search

conda-forge / xz-feedstock

A conda-smithy repository for xz.
BSD 3-Clause "New" or "Revised" License
0 stars 22 forks source link

xz conda-forge package LGPL, but not GPL #26

Open FelixS90 opened 3 years ago

FelixS90 commented 3 years ago

Issue: I was wondering whether there are indeed components in the shipped conda package subject to GPL as indicated through the license key saying "LGPL-2.1 and GPL-2.0".

Following https://tukaani.org/xz/ and the linked COPYING, the only parts of xz subject to GNU GPLv2+ (that are indeed shipped) are the "scripts to grep, diff, and view compressed files". In the package pulled in from sourceforge as coded in the xz feedstock meta.yaml, this corresponds to the files located in src/scripts.

However, the xz conda-forge package eventually only ships a very small subset, which DOES NOT include those scripts.

Thus, we are at maximum LGPL, if not even public domain "unless GNU getopt_long had to be compiled and linked in from the lib directory. The getopt_long code is under GNU LGPLv2.1+.".


Environment (conda list):

``` # Name Version Build Channel absl-py 0.11.0 pypi_0 pypi astunparse 1.6.3 pypi_0 pypi atomicwrites 1.4.0 pyh9f0ad1d_0 conda-forge attrs 20.3.0 pyhd3deb0d_0 conda-forge blinker 1.4 py_1 conda-forge bokeh 1.4.0 py36h9f0ad1d_1 conda-forge brotlipy 0.7.0 py36h68aa20f_1001 conda-forge ca-certificates 2020.12.5 h5b45459_0 conda-forge cachetools 4.2.1 pypi_0 pypi certifi 2020.12.5 pypi_0 pypi cffi 1.14.4 py36he58ceb7_1 conda-forge chardet 4.0.0 py36ha15d459_1 conda-forge click 7.1.2 pyh9f0ad1d_0 conda-forge clickclick 1.2.2 py_1 conda-forge cloudpickle 1.6.0 py_0 conda-forge colorama 0.4.4 pyh9f0ad1d_0 conda-forge connexion 2.7.0 py_0 conda-forge coverage 5.4 py36h68aa20f_0 conda-forge cryptography 3.3.1 py36he58ceb7_1 conda-forge cudatoolkit 10.1.243 h3826478_6 conda-forge cudnn 7.6.5 cuda10.1_0 cycler 0.10.0 py_2 conda-forge cython 0.29.21 py36he2d232f_2 conda-forge cytoolz 0.11.0 py36h68aa20f_3 conda-forge dask 0.17.4 py_0 conda-forge dask-core 0.17.4 py_0 conda-forge decorator 4.4.2 py_0 conda-forge dill 0.3.3 pyhd8ed1ab_0 conda-forge distributed 1.21.8 py36_0 conda-forge flake8 3.8.4 py_0 conda-forge flask 1.1.2 pyh9f0ad1d_0 conda-forge flask-testing 0.8.1 pyhd8ed1ab_0 conda-forge freetype 2.10.4 h546665d_1 conda-forge gast 0.3.3 pypi_0 pypi google-auth 1.24.0 pypi_0 pypi google-auth-oauthlib 0.4.2 pypi_0 pypi google-pasta 0.2.0 pypi_0 pypi grpcio 1.35.0 pypi_0 pypi h5py 2.10.0 pypi_0 pypi heapdict 1.0.1 py_0 conda-forge icu 68.1 h0e60522_0 conda-forge idna 2.10 