License of Go/Rust or any statically linked packages

[Vít Ondruch]

Looking for example at git-lfs:

https://src.fedoraproject.org/rpms/git-lfs/blob/master/f/git-lfs.spec

I am afraid that the license field is wrong. Since the Go packages are
statically linked, that means also content of all the BR is part of the
binary packages and therefore should include their licenses. This also
applies to Rust and all other statically linked packages.

I believe the guidelines should be amended to handle this scenario and
all the packages fixed appropriately.

Thoughts?

Vít

[Fedora-legal-list] License of Go/Rust or any statically linked packages

[Igor Raits]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

On Fri, 2020-06-26 at 13:33 +0200, Vít Ondruch wrote:
> Looking for example at git-lfs:
>
> https://src.fedoraproject.org/rpms/git-lfs/blob/master/f/git-lfs.spec
>
> I am afraid that the license field is wrong. Since the Go packages
> are
> statically linked, that means also content of all the BR is part of
> the
> binary packages and therefore should include their licenses. This
> also
> applies to Rust and all other statically linked packages.

I think we already do it fine for Rust, no?

https://src.fedoraproject.org/rpms/rust-ripgrep/blob/master/f/rust-ripgrep.s...
https://src.fedoraproject.org/rpms/rust-bat/blob/master/f/rust-bat.spec#_35
https://src.fedoraproject.org/rpms/rust-starship/blob/master/f/rust-starship...

and so on.
> I believe the guidelines should be amended to handle this scenario
> and
> all the packages fixed appropriately.

We've also discussed this here:
https://src.fedoraproject.org/rpms/rust-rpick/pull-request/1
> Thoughts?

I think Pull Request is very welcomed in the packaging guidelines.
> Vít
>
> legal mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]
> Fedora Code of Conduct:   
> https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> List Guidelines:   
> https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives:   
> https://lists.fedoraproject.org/archives/list/[e-mail]

- -- 
Igor Raits
> -----BEGIN PGP SIGNATURE-----
>
> iQIzBAEBCgAdFiEEcwgJ58gsbV5f5dMcEV1auJxcHh4FAl714H4ACgkQEV1auJxc
> Hh78ow//YSYs1uSZul0G4FZY5arc/Rxhsdsne5ENo8rFoltrebwfwHBxjOmfaD+9
> elPQcPb5P0kYljTt3c3+3m0nvpZPVFFycE+ZlHG+cFgQCSwQ8MBR0ggIJPFtPz6G
> 4HC5VBT7m8bmw/EFk5Gx9D+OZ+NYAlIxIMOQXSnUoZCZAe+YdIohhvVGXh3p+Czj
> WxYmFMqG9ECP6joXEiZE4O4pdA1S0wRL3w1AVMZTyqQSwIPqTOWuIcsb8xj6Dg++
> EfR56Z1L8vnbgajH/F6RzJow4CQJt7qaCnl/ncPUFw194W9gyij75HvtudfJLerb
> JoLXCqqa+kTC18RDjEaJTXFPbrticEMSGaHIWDV+KQU4kWAPlM00Qq2ikVPn01AM
> 23G1T40c8WO/H+jiUtRxBIebaC16BGGf8uMavLocCm0PtvzDExXbNKXsgiKZB9N5
> nl1DmeDHtoUpUUFkOCh6lbYfSZaz2no9W+wGgXMTwGYcpq2UYg0G3dY4gWwy1o+v
> AZbpgoSCyPobqmd54qRWKH7XGXbvTla4qWggL/VMU/jzxPRtnfnMkHmSULA57M36
> zDYs8ff6pUorM1qv/3MJ5BruN0y/QOwMq6dXdKItNm7mAEJ+95S+elh7SFOpQx69
> VnwYfBlWX6Fn93Ti1F7MEcouh9HXN+T1YBWpYBniInqLOny7n4s=
> =QPwA
> -----END PGP SIGNATURE-----

