Removed gem breaks Rails ActiveStorage

https://github.com/rails/rails/issues/41750

by ldulcic • 5 years ago

265 183 5 years ago

verdverm• 5 years ago

Looking through the linked comments & issues, it will be interesting to see how many people blindly adopt (forced into) GPL2 license. I wonder how big the R for spreading is? All from an XML file for mimetype info

ivanbakel3• 5 years ago

It's interesting how many commenters on the various issues around the license change seem to think that software licensing is an inconvenience, rather than a serious legal question.

michaelt2• 5 years ago

Well, when viewed from the perspective of legal realism, a lot of software licensing is a joke.

I'm an open source developer - but even if Oracle had violated my license terms and I had indisputable proof of it, I wouldn't take them to court.

Arguing about the differences between GPL3 and WTFPL in a hypothetical court case is about as meaningful and productive as arguing about the differences between a chainsaw and a katana in a hypothetical zombie apocalypse.

ivanbakel3• 5 years ago

I'm an open source developer - but even if Oracle had violated my license terms and I had indisputable proof of it, I wouldn't take them to court.

Why do you use a license with those terms, then?

Court cases over license violations are not hypothetical. Perhaps your stance is that licenses are frivolous, but there are plenty of people in software who don't share it. And those people, given "indisputable proof" of a significant license violation, would happily take you to court (with FSF support) to force compliance, if necessary.

xpe2• 5 years ago

Large organizations often are risk averse with regards to legal matters. They don't want to be sued for misusing a license. The threat of litigation has a real effect, even if one particular individual is unlikely to bring a case.

xpe2• 5 years ago

Saying "software licensing is a joke" and "hypothetical zombie apocalypse" may be provocative and/or funny, but it distracts attention from the underlying logic. In my view, when conversations start going down this path, they become less substantive and interesting, because the meaning becomes muddled.

I try to always remember:

* One person writes a comment one time. N people read it. N >> 1. Therefore strive to be clear.

* "Comments should get more thoughtful and substantive, not less, as a topic gets more divisive." https://news.ycombinator.com/newsguidelines.html

riffraff• 5 years ago

I'm an open source developer - but even if Oracle had violated my license terms and I had indisputable proof of it, I wouldn't take them to court.

that's one of the good reasons to assign copyright to a larger entity (Apache foundation, FSF, or whatever): they'll fight to defend the license when it is violated with means you do not have.

iso1631• 5 years ago

So you're saying the legal system is stacked in favor of the large, so we shouldn't bother with laws at all?

If you broke Oracle's license terms they'll be suing you.

misnome4• 5 years ago

Is there any precedent to what happens, or could happen, if a project changes licence like this in a patch release? Is there any provision for mistakes like this in the GPL, or is everything that has ever used this package now considered "fair game" for classing as GPL and making source requests?

(although I imagine rails being a web framework probably protects anything using rails and only serving the end results publicly, this sounds like the sort of nightmare scenario that would make legal departments nervous about open source)

freedomben4• 5 years ago

IANAL so take with a grain of salt, but legal action is very rare under the GPL, and it's also expensive. In a case like this also I think it would be a tough case. I wouldn't worry about it, at least not currently.

misnome4• 5 years ago

I expect this whole discussion could have IANAL prepended to it - but it seems like an interesting question - what the licence strictly implies, beyond "It probably doesn't matter as probably nobody will take legal action against you".

Or is lack of enforcement, in the end case, the only thing that matters - making most discussions about open licences and in-depth consideration meaningless?

joshuaissac• 5 years ago

GPL licensing of derived works is not automatic. Instead, distributing under incompatible terms is copyright infringement.

It may be possible to remedy this infringement by releasing the source code under the GPL, but it also may not (e.g. source code contains un-relicenceable code from a third-party), in which case the only remedy is to not distribute the program at all.

misnome4• 5 years ago

Ah, right, so it doesn't make it automatically GPL2 unless they want to continue to distribute it - and presumably only the original GPL2 licence-holder(s) are in the position to raise the issue of past infringement-via-distribution.

And so presumably unless rails was actively distributing bundles with it they'd would not be counted as "distributing" this GPL dependency.

It does sound like exactly the sort of hole that AGPL is designed to close is the saving grace here?

freedomben4• 5 years ago

TLDR: the mimemagic gem was MIT licensed, but an issue was opened where it was reported that mimemagic is using a GPLv2 source file. Legally (IANAL) this forces mimemagic to become GPLv2. The mimemagic gem was changed to GPLv2.

However rails depends on mimemagic, and that means rails needs to be GPLv2, which is obviously a big problem. The discussion around this is taking place in the github repo for rails because mimemagic was archived for some reason (at least temporarily).

wokwokwok• 5 years ago

The reason this is happening is not obvious without reading https://github.com/minad/mimemagic/issues/97

I've historically been the maintainer of shared-mime-info for around 15 years, and script/freedesktop.org.xml looks like it's a copy of the database shipped with shared-mime-info, which is released under the GPL, with shared-mime-info's translators work merged in, and the GPL header removed.
The license that you're shipping mimemagic under (MIT) isn't compatible with shared-mime-info's.

Seems like quite a reasonable request, even if folk don’t like the results.

..and to be clear, I’m quite sure that rolling back to the commit before the license change does exactly nothing to address the issue.

You don’t magically get your MIT license back by forking before the license change was added, that’s not how it works.