pyh9f0ad1d_0 conda-forge imagecodecs-lite 2019.12.3 py36h6434af4_3 conda-forge imageio 2.9.0 py_0 conda-forge importlib-metadata 3.4.0 py36ha15d459_0 conda-forge importlib_metadata 3.4.0 hd8ed1ab_0 conda-forge inflection 0.5.1 pyh9f0ad1d_0 conda-forge iniconfig 1.1.1 pyh9f0ad1d_0 conda-forge intel-openmp 2020.3 h57928b3_311 conda-forge itsdangerous 1.1.0 py_0 conda-forge jinja2 2.11.2 pyh9f0ad1d_0 conda-forge joblib 1.0.0 pyhd8ed1ab_0 conda-forge jpeg 9d h8ffe710_0 conda-forge jsonschema 3.2.0 py_2 conda-forge keras-preprocessing 1.1.2 pypi_0 pypi kiwisolver 1.3.1 py36he95197e_1 conda-forge libblas 3.9.0 7_mkl conda-forge libcblas 3.9.0 7_mkl conda-forge libclang 11.0.1 default_h5c34c98_1 conda-forge libiconv 1.16 he774522_0 conda-forge liblapack 3.9.0 7_mkl conda-forge libpng 1.6.37 h1d00b33_2 conda-forge libtiff 4.2.0 hc10be44_0 conda-forge libxml2 2.9.10 hf5bbc77_3 conda-forge libxslt 1.1.33 h65864e5_2 conda-forge locket 0.2.0 py_2 conda-forge lz4-c 1.9.3 h8ffe710_0 conda-forge m2w64-gcc-libgfortran 5.3.0 6 conda-forge m2w64-gcc-libs 5.3.0 7 conda-forge m2w64-gcc-libs-core 5.3.0 7 conda-forge m2w64-gmp 6.1.0 2 conda-forge m2w64-libwinpthread-git 5.0.0.4634.697f757 2 conda-forge markdown 3.3.3 pypi_0 pypi markupsafe 1.1.1 py36h68aa20f_3 conda-forge marshmallow 3.10.0 pyhd8ed1ab_0 conda-forge matplotlib 3.3.3 py36ha15d459_0 conda-forge matplotlib-base 3.3.3 py36h1abdf75_0 conda-forge mccabe 0.6.1 py_1 conda-forge mkl 2020.4 hb70f87d_311 conda-forge more-itertools 8.6.0 pyhd8ed1ab_0 conda-forge msgpack-python 0.6.2 py36he980bc4_0 conda-forge msys2-conda-epoch 20160418 1 conda-forge multiprocess 0.70.11.1 py36h68aa20f_1 conda-forge networkx 2.5 py_0 conda-forge numpy 1.18.5 pypi_0 pypi oauthlib 3.1.0 pypi_0 pypi olefile 0.46 pyh9f0ad1d_1 conda-forge onnxruntime-gpu 1.4.0 pypi_0 pypi openapi-spec-validator 0.2.9 pyh9f0ad1d_0 conda-forge openssl 1.1.1i h8ffe710_0 conda-forge opt-einsum 3.3.0 pypi_0 pypi packaging 20.8 pyhd3deb0d_0 conda-forge pandas 1.1.5 py36he38d939_0 conda-forge partd 1.1.0 py_0 conda-forge pathlib2 2.3.5 py36ha15d459_3 conda-forge pathos 0.2.7 pyhd3deb0d_0 conda-forge patsy 0.5.1 py_0 conda-forge pillow 8.1.0 py36h194931e_1 conda-forge pip 21.0 pyhd8ed1ab_1 conda-forge pluggy 0.13.1 py36ha15d459_4 conda-forge pox 0.2.9 pyhd3deb0d_0 conda-forge ppft 1.6.6.3 pyhd3deb0d_0 conda-forge protobuf 3.14.0 pypi_0 pypi psutil 5.8.0 py36h68aa20f_1 conda-forge py 1.10.0 pyhd3deb0d_0 conda-forge pyasn1 0.4.8 pypi_0 pypi pyasn1-modules 0.2.8 pypi_0 pypi pycodestyle 2.6.0 pyh9f0ad1d_0 conda-forge pycparser 2.20 pyh9f0ad1d_2 