[Fedora-legal-list] License of Go/Rust or any statically linked packages

[Igor Raits]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

On Fri, 2020-06-26 at 13:48 +0200, Igor Raits wrote:
> On Fri, 2020-06-26 at 13:33 +0200, Vít Ondruch wrote:
> > Looking for example at git-lfs:
> >
> > https://src.fedoraproject.org/rpms/git-lfs/blob/master/f/git-lfs.spec
> >
> > I am afraid that the license field is wrong. Since the Go packages
> > are
> > statically linked, that means also content of all the BR is part of
> > the
> > binary packages and therefore should include their licenses. This
> > also
> > applies to Rust and all other statically linked packages.
>
> I think we already do it fine for Rust, no?
>
> https://src.fedoraproject.org/rpms/rust-ripgrep/blob/master/f/rust-ripgrep.s...
> https://src.fedoraproject.org/rpms/rust-bat/blob/master/f/rust-bat.spec#_35
> https://src.fedoraproject.org/rpms/rust-starship/blob/master/f/rust-starship...
>
> and so on.

Forgot to mention that we even have script to generate those:
https://pagure.io/fedora-rust/rust2rpm/blob/master/f/tools/fedora-helper.py
> > I believe the guidelines should be amended to handle this scenario
> > and
> > all the packages fixed appropriately.
>
> We've also discussed this here:
> https://src.fedoraproject.org/rpms/rust-rpick/pull-request/1
> > Thoughts?
>
> I think Pull Request is very welcomed in the packaging guidelines.
> > Vít
> >
> > legal mailing list -- [e-mail]
> > To unsubscribe send an email to [e-mail]
> > Fedora Code of Conduct:   
> > https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> > List Guidelines:   
> > https://fedoraproject.org/wiki/Mailing_list_guidelines
> > List Archives:   
> > https://lists.fedoraproject.org/archives/list/[e-mail]

- -- 
Igor Raits
> -----BEGIN PGP SIGNATURE-----
>
> iQIzBAEBCgAdFiEEcwgJ58gsbV5f5dMcEV1auJxcHh4FAl714egACgkQEV1auJxc
> Hh6lBQ//UTR0h1YecxlcCLV52LdDYLtCb1YFB1GsSJgg5B7Veq8ACRqNy9QqbWxL
> mtluCHJpCM7dpdH5L4+xzKREI6eJHTSCQIRKopcA4bPy97g/0sRQ8+4xLGKJbh7l
> AEa9VAlkYHyqCDbmc2T+QEwXru7kXTNio14eNxIpwn3mOZpab9SYMlu7H6sHKPy6
> oWJF0HIROFW5vNwwsB6UW7IV044IJ72zYG2LN2tjNGsTFvqR5LTfaJImPPP4vWJT
> 8YJfcFCFdQXnwunj5Y1DJwgSLNBem31MOhS+Vq6E3nXjsTflNVEt4/UPB5HRrJcl
> vYoeaVHcE1Gbn2FUWvXTe9TRdujBpVVT4rgvxPh+cKh9x5FrS4Eg1Jj+WrIgszYn
> NWIrJW0e2iwZZN9P7ZTuefbdjKhKyDvqIghNKt16gcfzQ6L/yYfiKURKBOYiRtmA
> Q+KStJRogH6kwWMWlPlNpRpDr9rCpC5j+F+Jg9IfXFUP10DswN8zXwPsab39nSeA
> e51Ko5YqRPapSCe6gSWYbI1g4ngz4vwxpPw36UTOEiDuHR3BNKZvNeTNB/lzDuoh
> 6DIIXyWfeUmsuhSN6igc6j+CpQtnWtU94ESM6BbfjAnJgNahrY4pPkUQ3XzGU9yR
> ewl/fjyQAIkMNWV3RwMp5aCIypFNJDgRT0RQ9eFmYBqeOGs6/nY=
> =3AC1
> -----END PGP SIGNATURE-----

[Fedora-legal-list] License of Go/Rust or any statically linked packages

[Mikhail Zabaluev]

Hi,

Some of the issues with licensing and security vulnerability audit could be
solved by providing a Flatpak runtime or extension containing the
dynamically loaded libstd and other core Rust libraries, and the matching
Rust toolchain SDK geared towards dynamic linking. This is not the
mainstream way of building applications with Rust, but in the controlled
environment of Flatpak builds, the ABI fragility can be taken out of the
picture.