If the previous version contains GPL code, it’s GPL. It doesn’t matter if you slap an MIT license file on it, or used it in “good faith” presuming it was MIT license.

gedy2• 5 years ago

I guess this is subjective (though maybe not legally), but this lookup table of extensions to mimetypes doesn't feel like GPL "software". It's just a description of other software's conventions using the GPLed source as a reference: https://github.com/minad/mimemagic/blob/master/lib/mimemagic...

To create a non-GPL version, you would have to do what? Research extensions without letting your eyes see this GPLed list?

imhoguy4• 5 years ago

vs this https://gitlab.freedesktop.org/xdg/shared-mime-info/-/blob/m...

Denvercoder96• 5 years ago

this lookup table of extensions to mimetypes doesn't feel like GPL "software".

Copyright nor the GPL are limited to software, collections of data are copyrightable as well; and thus they can fall under the GPL as well.

To create a non-GPL version, you would have to do what? Research extensions without letting your eyes see this GPLed list?

Yes.

boleary-gl3• 5 years ago

Or use another source that is non-GPL - that's proposed here: https://github.com/rails/rails/issues/41750#issuecomment-805...

jahewson2• 5 years ago

I agree. Lists of facts are not eligible for copyright in the US, most famously phone books. It’s debatable as to whether or not this file is pure facts but I’m having a hard time seeing it as a “creative expression”.

alberth• 5 years ago

"You don’t magically get your MIT license back by forking before the license change"

Am I understanding this correctly. If for example, 15 years you have an MIT code base with only MIT code. Then yesterday, you add a few lines of GPL code. Then today, you remove 100% of the GPL code you just previously added in order to revert back your codebase to be only MIT code ... it's no longer "MIT"? The GPL has now tainted their entire existing codebase?

psanford• 5 years ago

No.

terramex• 5 years ago

No, in this hypothetical case you would be fine. Mimemagic case is more like 15 years ago you had a MIT codebase that contained hidden GPL-derived code. One day you are notified about that violation and relicense whole codebase to GPL, but the code that was already in the repository before has never been truly MIT - it was always violating GPL. To fix this you can either relicense whole codebase to GPL (what mimemagic chose) or remove GPL code from codebase, stop distribution of older versions and continue your project as MIT.

Going back to older version of code does not change anything as now everybody is aware of violation so you don't even have plausible deniability. You would need to fork from commit before adding GPL code, but this is impossible for mimemagic as it contained this code since day one.

onli4• 5 years ago

If the previous version contains GPL code, it’s GPL. It doesn’t matter if you slap an MIT license file on it, or used it in “good faith” presuming it was MIT license.

This depends.

Rails used a gem by a different developer, a gem that had its own MIT license. The Rails project and all others using Rails can not be expected that they ought to have known the license is invalid, so usually the GPL does not count for their usage back then.

You can in general never retroactively change a license, so their usage back then was certainly valid. You can [be forced to] stop using a license and re-license future versions of an artefact, and also possibly have to stop distributing the old versions. But that's on the gem's author, not Rails, and would likely not even impact future usage of the old, already obtained versions.

If the original author wanted to claim damages under GPL from Rails, he would have to do so via the gem's author. And even then: What damages? And would the projects have had to know? None and no is the likely answer, safe juridical incompetence/corruption like in the Oracle-API case.

It would be further be complicated by the file in question being a database file. You typically can not license databases in a meaningful way under GPL. Even if you could, reading a GPL'd database has no chance of carrying GPL code obligations over to the consuming program.

As always with those questions, this might depend on your specific jurisdiction. Also, it means in no way that it is not the ethically right thing to swap the dependency to one that does not have this issue.

PS: Also consider that in most uses of Rails, GPL or MIT does not change much, as accessing a server running GPL software does not trigger GPL's distribution clause (you want the AGPL for that). This already limits the impact here. The Github thread has comments in the direction of all Rails projects having to be open source now if the license changed to GPL. Not only can the license of old versions not change, this is also not the effect GPL would have.

tsbinz• 5 years ago

Rails used a gem by a different developer, a gem that had its own MIT license. The Rails project and all others using Rails can not be expected that they ought to have known the license is invalid, so usually the GPL does not count for their usage back then.
You can in general never retroactively change a license, so their usage back then was certainly valid.

I would ask a lawyer about that. As it has been explained to me, the original author didn't have the right to distribute it under the MIT license, so they (rails) never had a valid license. It's similar with images, even when you grab it off flickr or another page and it specifies a license you like, that does not mean that whoever posted it there actually had the right to do that, and if they didn't, you can get sued.

btilly4• 5 years ago

"You can in general never retroactively change a license, so their usage back then was certainly valid."

No, it wasn't. It was reasonable, but not valid.

They were using copyrighted code without permission from the copyright holder, relying on a false claim. The false claim gave them no right to use the copyrighted code, and will not protect them if the copyright holder sues them. However the fact that they were acting in good faith and had no idea is likely to help them when it comes to damages. And furthermore if they got sued, then they would have the right to sue the author of the gem whose false claim got them in trouble.

If the original author wanted to claim damages under GPL from Rails, he would have to do so via the gem's author. And even then: What damages?

I have no idea why you think that the copyright holder would have to go to the gem's author to sue about a copyright violation. Furthermore damages are not the only thing you can sue for. See https://www.lib.purdue.edu/uco/CopyrightBasics/penalties.htm... for a list. That statutory minimum of $200 per infringement can add up really fast when you're generating copies electronically.

smarx0072• 5 years ago

One thing I am not sure is why such a radical action was taken so quickly without thinking carefully first? It's not like a lawsuit was threatened or something. The original request in https://github.com/minad/mimemagic/issues/97 that you linked to was very polite and professional.

