Closed danieldjewell closed 3 years ago
Thank you for your warning.
python setup.py
, it was automatically named pyexiv2-xxx-none-any.whl
. In the future, I can split up pyexiv2-xxx-py3-none-any.whl
into multiple files for different platforms.Isn't including binaries a horrible security issue?
In v2.4.1 , I finally released the wheel package for different platforms separately. So they've been reduced in size. All compiled files have been removed from the source package.
Isn't including binaries a horrible security issue?
The source code package does not contain compiled files, while the wheel package contains compiled files. Next, I'll automate packaging and publishing pyexiv2 through GitHub Actions. So you don't have to worry about me tampering with the compiled files.
This issue has been automatically closed because there has been no activity for a month.
Hello!
Both the source and binary wheel distributions of pyexiv2 (as of v2.3.1 as hosted on PyPi) contain binaries compiled for x86-64. When installing on aarch64, for example, the package is completely broken.
Couple of things:
pyexiv2-2.3.1-py3-none-any.whl
would be an architecture independent wheel. It's perfectly fine to have pre-compiled binaries in a binary wheel but they need to be properly tagged. See https://packaging.python.org/specifications/platform-compatibility-tags/Possible GPLv2 License Violation of exiv2
Exiv2 is released under the GPLv2 -- which AFAIK requires that if you distribute binaries, you must make the source code available for those binaries. Further, this is the right thing to do on many fronts. Check out: https://reproducible-builds.org
Further, read GNU's GPL guidance on this very topic here: https://www.gnu.org/licenses/gpl-faq.html#UnchangedJustBinary
Making binaries is fine - but you have to release the source. Since exiv2 is already on github ... adding it as a git submodule and then having python build the dependency would be the best option. That way, if someone downloads the package on a different architecture, they will be able to build it too :grin:
References
https://www.python.org/dev/peps/pep-0425/