conda-forge pydensecrf 1.0rc3 py36h830ac7b_1 conda-forge pyflakes 2.2.0 pyh9f0ad1d_0 conda-forge pyopenssl 20.0.1 pyhd8ed1ab_0 conda-forge pyparsing 2.4.7 pyh9f0ad1d_0 conda-forge pyqt 5.12.3 py36ha15d459_7 conda-forge pyqt-impl 5.12.3 py36he2d232f_7 conda-forge pyqt5-sip 4.19.18 py36he2d232f_7 conda-forge pyqtchart 5.12 py36he2d232f_7 conda-forge pyqtwebengine 5.12.1 py36he2d232f_7 conda-forge pyrsistent 0.17.3 py36h68aa20f_2 conda-forge pyside2 5.13.2 py36h4827aa2_4 conda-forge pysocks 1.7.1 py36ha15d459_3 conda-forge pytest 6.2.2 py36ha15d459_0 conda-forge pytest-cov 2.11.1 pyh44b312d_0 conda-forge pytest-timeout 1.4.2 pyh9f0ad1d_0 conda-forge python 3.6.12 h39d44d4_0_cpython conda-forge python-dateutil 2.8.1 py_0 conda-forge python_abi 3.6 1_cp36m conda-forge pytz 2020.5 pyhd8ed1ab_0 conda-forge pywavelets 1.1.1 py36h6434af4_3 conda-forge pyyaml 5.4.1 py36h68aa20f_0 conda-forge qt 5.12.9 h5909a2a_3 conda-forge requests 2.25.1 pyhd3deb0d_0 conda-forge requests-oauthlib 1.3.0 pypi_0 pypi rsa 4.7 pypi_0 pypi scikit-image 0.17.2 py36he38d939_4 conda-forge scikit-learn 0.24.1 py36h63cef00_0 conda-forge scipy 1.5.3 py36h7ff6e69_0 conda-forge seaborn 0.11.1 h57928b3_0 conda-forge seaborn-base 0.11.1 pyhd8ed1ab_0 conda-forge setuptools 52.0.0 pypi_0 pypi six 1.15.0 pyh9f0ad1d_0 conda-forge sortedcontainers 2.3.0 pyhd8ed1ab_0 conda-forge sqlalchemy 1.3.22 py36h68aa20f_1 conda-forge sqlite 3.34.0 h8ffe710_0 conda-forge statsmodels 0.12.1 py36h6434af4_2 conda-forge tblib 1.6.0 py_0 conda-forge tensorboard 2.2.2 pypi_0 pypi tensorboard-plugin-wit 1.8.0 pypi_0 pypi tensorflow-gpu 2.2.1 pypi_0 pypi tensorflow-gpu-estimator 2.2.0 pypi_0 pypi termcolor 1.1.0 pypi_0 pypi threadpoolctl 2.1.0 pyh5ca1d4c_0 conda-forge tifffile 2020.6.3 py_0 conda-forge tk 8.6.10 h8ffe710_1 conda-forge toml 0.10.2 pyhd8ed1ab_0 conda-forge toolz 0.11.1 py_0 conda-forge tornado 5.0.2 py36_0 conda-forge tqdm 4.56.0 pyhd8ed1ab_0 conda-forge typing_extensions 3.7.4.3 py_0 conda-forge urllib3 1.26.3 pyhd8ed1ab_0 conda-forge vc 14.2 hb210afc_2 conda-forge vs2015_runtime 14.28.29325 h5e1d092_0 conda-forge waitress 1.4.4 pyhd8ed1ab_0 conda-forge werkzeug 1.0.1 pyh9f0ad1d_0 conda-forge wheel 0.36.2 pypi_0 pypi win_inet_pton 1.1.0 py36ha15d459_2 conda-forge wincertstore 0.2 py36ha15d459_1006 conda-forge wrapt 1.12.1 pypi_0 pypi xz 5.2.5 h62dcd97_1 conda-forge yaml 0.2.5 he774522_0 conda-forge zict 2.0.0 py_0 conda-forge zipp 3.4.0 py_0 conda-forge zlib 1.2.11 h62dcd97_1010 conda-forge zstd 1.4.8 h4e2f164_1 conda-forge ```


Details about conda and system ( conda info ):