1) A time extension to remove the GPLed code could be politely requested. I know that the copyright belongs to all contributors but getting on good terms with the maintainer could be a solid first step. I think just opening a PR with that file deleted (and tests failing) could have been interpreted as a willingness to comply with the request in good faith.

2) A request to relicense the XML file in question under LGPL could have been sent to the original project (could be problem without CLAs, but still worth a try). Then the library could have been relicensed under LGPL.

3) Gem users could have been notified. Some prominent people from those projects could have helped with (1) and joined a kind request (2) to the original project.

At least that's how we'd (try to) handle it on our project under Eclipse Foundation (though we used to have a GPL code scanning for releases in the first place until very recently) if such situation arose. Anyway, talking to people first before doing something quickly is often a good idea.

ericbarrett2• 5 years ago

One thing I am not sure is why such a radical action was taken so quickly without thinking carefully first? It's not like a lawsuit was threatened or something.

Once you've been informed of a violation, you have a legal duty to act, no? Regardless of whether counter-action is immediately threatened. (Not a lawyer, not legal advice)

CaliforniaKarl• 5 years ago

One thing I am not sure is why such a radical action was taken so quickly without thinking carefully first?

I think this can be answered by considering the following:

At least that's how we'd (try to) handle it on our project under Eclipse Foundation…

Looking at https://github.com/minad/mimemagic, I did not get the impression that the software was backed by any organization, let alone one on the scale of the Eclipse Foundation. If indeed the software is essentially one person, imagine it from their perspective.

Anyway, talking to people first before doing something quickly is often a good idea.

Assuming that this was not intentional (see Hanlon's razor), you could quickly have groups like the gpl-violations.org project taking notice, and things snowballing from there. I'm not calling out gpl-violations.org specifically here, instead I'm noting that there are other people who _would_ do something quickly.

Another thing to note is that u/minad is (per their GitHub profile) in Germany. That will also affect their opinion on things related to licensing.

jakelazaroff• 5 years ago

IANAL but I don't think it works like that. Using GPL code in non-GPL project doesn't mean your code is automatically licensed under the GPL, it just means you're violating the license of the original code. How that shakes out — whether you have to re-license your project or just remove the offending code — ultimately depends on the two parties and the court system.

hartator• 5 years ago

You don’t magically get your MIT license back by forking before the license change was added, that’s not how it works.

And all RoR apps don't magically became open source because one of the depencies got contaminated by GPL. It's up to the courts to decide not parties who don't haven't standing.

rocqua3• 5 years ago

This is what I personally dislike about GPL it is a viral license, without any 'cure'. Especially the more aggressive licenses feel like a ransom. Either accept gpl, or spend the rest of time trying to quarantine gpl from your projects.

This is a huge unilateral attempt to make FOSS a certain way. And I don't think this kind of unilateral action does anything but set bad blood.

imhoguy4• 5 years ago

TL;DR

This unfortunate chain of events is rooted in licensing violation: https://github.com/minad/mimemagic/issues/97

Mimemagic got its MIME tables source generated from `freedesktop.org.xml` file, which is licensed under GPL2, and the resulting source was released under permissive MIT license. All prior 0.3.6 mimemagic versions violated the GPL2 license.

The author of mimemagic couldn't change the pre-0.3.6 versions so they simply deleted them.

Unfortunately "the fix" has broken the dependent projects and such have to either:

1) upgrade to GPL2 compatible mimemagic 0.3.6 or 0.4.0, which conflicts with MIT licensed projects like Rails or

2) build/use other MIME resolving library with has permissive license or

3) fork mimemagic under MIT and implement dynamic loading of `freedesktop.org.xml` which wouldn't violate the license.

gedy2• 5 years ago

Since the xml file is not included in the source, and was just a reference for a rb source file's lookup table, it just feels weird that 3 fixes the violation.

imhoguy4• 5 years ago

IANAL but it explicitly states it is derivative from the XML file: https://github.com/minad/mimemagic/blob/master/lib/mimemagic...

derefr2• 5 years ago

I think the pedantic interpretation of the GPL “depends on” clause is that burning a content-hash of a GPLed release of a work into your work, such that your work retrieves and installs the GPLed work-release by its content-hash (or retrieves the work-release by name + version and then verifies it by content hash — as a Bundler Gemfile.lock does), is “depending on” the GPLed release of the upstream work. Due to the explicitness of the reference, the only release that the downstream project could be depending on, is a GPLed release. (Remember, GPLed code releases need to embed the GPL license somewhere, so there’s no posssibility of a byte-for-byte identical dep being created by coincidence that isn’t GPLed.)

Meanwhile, just saying “I’ll take whatever is in the environment at [path]” is a more plugin-like approach: a GPLed database could be placed there, but a differently-licensed database could be there instead. Because you’re not making any explicit reference to any particular release of any particular work, you aren’t infected by the copyright/licensing of the particular work/release that happens to be there.

It’s a lot like the case-law of the DMCA’s “tool used for breaking copyright” clause: if the tool has features that exclusively help to break copyright, with no other uses, then it’s in violation of the DMCA; while if all features of the tool have other potential use-cases, then it doesn’t.

In both cases, it’s a question of whether there’s a “reasonable doubt” on what exactly the project was aiming to achieve / link against. If the project is explicit and removes all doubt, then it’s in violation.

TomOwens3• 5 years ago

This just bit me.

The first thing that I noticed was that some people are not understanding the GPL. It's far more impactful to Rails than the vast majority of web applications built using Rails. The use of GPL'd files means that the gem itself has to be released under the GPL. Since the gem is now under the GPL, dependencies are also under the GPL. That would include Rails. However, even if Rails was under the GPL, organizations could still build closed-source web applications using Rails since network access is not distribution. That's the whole point of the AGPL.