However, some commitment from upstream would be required first:
https://github.com/rust-lang/rust/issues/73932

Best regards,
  Mikhail

пт, 26 июн. 2020 г. в 14:56, Igor Raits :
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA512
>
> On Fri, 2020-06-26 at 13:48 +0200, Igor Raits wrote:
> > On Fri, 2020-06-26 at 13:33 +0200, Vít Ondruch wrote:
> > > Looking for example at git-lfs:
> > >
> > > https://src.fedoraproject.org/rpms/git-lfs/blob/master/f/git-lfs.spec
> > >
> > > I am afraid that the license field is wrong. Since the Go packages
> > > are
> > > statically linked, that means also content of all the BR is part of
> > > the
> > > binary packages and therefore should include their licenses. This
> > > also
> > > applies to Rust and all other statically linked packages.
> >
> > I think we already do it fine for Rust, no?
>
> https://src.fedoraproject.org/rpms/rust-ripgrep/blob/master/f/rust-ripgrep.s...
> >
>
> https://src.fedoraproject.org/rpms/rust-bat/blob/master/f/rust-bat.spec#_35
> >
>
> https://src.fedoraproject.org/rpms/rust-starship/blob/master/f/rust-starship...
> > and so on.
>
> Forgot to mention that we even have script to generate those:
> https://pagure.io/fedora-rust/rust2rpm/blob/master/f/tools/fedora-helper.py
> > > I believe the guidelines should be amended to handle this scenario
> > > and
> > > all the packages fixed appropriately.
> >
> > We've also discussed this here:
> > https://src.fedoraproject.org/rpms/rust-rpick/pull-request/1
> > > Thoughts?
> >
> > I think Pull Request is very welcomed in the packaging guidelines.
> > > Vít
> > >
> > > legal mailing list -- [e-mail]
> > > To unsubscribe send an email to [e-mail]
> > > Fedora Code of Conduct:
> > > https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> > > List Guidelines:
> > > https://fedoraproject.org/wiki/Mailing_list_guidelines
> > > List Archives:
>
> https://lists.fedoraproject.org/archives/list/[e-mail]
>
> Igor Raits 
> -----BEGIN PGP SIGNATURE-----
>
> iQIzBAEBCgAdFiEEcwgJ58gsbV5f5dMcEV1auJxcHh4FAl714egACgkQEV1auJxc
> Hh6lBQ//UTR0h1YecxlcCLV52LdDYLtCb1YFB1GsSJgg5B7Veq8ACRqNy9QqbWxL
> mtluCHJpCM7dpdH5L4+xzKREI6eJHTSCQIRKopcA4bPy97g/0sRQ8+4xLGKJbh7l
> AEa9VAlkYHyqCDbmc2T+QEwXru7kXTNio14eNxIpwn3mOZpab9SYMlu7H6sHKPy6
> oWJF0HIROFW5vNwwsB6UW7IV044IJ72zYG2LN2tjNGsTFvqR5LTfaJImPPP4vWJT
> 8YJfcFCFdQXnwunj5Y1DJwgSLNBem31MOhS+Vq6E3nXjsTflNVEt4/UPB5HRrJcl
> vYoeaVHcE1Gbn2FUWvXTe9TRdujBpVVT4rgvxPh+cKh9x5FrS4Eg1Jj+WrIgszYn
> NWIrJW0e2iwZZN9P7ZTuefbdjKhKyDvqIghNKt16gcfzQ6L/yYfiKURKBOYiRtmA
> Q+KStJRogH6kwWMWlPlNpRpDr9rCpC5j+F+Jg9IfXFUP10DswN8zXwPsab39nSeA
> e51Ko5YqRPapSCe6gSWYbI1g4ngz4vwxpPw36UTOEiDuHR3BNKZvNeTNB/lzDuoh
> 6DIIXyWfeUmsuhSN6igc6j+CpQtnWtU94ESM6BbfjAnJgNahrY4pPkUQ3XzGU9yR
> ewl/fjyQAIkMNWV3RwMp5aCIypFNJDgRT0RQ9eFmYBqeOGs6/nY=
> =3AC1
> -----END PGP SIGNATURE-----
> _______________________________________________
> Rust mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]
> Fedora Code of Conduct:
> https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives:
> https://lists.fedoraproject.org/archives/list/[e-mail]