``` conda version : 4.8.2 conda-build version : not installed python version : 3.7.6.final.0 virtual packages : __cuda=10.1 base environment : C:\ProgramData\Miniconda3 (writable) channel URLs : https://conda.anaconda.org/conda-forge/win-64 https://conda.anaconda.org/conda-forge/noarch https://repo.anaconda.com/pkgs/main/win-64 https://repo.anaconda.com/pkgs/main/noarch https://repo.anaconda.com/pkgs/r/win-64 https://repo.anaconda.com/pkgs/r/noarch https://repo.anaconda.com/pkgs/msys2/win-64 https://repo.anaconda.com/pkgs/msys2/noarch package cache : C:\ProgramData\Miniconda3\pkgs C:\Users\m1fsche\.conda\pkgs C:\Users\m1fsche\AppData\Local\conda\conda\pkgs envs directories : C:\ProgramData\Miniconda3\envs C:\Users\m1fsche\.conda\envs C:\Users\m1fsche\AppData\Local\conda\conda\envs platform : win-64 user-agent : conda/4.8.2 requests/2.22.0 CPython/3.7.6 Windows/10 Windows/10.0.18362 administrator : False netrc file : None offline mode : False ```
nehaljwani commented 3 years ago

cc @conda-forge/core @conda-forge/staged-recipes

jakirkham commented 3 years ago

Probably the thing to do is to split the package into shared libraries (if these can in fact be LGPL someone should check) and CLI tools (if these can in fact be GPL again someone should check). Most other packages just need the libraries. So we could then go through and update those packages (perhaps with a migrator) to get them to use just the library portion. This should allow most things where the GPL bit are not needed to ship under LGPL

GreatScherzo commented 2 years ago

This, I am having the exact problem in figuring out why is the xz package licensed under GPL.

I've posted questions on the stack exchange, if anyone wants to refer: https://opensource.stackexchange.com/questions/12496/using-condas-xz-package-for-proprietary-use https://stackoverflow.com/questions/70677496/determining-anaconda-xz-package-content

GreatScherzo commented 2 years ago

@FelixS90 Were you able to determine if the package includes the GNU getopt_long(which is licensed under LGPL) as well? Thanks a bunch!

GreatScherzo commented 2 years ago

I was able to get in touch with the author of lzma, Lasse Collin (bless his soul for answering my enquiry)

Here's his response


> I would to ask about the Python's binding for XZ Utils.
>
>  From my understanding, the python's binding has only the liblzma 
> component.

Bindings are usually written against a library and then liblzma is
enough.

> Is this the same for the xz package for anaconda? (Link to package
> page: https://anaconda.org/anaconda/xz)
> If it's not the same, what are the components and licenses in
> anaconda's xz package?

I downloaded Windows and Linux versions from that page and they seem to
include both liblzma and the command line tools. The Linux version even
includes the scripts (xzgrep etc.). The Windows version is built using
Visual Studio and there are two patches. I don't support building the
command line tools using Visual Studio so I cannot comment the Windows
build much.

From licensing point of view, on some platforms the command line tools
will include LGPLv2.1+ code (GNU getopt_long). The scripts are GPLv2+.
liblzma itself is public domain but binaries can contain code from the
toolchain (like Visual Studio or MinGW-w64) and that code can have its
own license restrictions (which people too often ignore).

I hope this helps.

From his reply, it seems that the Linux version of the package includes the grep scripts. The command line tool may include the getopt_long component based on platforms, so its best to assume that the package is LGPLv2.1 at minimum.

Hope this helps everyone!

jakirkham commented 2 years ago

Thanks for the feedback!

If someone would like to try a PR to split out the packages into different outputs, it should be possible to get the right license on the right collections of things 🙂

jonashaag commented 1 year ago

I'm interested in working on this. I'd prefer to have the non-GPL tools shipped by default though, so my proposal is to have either two packages as follows:

or three packages:

xhochy commented 1 year ago

We should have three packages to split of libs from tools. You can take inspiration from zlib and glib on how to achieve this.

jonashaag commented 1 year ago

We should have three packages to split of libs from tools. You can take inspiration from zlib and glib on how to achieve this.

What should go in each package?

xhochy commented 1 year ago

Let's wait for https://github.com/conda-forge/boost-feedstock/pull/164 to be merged. Then I would propose to have

The boost PR is not a technical requirement but a place where very central discussions about package splits are happening.

xhochy commented 11 months ago

@jonashaag Boost has been successfully split, you can continue here with the same pattern (in a simpler form).

jonashaag commented 11 months ago

I probably won’t have time to do so in the next days/weeks. But it’s on my todo list.