However, it does raise a lot of questions about when someone is allowed to yank a gem (or any library, really). It's been a while since I took a deep dive, but I was under the general impression that there was some leeway around not breaking the world when rectifying license issues. I would think that releasing new versions under the correct license and giving everyone notice and time (30 days?) to update would be fine for most copyright holders. I'd suspect that most open source developers wouldn't want to break the world. The sudden yanking with no warning caused builds to fail everywhere.

The absolute worst thing, though, was that changing a license should not be a minor (or a major) version number increase. It should be a patch. The breaking was simply because Rails is pinned to 0.3.x, but the first release under the new license was 0.4.x. Fortunately, the author released a 0.3.6 patch with the correct license, so it's just a matter of a bundle update to get the latest version. But if he hadn't, Rails would have had to release a new version and anyone on legacy/unsupported Rails versions would be hosed if they had to rebuild and redeploy.

This is a really good reason to stand up your own artifact repository and put all of your third-party dependencies in it, especially if you're a business.

freedomben4• 5 years ago

After the "left-pad" fiasco, and a similar event on the Ruby side, I started vendoring my dependencies as standard practice. I have not been sorry yet, in fact I feel vindicated in that approach.

TomOwens3• 5 years ago

Vendoring is a good first step, too. As long as you have a local copy of all the dependencies, you're better off than needing to go pull them from the Internet every time you want them and risk having them gone. Potentially worse is having the same version but with modifications.

graywh• 5 years ago

we get a form of this with our two-stage image building process -- the first stage installs all dependencies and we only update it when dependencies change

imhoguy4• 5 years ago

Whoever has missed the event: https://www.theregister.com/2016/03/23/npm_left_pad_chaos/

JamesSwift2• 5 years ago

Vendoring in ruby land is a double edged sword. It is much safer as you said. However if you _do_ vendor, be sure to be running containerized first. Otherwise you will be in a very frustrating spot of having to handle all sorts of native gem issues when trying to run on various computers during dev/test/prod.

Denvercoder96• 5 years ago

The absolute worst thing, though, was that changing a license should not be a minor (or a major) version number increase.

The license didn't change. It was always already GPL, due to the usage of GPL-licensed code, regardless of what the metadata said. The change just made the metadata correctly reflect reality.

[EDIT: I should clarify that technically mimemagic wasn't already GPL, but the only legal way to use it was by satisfying your obligations under the GPL, making it effectively GPL. The author did relicense his own code to be GPL instead of MIT.]

To me it seems like making your downstreams aware of that ASAP is pretty important, since this has important legal implications for them as well. Yanking the old versions and releasing an update with an incompatible version number is a way to do that, albeit one that's quite disruptive.

TomOwens3• 5 years ago

Yeah. That's a better way of putting it. The author didn't opt to change the license. He corrected a licensing error.

I do agree that making the downstream users aware is important, I just don't agree that immediately yanking is the right solution. Putting out a new version would have been nice. Adding a post-install message to the new versions would have been good to start to get the word out. Not sure how far to take it, but opening issues with dependencies (RubyGems provides this information) would have also been nice, giving the major dependencies a good notice before yanking.

crazypython7• 5 years ago

The use of GPL'd files means that the gem itself has to be released under the GPL. Since the gem is now under the GPL, dependencies are also under the GPL.

No, that's not true. You can dual-license dependent software under GPL and MIT. The GPL merely requires a license at least as permissive as it.

Denvercoder96• 5 years ago

The GPL merely requires a license at least as permissive as it.

No, it requires a license that's at least as permissive as it AND that imposes the same obligations (i.e. source distribution, etc.) on the licensee.

Dual-licensing dependent software under the GPL and MIT only ensures that you can rip out the GPL dependency, and then use the (formerly) dependent software under MIT. The whole package is still GPL and imposes the same obligations on derivatives of the package.

eek04_• 5 years ago

You can dual-license if you own the full copyright ownership but if you include GPLed stuff (and don't have the full copyright ownership) you'll have to GPL the result.

As for "at least as permissive" - it requires no further restrictions, but it adds a bunch of restrictions itself. And there's no other license that doesn't add restrictions - MIT adds restrictions to reproduce the MIT license, which is an extra restriction. The restrictions are attempted excused by the FSF under the "attribution" clause of the GPL, but it is not clear to me that is valid and it has not tested by any court.

rubyist5eva• 5 years ago

vendor your dependencies people

byroot3• 5 years ago

Or you know... just cache them.

If your CI or deploys broke because of this, it basically means you're constantly re-installing all your dependencies from scratch, which is totally silly.

Configure your CI & other tools to cache the bundler directory between builds and not only you'll be protected from this, you'll also make your systems faster.

ro_ro2• 5 years ago

What's even more silly is implying that caching your dependencies is some kind of a fix here. So you'll be able to deploy for a few more days, then what?

rst2• 5 years ago

There can be other wrinkles. Builds of $dayjob's Rails app failed even though we had the gem itself cached locally all over, because entries for the BSD gem versions had vanished from the rubygems.org metadata, and we weren't caching that. There are multiple workarounds, but we may not be done debating them before rails-core decides on a replacement.

_ZeD_• 5 years ago

Please, no.

quesera4• 5 years ago

Vendoring gems solves lots of problems: GitHub/RubyGems outages, yanked gems, credentials sharing in CI/CD, and as a bonus, deployments are quicker.

