Removed gem breaks Rails ActiveStorage

Looking through the linked comments & issues, it will be interesting to see how many people blindly adopt (forced into) GPL2 license. I wonder how big the R for spreading is? All from an XML file for mimetype info

Is there any precedent to what happens, or could happen, if a project changes licence like this in a patch release? Is there any provision for mistakes like this in the GPL, or is everything that has ever used this package now considered "fair game" for classing as GPL and making source requests?

(although I imagine rails being a web framework probably protects anything using rails and only serving the end results publicly, this sounds like the sort of nightmare scenario that would make legal departments nervous about open source)

IANAL so take with a grain of salt, but legal action is very rare under the GPL, and it's also expensive. In a case like this also I think it would be a tough case. I wouldn't worry about it, at least not currently.

TL;DR

This unfortunate chain of events is rooted in licensing violation: https://github.com/minad/mimemagic/issues/97

Mimemagic got its MIME tables source generated from `freedesktop.org.xml` file, which is licensed under GPL2, and the resulting source was released under permissive MIT license. All prior 0.3.6 mimemagic versions violated the GPL2 license.

The author of mimemagic couldn't change the pre-0.3.6 versions so they simply deleted them.

Unfortunately "the fix" has broken the dependent projects and such have to either:

1) upgrade to GPL2 compatible mimemagic 0.3.6 or 0.4.0, which conflicts with MIT licensed projects like Rails or

2) build/use other MIME resolving library with has permissive license or

3) fork mimemagic under MIT and implement dynamic loading of `freedesktop.org.xml` which wouldn't violate the license.

This just bit me.

The first thing that I noticed was that some people are not understanding the GPL. It's far more impactful to Rails than the vast majority of web applications built using Rails. The use of GPL'd files means that the gem itself has to be released under the GPL. Since the gem is now under the GPL, dependencies are also under the GPL. That would include Rails. However, even if Rails was under the GPL, organizations could still build closed-source web applications using Rails since network access is not distribution. That's the whole point of the AGPL.

However, it does raise a lot of questions about when someone is allowed to yank a gem (or any library, really). It's been a while since I took a deep dive, but I was under the general impression that there was some leeway around not breaking the world when rectifying license issues. I would think that releasing new versions under the correct license and giving everyone notice and time (30 days?) to update would be fine for most copyright holders. I'd suspect that most open source developers wouldn't want to break the world. The sudden yanking with no warning caused builds to fail everywhere.

The absolute worst thing, though, was that changing a license should not be a minor (or a major) version number increase. It should be a patch. The breaking was simply because Rails is pinned to 0.3.x, but the first release under the new license was 0.4.x. Fortunately, the author released a 0.3.6 patch with the correct license, so it's just a matter of a bundle update to get the latest version. But if he hadn't, Rails would have had to release a new version and anyone on legacy/unsupported Rails versions would be hosed if they had to rebuild and redeploy.

This is a really good reason to stand up your own artifact repository and put all of your third-party dependencies in it, especially if you're a business.