search

prefix-dev / reproducible-builds

Testing reproducible builds for the conda ecosystem (using rattler-build)
https://prefix-dev.github.io/reproducible-builds/
BSD 3-Clause "New" or "Revised" License
8 stars 4 forks source link

conda-forge license violation #182

Closed isuruf closed 2 weeks ago

isuruf commented 2 months ago

The recipes here are modified recipe scripts from conda-forge and therefore are subjected to conda-forge's BSD-3-Clause license. Please distribute that license notice and copyright here in the repo and in all the artifacts that you produce. (For eg: in each conda package in conda-forge, we distribute the license as info/recipe/parent/recipe-scripts-license.

wolfv commented 1 month ago

Would you be OK with a single license file e.g. in the root of the repository?

I am currently thinking about ways we could embed it easily into all the artifacts, but it might be a little tricky (we would ideally copy it into the recipe folder prior to each build).

isuruf commented 1 month ago

Would you be OK with a single license file e.g. in the root of the repository?

I think that's okay.

Hofer-Julian commented 1 month ago

Would you be OK with a single license file e.g. in the root of the repository?

I think that's okay.

I just checked out the repo, and there is already a LICENSE file containing a BSD-3 Clause license. Can this issue be closed then @isuruf?

wolfv commented 1 month ago

@Hofer-Julian that license file only mentions prefix whcih is not correct.

Hofer-Julian commented 1 month ago

Fair point, I've opened a PR for clarifying that we adapted the recipes from conda-forge as a first step: https://github.com/prefix-dev/reproducible-builds/pull/184

mbargull commented 3 weeks ago

FYi, we discussed this at today's conda-forge/core meeting (ref: https://github.com/conda-forge/conda-forge.github.io/pull/2267 ) -- not just wrt. this repo, but general downstream/other uses of conda-forge's recipes. Specifically, we mostly discussed how to handle/better document the

[...] and in all the artifacts that you produce. (For eg: in each conda package in conda-forge, we distribute the license as info/recipe/parent/recipe-scripts-license.

part since this is currently done via scripts from the .scripts/ directory in conda-forge's feedstocks and thus missed if recipes are built without running those downstream.