Negative side effects: You need to update your vendor cache periodically, your repo increases in size, and native gems have problems if if you develop on a different platform than you deploy.

spijdar• 5 years ago

This is the sort of thing that makes some people really wary of the GPL and other "viral" licenses, and I don't think you can blame them. The "blame" for this falls on someone for throwing in GPL'd code into an MIT project, but the headache drops onto a whole bunch more people down the line. It seems other commenters think this will probably be alright, but I bet this is a lot of corporate type's worst nightmare, that some underling added some segment of GPL code to their product, and now the entire thing is "technically" GPL.

One can only imagine if it was AGPL instead of GPL, and how people would debate if they should send source requests to all the sites running on rails ;-)

misnome4• 5 years ago

makes some people really wary of the GPL and other "viral" licenses

It's worse than that surely - as in this case avoiding GPL doesn't prevent the problem. This sounds like for a medium-paranoid-legal perspective, that it would "prove" that even non-GPL code isn't safe, thus discouraging from usage of any open source software [edit: dependencies]

One can only imagine if it was AGPL instead of GPL

Right, that seems like the only saving grace that avoids this being an potentially apocalyptic event.

qotgalaxy• 5 years ago

Why would closed source software be safe? Say I copy shared-mime-info completely, compile it, sell it to you as MimeWizardPRO2000, you include it as part of your closed source web framework and sell that. You're still distributing GPL code without making your source available.

Tomte• 5 years ago

and now the entire thing is "technically" GPL.

The "thing" doesn't become GPL, though.

They are in breach of the license, it's a major headache, and re-licensing the thing as GPL may be one way forward.

That's not an automatism, though, and no court would declare the thing GPL.

You may pay hefty "fictitious" licensing fees and (punitive) damages, you may have to stop distributing your thing, but you're not losing control.

dathinab4• 5 years ago

You may pay hefty "fictitious" licensing fees and (punitive) damages,

Except in cases like this you likely won't.

As it's clearly a mistake you clearly fixed asap its unlikely you have to pay more than small punitive damages.

Wrt. license fees and (non punitive damages) it's a bit more tricky but it boils down to the damage done. But as this libraries are only distributed GPL licensed and non essential (can easily be replaced) you will have a hard time to show that any damage was done and that the software can be sold for any non negligent amount of money. And if no damage was done and there is no reasonable case for selling the software i.e. non negligible fictious license cost you can guess how the ruling will end.

If you would have intentionally/knowingly done the violation and/or it being essential non easily replaceable software which saved you a lot of money and/or gave you other benefits things are different.

But this isn't really the case in this case as far as I can tell.

judofyr2• 5 years ago

but I bet this is a lot of corporate type's worst nightmare, that some underling added some segment of GPL code to their product, and now the entire thing is "technically" GPL.

IANAL, but I'm pretty sure this is _not_ how it works. Your code doesn't magically "become" licensed under GPL if you use GPL code. Your code is now in _violation_ of the GPL and one way of fixing it is to re-license your code. Another way is to eliminate the dependency.

However, if you decide to re-license to GPL then you may still have to pay damages for the time you were violating GPL.

In practice I can't imagine that a court would make anyone pay anything for this incident.

5560675260• 5 years ago

you may still have to pay damages

This is probably a first time I've seen damages mentioned in relation to GPL violations. Did anyone try enforce this?

Benjamin_Dobell3• 5 years ago

Another way is to eliminate the dependency

That'll resolve the violation for future releases. However, all previous releases are still infringing.

For a violating company who really doesn't want to open source their project, their best bet would probably be to (remove the dependency and) pay damages for previous infringement.

You'd hope damages in a case like this would be small given it went unnoticed for so long. Considering the shared-mime-info project itself is not commercial software, there probably wasn't significant damage to the project or the authors.

sergiotapia• 5 years ago

So what is a good license for "everybody can use this 100% free of charge but please don't change one line and call it yours"? What about a company like Amazon copying your codebase, throwing millions at it and then leaving you in the dust?

MIT seems far too permissible now and I'm looking for a default license for my projects.

dashwav• 5 years ago

I have been a big fan of the Mozilla Public License 2.0 [1]. I find it is the best combination of "if you use this and improve or modify, those changes need to go to the original code" while not restricting overall usage.

IMO there really isn't anything you can do to prevent people from making a product out of your work if it is open source, but what you can do is make sure that if someone makes improvements to your work, those improvements need to be publicly available under the MPL2.0 license as well.

This has the effect that if someone wants to make a product by just 'adding one line' that line needs to be published and you could add it upstream, making it publicly available again(thus making it harder to make a product solely from your code).

[1] https://choosealicense.com/licenses/mpl-2.0/

protomyth3• 5 years ago

What about a company like Amazon copying your codebase, throwing millions at it and then leaving you in the dust?

Well, they can do that with the GPL thus spawned the AGPL which didn't fix the problem either thus MongoDB and companies licenses.

"everybody can use this 100% free of charge but please don't change one line and call it yours"

Well, the BSD licenses require redistribution and use in source and binary forms are permitted provided that the above copyright notice and this paragraph are duplicated in all such forms

I know some GPL advocates tend to feel they can remove the copyright statement, but BSD code is BSD code and requires your copyright statement to be preserved.

mey• 5 years ago

Different generations of the BSD and Apache licenses have had attribution clauses to various levels of strictness. (Older ones were more strict). Neither are copyleft (Like GPL/CDDL) forcing future improvements to be open sourced. CDDL may be interesting as a way to preventing improvements to a code base from going "dark" but still being non-copyleft compatible. (Hello Sun/Oracle). Another commenter mentioned MDL which CDDL was based on for Sun's needs, that is also worth looking at.

tinus_hn• 5 years ago

Exactly the same thing happens with non open source, proprietary code which leaks into open projects.

dspillett• 5 years ago

This is the sort of thing that makes some people really wary of the GPL and other "viral" licenses

True, though the people most concerned about GPL & related licenses are usually commercial users and commercial licenses that include code access are no less "viral" then the GPL.

