is now in _violation_ of the GPL and one way of fixing it is to re-license your code. Another way is to eliminate the dependency.

However, if you decide to re-license to GPL then you may still have to pay damages for the time you were violating GPL.

In practice I can't imagine that a court would make anyone pay anything for this incident.

Re: Removed gem breaks Rails ActiveStorage

#40

Post by misnome »

joshuaissac wrote: post #24
misnome wrote: post #4

Is there any precedent to what happens, or could happen, if a project changes licence like this in a patch release? Is there any provision for mistakes like this in the GPL, or is everything that has ever used this package now considered "fair game" for classing as GPL and making source requests? (although I imagine rails being a web framework probably protects anything using rails and only serving the end results pu…

GPL licensing of derived works is not automatic. Instead, distributing under incompatible terms is copyright infringement. It may be possible to remedy this infringement by releasing the source code under the GPL, but it also may not (e.g. source code contains un-relicenceable code from a third-party), in which case the only remedy is to not distribute the program at all.

Ah, right, so it doesn't make it automatically GPL2 unless they want to continue to distribute it - and presumably only the original GPL2 licence-holder(s) are in the position to raise the issue of past infringement-via-distribution.

And so presumably unless rails was actively distributing bundles with it they'd would not be counted as "distributing" this GPL dependency.

It does sound like exactly the sort of hole that AGPL is designed to close is the saving grace here?

Post reply on HN