It's like left-pad all over again.
I wonder how much software will be unbuildable in 10 years time, due to dependencies that can no longer be downloaded. Is there an archive.org for packages?
Removed gem breaks Rails ActiveStorage
71–80 of 189 posts
Re: Removed gem breaks Rails ActiveStorage
#72Earlier quoted context omitted.
People can of course downvote me for whatever reason they want. I do object to you calling this an advertisement. Sure, it links to my employer's website, but it is an OSS build library that addresses licensing issues. Yes, GIGO applies, but what about the underlying Gem? Was the XML file relicensed? (Haven't dug into that issue 97 referenced in the GH thread.) Edit: from sibling comments, looks like this build syste…
The product in question being open-source or not has nothing to do with whether it's advertising. I would have been okay with it if your product genuinely did something to solve the issue at hand, but as you admit, it does not, so all that's left is "this is a good time to mention my product".
The build tool I linked to would not have solved the issue. I should have read further into the GH repos to understand how the Gem was contaminated. That's my fault.
I have thoughts on the applicability of the build tool mentioned and its relation to licensing issues in general, but I feel I'm repeating myself. I'm not sure continuing this conversation will be productive, so I'm gonna stop.
Re: Removed gem breaks Rails ActiveStorage
#73If rails is now considered as GPL because this dependency, does this mean that GitHub Enterprise is now GPL?
> rails is now considered as GPL
no
> mean that GitHub Enterprise is now GPL?
even less so
---
Rails was in a license violating situation, which doesn't make it GPL at all.
Then the outcome of a legal case trying to sue someone who is knowingly using rails which unknowingly pulls in a GPL licensed dependency might be less clean cut as you might think.
Lastly depending on the version of GPL and other factors like non-clean cut interpretations you might be able to argue that a company building a service using rails wouldn't need to make the service GPL even if they use GPL software to do so (if that GPL software is in the backend only!, not if it's in the UI). The reason is that the service is not distributed by them, it stays internally even through it is communicating with a website(html,css,js, not! server side rendering) which was distributed to the user.
Re: Removed gem breaks Rails ActiveStorage
#74Earlier quoted context omitted.
> you may still have to pay damages This is probably a first time I've seen damages mentioned in relation to GPL violations. Did anyone try enforce this?
There is at least one case[0] I can find. Probably it is exceedingly rare simply because companies are much more likely to settle, especially in the cheapest way possible i.e. stop distributing the tainted software. [0]: https://wiki.fsfe.org/Migrated/GPL%20Enforcement%20Cases#Bus...
To be clear, stop distributing is often "good enough" but technically damages could still be sought for copyright violation.
Re: Removed gem breaks Rails ActiveStorage
#75Earlier quoted context omitted.
> and now the entire thing is "technically" GPL. The "thing" doesn't become GPL, though. They are in breach of the license, it's a major headache, and re-licensing the thing as GPL may be one way forward. That's not an automatism, though, and no court would declare the thing GPL. You may pay hefty "fictitious" licensing fees and (punitive) damages, you may have to stop distributing your thing, but you're not losing c…
> You may pay hefty "fictitious" licensing fees and (punitive) damages, Except in cases like this you likely won't. As it's clearly a mistake you clearly fixed asap its unlikely you have to pay more than small punitive damages. Wrt. license fees and (non punitive damages) it's a bit more tricky but it boils down to the damage done. But as this libraries are only distributed GPL licensed and non essential (can easily…
[deleted]
Re: Removed gem breaks Rails ActiveStorage
#76Technically everyone using Rails right now may be in violation of the GPL. It doesn't matter that the version of the gem being used claims to be MIT, that's not how licensing/copyright works. Github Enterprise licensees could try hit-up GitHub for source code! EDIT: License in question is GPL, not Affero GPL. So github.com is not covered. However, Github Enterprise is. In all likelihood, Github wouldn't comply, as Gi…
> everyone using Rails right now is in violation of the GPL.
Not if your use of Rails is limited to your own/your company's own servers, which I imagine most Rails users are. Please don't fall for the flamebait.
If they were using GPLv3, they would have an entire month (30 days) to cure the violation.
GitHub Enterprise is in violation as it is distributed to third-parties.
Re: Removed gem breaks Rails ActiveStorage
#77If rails is now considered as GPL because this dependency, does this mean that GitHub Enterprise is now GPL?
> rails is now considered as GPL no > mean that GitHub Enterprise is now GPL? even less so --- Rails was in a license violating situation, which doesn't make it GPL at all. Then the outcome of a legal case trying to sue someone who is knowingly using rails which unknowingly pulls in a GPL licensed dependency might be less clean cut as you might think. Lastly depending on the version of GPL and other factors like non-…
The reason I mentioned GitHub Enterprise instead of GitHub website is because the former one is not a service. It is a software distributed to the end user.
Based on your comments, it seems that the existing releases of the GitHub Enterprise are in GPL violation states due to the transitive dependency.
Re: Removed gem breaks Rails ActiveStorage
#78Earlier quoted context omitted.
> but I bet this is a lot of corporate type's worst nightmare, that some underling added some segment of GPL code to their product, and now the entire thing is "technically" GPL. IANAL, but I'm pretty sure this is _not_ how it works. Your code doesn't magically "become" licensed under GPL if you use GPL code. Your code is now in _violation_ of the GPL and one way of fixing it is to re-license your code. Another way i…
> you may still have to pay damages This is probably a first time I've seen damages mentioned in relation to GPL violations. Did anyone try enforce this?
IIRC, there was someone who had written some networking code in Linux and independently started sueing hardware vendors for GPL violations. The Software Freedom Conservancy said that he was doing more harm than good, and said that if someone is violating the GPL, lawsuits should first only require compliance with the GPL, then seek punitive damages if they fail to comply.
Re: Removed gem breaks Rails ActiveStorage
#79If rails is now considered as GPL because this dependency, does this mean that GitHub Enterprise is now GPL?
Rails isn't considered GPL because of this dependency. It is in violation of the GPL¹, which is copyright infringement. Releasing the violating software under the GPL is one way to stop that infringement, but that's not an automatic legal mechanism.
If a copyright owner decides to pursue a GPL violation, they could get damages² and enforce that the infringement stops (i.e. cease using the GPL-licensed software). It's incredibly unlikely any judge would force anybody to release source code.
¹ Actually, Rails itself isn't even in violation, because the project satisfies all the obligations the GPL imposes. GitHub would be in violation.
² In this case, where infringement wasn't intentional, they'd probably get almost nothing provided that the defendant stopped infringing when they learned of it.
Re: Removed gem breaks Rails ActiveStorage
#80vendor your dependencies people
Or you know... just cache them.
If your CI or deploys broke because of this, it basically means you're constantly re-installing all your dependencies from scratch, which is totally silly.
Configure your CI & other tools to cache the bundler directory between builds and not only you'll be protected from this, you'll also make your systems faster.