Wowfunhappy3• 5 years ago

I don’t think this situation is inherently different from buying a proprietary library, and discovering that the vendor stole code from the Windows kernel. Or a musician buying a sample, and discovering it was copied from a Disney movie.

You’re responsible for the stuff you use. You should audit it as well as you can—but realize that crap always happens.

Jiro2• 5 years ago

It's a lot less likely that Windows kernel code or Disney music is going to be included by mistake, so your potential exposure is much less. In the case of the Windows kernel, it's a lot less likely that anyone is even going to have it because even the leaks of Windows code are distributed to orders of magnitude fewer people than GPL code.

bobbylarrybobby• 5 years ago

the GPL and other "viral" licenses

I really hope someone writes an article with the title "what color is your license?"

teddyh• 5 years ago

GPL and other "viral" licenses

“When others hurt me, I try to defend myself. But some tell me that this makes them sick. They tell me that I should permit people to rob me of my work. They tell me that I should never try to defend myself.

They tell me that I should stop using the GNU General Public License, a license that vaccinates me against hurt. Instead, I should adopt a license that permits other people to rob me with impunity. They want me to adopt a license that forbids me from fighting back. They want me to give up my right to benefit from a derivative of my own work, a right I possess under current copyright law.

Of course, the language is a little less feverish than this. Usually, I myself am not called “infectious”. Rather, the legal defense that I use is called “infectious”. The license I choose is called “viral”.

In every day language, words such as “infect” and “virus” describe disease. The rhetoric is metaphorical. A legal tool is not a disease organism; but it is popular to think of the law as an illness, so the metaphor has impact.

The people who want to rob me use language that says I make them sick when I stop them from robbing me. They do not want to draw attention to the so-called “disease” that makes them ill: my health and my rights, and the health and rights of other people. Instead, they choose metaphor to twist people's thinking. They do not want anyone to think that I am a good citizen for stopping crime. They want the metaphor to fool others into thinking that I am a disease agent.

The GNU General Public License protects me. The connotation of “virus” and “infect” is that my choice of defense gives an illness to those who want to rob me. I want freedom from their robbery; but they want the power to hurt me. They get sick when they cannot hurt me.

To use another health and illness-related metaphor, the GNU General Public License vaccinates me; it protects me from theft.

Note that the theft about which I am talking is entirely legal in some situations: if you license your work under a modified BSD license, or a similar license, then others may legally take your work, make fixes or improvements to it, and forbid you from using that code. I personally dislike this arrangement, but it exists.”

— Robert J. Chassell, Viral Code and Vaccination, https://www.gnu.org/philosophy/vaccination.html

crazypython7• 5 years ago

Note that using a GPL dependency on servers is always allowed: "except executing it on a computer or modifying a private copy." Most Ruby on Rails projects are executed only on own servers. Smells like flamebait.

Dangeranger3• 5 years ago

There are projects that redistribute the source code, such as Gitlab, and for those projects this is a significant problem.

mooreds6• 5 years ago

I give my boss a hard time about our dependency management system because it is relatively unknown[0], but licensing is built into it from the ground up. You can't import any dependency (no matter how buried) without assigning a license to it.

This lets us confidently know, via software, the open and closed source licenses in our code base.

Licensing is one of those out of band concerns that doesn't burn you until it does.

0: https://github.com/savant-build/savant-core

sc00ty• 5 years ago

How do you handle transitive dependencies?

mooreds6• 5 years ago

When you are importing a jar file (this is a java build tool) you have to specify the provenance of every dependency, and any dependency of those dependencies.

It's a real pain, but the pain is all upfront.

Denvercoder96• 5 years ago

You can't import any dependency (no matter how buried) without assigning a license to it.

That wouldn't help here. Mimemagic declared itself to be MIT, and only turned out to be GPL because it embedded a file derived from GPL sources. That file didn't even have a license header specifying it as GPL.

Anyone importing it would mark it as MIT.

EDIT: Mimemagic didn't even turn out to be GPL, it turned out to be infringing on the GPL, and the author solved that by relicensing it to GPL.

mooreds6• 5 years ago

Fair point. I guess software couldn't have helped this issue.

Trasmatta• 5 years ago

That's a good idea generally, but it wouldn't have saved you from this issue. The gem had an MIT license, and the offending file was copied in, not sourced through a dependency.

mooreds6• 5 years ago

Gotcha, fair point. I should have read deeper; I only read the Rails issue, but should have dove into the mimemagic one. My bad.

hakre• 5 years ago

Depends on the process. If assigning a license means that there is a review of the dependency before use, this is normally seen.

majewsky2• 5 years ago

You're correctly getting downvoted for your thinly-veiled advertisement because it's besides the point. The gem was labeled as "license: MIT" all the time, but that label was just factually wrong. Garbage in, garbage out.

mooreds6• 5 years ago

People can of course downvote me for whatever reason they want. I do object to you calling this an advertisement. Sure, it links to my employer's website, but it is an OSS build library that addresses licensing issues.

Yes, GIGO applies, but what about the underlying Gem? Was the XML file relicensed? (Haven't dug into that issue 97 referenced in the GH thread.)

Edit: from sibling comments, looks like this build system wouldn't have caught the underlying issue, which was a GPL licensed, unmarked file copied in.

