4 ms·

The question is what happens when someone is already doing that, but the rug gets pulled out from underneath them unexpectedly (even intentionally). Humans are

The question is what happens when someone is already doing that, but the rug gets pulled out from underneath them unexpectedly (even intentionally). Humans are fallible; mistakes happen even when everyone tried their best to do their due diligence, especially around pitfalls. Claiming that a good software engineer would never fall in this trap is like claiming that a good software engineer would never write a bug.

m_mueller 5y ago
great, now we need to add a license checker CI step...
- dataflow 5y ago
  Probably a good idea, yeah.
- gizmo686 5y ago
  Several projects I'm on already have one: https://creadur.apache.org/rat/ https://creadur.apache.org/rat/ Granted, this focused on code within the project, not dependencies.
- zvr 5y ago
  It's nothing new, and yes, checking licenses is a usual task to have on your CI setup.
heavyset_go 5y ago
Good doctors and drivers make mistakes, too, and they still face liability for those mistakes. I think that if your company is large enough, you should have employees, or pay someone to, mirror your dependencies and automate license checks. There are projects that do the latter already[1][2]. You can loop your lawyers in if licenses change to ensure you don't violate them. If (A)GPL code still ships in proprietary products, that's a process problem that the company needs to solve. [1] https://github.com/dhatim/python-license-check https://github.com/dhatim/python-license-check [2] https://github.com/davglass/license-checker https://github.com/davglass/license-checker
- dataflow 5y ago
  The question isn't whether they should face liability or whether the company has problems to solve. The question is what specifically should the penalty be? If you happen to ship any GPL'd code at any point with your product, must it necessarily always follow that you should be forced to release the source to everything else you happened to ship along with it? That's what people here want, and I'm pointing out it has a flip side to it that doesn't seem to be considered.
  - michaelmrose 5y ago
    There is no such situation possible. You can never be forced to release your code under a different license. That is merely one way to cure your infringement.
  - nextaccountic 5y ago
    > If you happen to ship any GPL'd code at any point with your product, must it necessarily always follow that you should be forced to release the source to everything else you happened to ship along with it? The only thing that gives you any right to ship the code is the license, and you must always comply with the terms of the license, so.. yes? But here's the thing. GPL doesn't infect things that merely ship "along with it". For your entire software to be covered by GPL it must be a derivative work.

m_mueller 5y ago

great, now we need to add a license checker CI step...

dataflow 5y ago
Probably a good idea, yeah.
gizmo686 5y ago
Several projects I'm on already have one: https://creadur.apache.org/rat/ https://creadur.apache.org/rat/ Granted, this focused on code within the project, not dependencies.
zvr 5y ago
It's nothing new, and yes, checking licenses is a usual task to have on your CI setup.

heavyset_go 5y ago

Good doctors and drivers make mistakes, too, and they still face liability for those mistakes. I think that if your company is large enough, you should have employees, or pay someone to, mirror your dependencies and automate license checks. There are projects that do the latter already[1][2]. You can loop your lawyers in if licenses change to ensure you don't violate them. If (A)GPL code still ships in proprietary products, that's a process problem that the company needs to solve. [1] https://github.com/dhatim/python-license-check https://github.com/dhatim/python-license-check [2] https://github.com/davglass/license-checker https://github.com/davglass/license-checker

dataflow 5y ago
The question isn't whether they should face liability or whether the company has problems to solve. The question is what specifically should the penalty be? If you happen to ship any GPL'd code at any point with your product, must it necessarily always follow that you should be forced to release the source to everything else you happened to ship along with it? That's what people here want, and I'm pointing out it has a flip side to it that doesn't seem to be considered.
- michaelmrose 5y ago
  There is no such situation possible. You can never be forced to release your code under a different license. That is merely one way to cure your infringement.
- nextaccountic 5y ago
  > If you happen to ship any GPL'd code at any point with your product, must it necessarily always follow that you should be forced to release the source to everything else you happened to ship along with it? The only thing that gives you any right to ship the code is the license, and you must always comply with the terms of the license, so.. yes? But here's the thing. GPL doesn't infect things that merely ship "along with it". For your entire software to be covered by GPL it must be a derivative work.