CodesInChaos5• 5 years ago

1. Is a database like that even copyrightable, especially in the US?

United States: Uncreative collections of facts are outside of Congressional authority under the Copyright Clause (Article I, § 8, cl. 8) of the United States Constitution, therefore no database right exists in the United States. Originality is the sine qua non of copyright in the United States (see Feist Publications v. Rural Telephone Service). https://en.wikipedia.org/wiki/Database_right#United_States

2. I'm skeptical that using a GPLed database makes this library a derivative work of the GPLed database, though the "distribute as a part of the whole" clause still applies

These requirements apply to the modified work as a whole. If identifiable sections of that work are not derived from the Program, and can be reasonably considered independent and separate works in themselves, then this License, and its terms, do not apply to those sections when you distribute them as separate works
But when you distribute the same sections as part of a whole which is a work based on the Program, the distribution of the whole must be on the terms of this License, whose permissions for other licensees extend to the entire whole, and thus to each and every part regardless of who wrote it.

boleary-gl3• 5 years ago

Anytime you publish something, it is copyrighted. The data within may not be, but my presentation of it in a certain database certainly is.

ericb• 5 years ago

When is my work protected?

Your work is under copyright protection the moment it is created and fixed in a tangible form that it is perceptible either directly or with the aid of a machine or device.

Source: https://www.copyright.gov/help/faq/faq-general.html

jahewson2• 5 years ago

Both of your claims are incorrect, at least in the US. A work must pass a certain level of creative expression to be eligible for copyright and collections of plain facts, e.g a phone book are famously not copyrightable.

theta_d• 5 years ago

1. Is a database like that even copyrightable, especially in the US?

Yes, collections of data are very much copyrightable, especially in the US.

This is not just a list of mime-types. It is a list of mime-types and instructions on how to detect those mime-types.

CodesInChaos5• 5 years ago

I would have interpreted simple patterns (e.g. value x at offset y) as non copyrightable facts about the file format.

Complex patterns could be problematic though, since you could argue they are original programs.

boleary-gl3• 5 years ago

Looks like there is a proposal to completely replace the gem: https://github.com/rails/rails/pull/41751/files

forgingahead• 5 years ago

Outrageous move to just yank the gem and break builds everywhere.

heax2• 5 years ago

It is not nice, but aside from hobbyists everyone who seriously develops software caches all dependencies in a own repository like nexus etc.

It's similar to backups, if you don't have one your data must be worthless.

samb1729• 5 years ago

aside from hobbyists everyone who seriously develops software caches all dependencies in a own repository like nexus etc.

This is a bold claim to make, and one that isn’t supported by my personal observations. Many ‘serious’ software developers have no such intermediate repository for their dependencies.

crazypython7• 5 years ago

This is flamebait.

xucheng2• 5 years ago

If rails is now considered as GPL because this dependency, does this mean that GitHub Enterprise is now GPL?

dathinab4• 5 years ago

rails is now considered as GPL

mean that GitHub Enterprise is now GPL?

even less so

---

Rails was in a license violating situation, which doesn't make it GPL at all.

Then the outcome of a legal case trying to sue someone who is knowingly using rails which unknowingly pulls in a GPL licensed dependency might be less clean cut as you might think.

Lastly depending on the version of GPL and other factors like non-clean cut interpretations you might be able to argue that a company building a service using rails wouldn't need to make the service GPL even if they use GPL software to do so (if that GPL software is in the backend only!, not if it's in the UI). The reason is that the service is not distributed by them, it stays internally even through it is communicating with a website(html,css,js, not! server side rendering) which was distributed to the user.

xucheng2• 5 years ago

The reason I mentioned GitHub Enterprise instead of GitHub website is because the former one is not a service. It is a software distributed to the end user.

Based on your comments, it seems that the existing releases of the GitHub Enterprise are in GPL violation states due to the transitive dependency.

Denvercoder96• 5 years ago

Rails isn't considered GPL because of this dependency. It is in violation of the GPL¹, which is copyright infringement. Releasing the violating software under the GPL is one way to stop that infringement, but that's not an automatic legal mechanism.

If a copyright owner decides to pursue a GPL violation, they could get damages² and enforce that the infringement stops (i.e. cease using the GPL-licensed software). It's incredibly unlikely any judge would force anybody to release source code.

¹ Actually, Rails itself isn't even in violation, because the project satisfies all the obligations the GPL imposes. GitHub would be in violation.

² In this case, where infringement wasn't intentional, they'd probably get almost nothing provided that the defendant stopped infringing when they learned of it.

crazypython7• 5 years ago

Reminder that GPLv3 gives you 30 days to "cure the violation," while the GPLv2 Linus Torvalds prefers immediately creates a copyright violation.

Denvercoder96• 5 years ago

Note that GPLv3 still immediately creates a copyright violation. It just states that if you cure the violation within 30 days, the license is reinstated. Under GPLv2 you forfeit your license immediately and in perpetuity if you infringe on it.

CodesInChaos5• 5 years ago

How does yanking work for rubygems?

In Rust a yanked version can still be downloaded when compiling (you have a lock-file referencing it), but isn't chosen when adding it as a new (transitive) dependency to your application. So yanking shouldn't break any existing applications.

(Though since is about a copyright violation, a DMCA notice against the package registry could result in a hard removal, and not just a yanked package)

packrat386• 5 years ago

A yanked gem won't be downloaded for a `bundle install` or anything of that sort. Aside from a record that it once existed it's basically gone.

lamontcg3• 5 years ago

I'm kind of surprised that nobody is talking more about this right now.

Everyone with a Gemfile.lock that does a `bundle install` as part of autoscaling (without having vendored gems or a rubygems mirror which doesn't obey yanks) is now broken, potentially in production.

judofyr2• 5 years ago

https://blog.rubygems.org/2015/04/13/permadelete-on-yank.htm...

Summary: Before 2015 then yanking didn't delete anything, but you could contact support to have it removed. They ended up getting tons of support requests and therefore changed it to be permadelete.

Benjamin_Dobell3• 5 years ago

Technically everyone using Rails right now may be in violation of the GPL. It doesn't matter that the version of the gem being used claims to be MIT, that's not how licensing/copyright works.

Github Enterprise licensees could try hit-up GitHub for source code!

EDIT: License in question is GPL, not Affero GPL. So github.com is not covered. However, Github Enterprise is.

In all likelihood, Github wouldn't comply, as Github Enterprise licensees have no such license/clause in effect with Github. It'd then be down to the shared-mime-info's copyright holders to take the matter to court.

Would be an interesting court case.

Some people in the Github issue commented that the XML "database" in question could be used under fair use. That'd be the logical defense. There's been many court cases where the "copyrighted material" is a representation of facts, as opposed to a "creative work", and thus has not been eligible for copyright protection.

It's probably also worth noting that "ignorance" is rarely an accepted defense in court.

crazypython7• 5 years ago

everyone using Rails right now is in violation of the GPL.

Not if your use of Rails is limited to your own/your company's own servers, which I imagine most Rails users are. Please don't fall for the flamebait.

If they were using GPLv3, they would have an entire month (30 days) to cure the violation.

GitHub Enterprise is in violation as it is distributed to third-parties.

Benjamin_Dobell3• 5 years ago

Thanks, edited for clarity. In this case it's GPLv2, so no "cure the violation" clause.

However, even if this were GPLv3, and you were to "cure the violation" that only reinstates your license i.e. the GPLv3 license. Replacing a dependency won't make previously infringing releases any less infringing.

toomanybeersies• 5 years ago

It's like left-pad all over again.

I wonder how much software will be unbuildable in 10 years time, due to dependencies that can no longer be downloaded. Is there an archive.org for packages?

sosodev• 5 years ago

I really do wonder about the long term sustainability of package systems. The oldest business software, think COBOL, still works because it can still run the way it did when it was created. Will I be able to say the same about my software in 50+ years?

commandlinefan• 5 years ago

At least this dependency makes sense: mime type parsing is nontrivial and something you'd logically want to leverage a library for. I can't comprehend how somebody could ever have said "I need left padding. I wonder if there's a library for that somewhere?"

hu3• 5 years ago

This is why I commit vendor directories.

I don't mind if CI ignores it but it's nice to have a fallback that ensures the project is buildable at all times.

pjmlp• 5 years ago

Always vendor software instead of relying on public repositories.

cstrahan• 5 years ago

This was handled quite poorly -- a different course of action could have avoided all the chaos while also resolving the GPL violation.

As the GPL FAQ states:

If a programming language interpreter has a license that is incompatible with the GPL, can I run GPL-covered programs on it? (#InterpreterIncompat)
When the interpreter just interprets a language, the answer is yes. The interpreted program, to the interpreter, is just data; the GPL doesn't restrict what tools you process the program with.

In mimemagic's case, similar logic could apply:

* mimemagic could redistribute the GPL licensed freedesktop.org.xml file. This redistributed file would retain the original GPL license and its terms.

* mimemagic could then read the freedesktop.org.xml file at run time and generate whatever data structures it needs. mimemagic would continue to be MIT licensed without violating the GPL license.

The problem is that mimemagic includes Ruby code generated from the GPL licensed XML file, and it could be argued that this makes part of mimemagic a derivative of a GPL licensed work. They just needed to stop doing that.

Of course I can't point this out to the repository owner now that the repo has been archived and thus commenting is now disabled.

thedanbob• 5 years ago

That approach is roughly being taken in this fork: https://github.com/jellybob/mimemagic/issues/1

With the difference that the gem will by default download the XML file at runtime, with the option of using a local copy specified by an environment variable. I guess they are operating under the belief that including any GPL file taints the library, or perhaps they're just playing it safe.

Dangeranger3• 5 years ago

Yes, this approach can work, unless the system which Rails/mimemagic is deployed to has restricted network settings. Under a restricted network setting, I believe the only solution which will work is to use a different package offering similar behavior, under a non-GPL license, or to re-implement the existing behavior using the freedesktop.org.xml as an input/output specification, rather than a source for derived code.

protomyth3• 5 years ago

So, this gem uses the mime database provided by freedesktop.org when the gem could have got the database from http://www.iana.org/assignments/media-types/media-types.xhtm... which wouldn't be GPL? What manipulation is done by freedesktop.org?

devrand• 5 years ago

The gem is basically a database of mime type, file extension, and magic bytes. The last two are not included in the linked iana database.

protomyth3• 5 years ago

Where did freedesktop.org get the magic bytes? I assume (probably stupidly) that some of that has to be in a file command on some BSD.

rushb• 5 years ago

Can someone please explain how it is possible to license a database of such sort in the first place? Pretty much all file types have some documentation on how to identify them by reading specific bytes, it's not like the folks from freedesktop invented those methods. On top of that, having the DB licensed under GPL would mean that every line of it is also under GPL, thus forcing the same GPL to all libraries out there that do even a simple PNG check using a magical byte check?

I'm really curious to understand how it this licensing works.

Removed gem breaks Rails ActiveStorage

Related Stories