4 ms·

Author of ripgrep here. Maybe, umm, don't depend on auto-detection tools as the ultimate source of whether something is appropriately licensed or not? encoding

Author of ripgrep here. Maybe, umm, don't depend on auto-detection tools as the ultimate source of whether something is appropriately licensed or not? encoding_rs is clearly licensed, otherwise I wouldn't have used it in ripgrep: https://github.com/hsivonen/encoding_rs https://github.com/hsivonen/encoding_rs Take it up with the auto-detection tools. Or at least do your due diligence before claiming ripgrep is using "unlicensed" code. The Debian copyright notice is correct for ripgrep.

jsmith45 4y ago
The encoding part is one concern, but what about ryu? Is “Apache-2.0 OR BSL-1.0” not accurate? Neither of those showed up in the grep for license lines? Sure, BSL is an obviously free license that is basically just a wording variant of MIT, but it is not showing up in that grep. Note: I’ve not actually read the copyright file, So perhaps It is clearly accounted for there, but is just not formatted in a way that the grep query used can find it.
- dwaite 4y ago
  https://github.com/dtolnay/ryu https://github.com/dtolnay/ryu lists that choice of license in its README, in its Cargo.toml, and includes the license texts in its repository.
- jsmith45 4y ago
  I have verified that ryu is a dependency of json_serde, which is a dependency of ripgrep. Apache-2.0 OR BSL-1.0 is indeed the correct license for ryu. It is not included in the Debian copyright file. I suppose this is because the library is not included in the source package, and the BSL does not mandate notice preservation for a binary output. And Debian policy for the copyright file is that only notices or info that must be preserved are required to be present in the file.
  - Aissen 4y ago
    Funny, I initially thought that BSL was the infamous Business Source License, a proprietary source-available license with an automatic switch to (usually) Apache 2.0 four years after each release. But no, it was the Boost Software License. https://spdx.org/licenses/BSL-1.0.html https://spdx.org/licenses/BSL-1.0.html https://spdx.org/licenses/BUSL-1.1.html https://spdx.org/licenses/BUSL-1.1.html

jsmith45 4y ago

The encoding part is one concern, but what about ryu? Is “Apache-2.0 OR BSL-1.0” not accurate? Neither of those showed up in the grep for license lines? Sure, BSL is an obviously free license that is basically just a wording variant of MIT, but it is not showing up in that grep. Note: I’ve not actually read the copyright file, So perhaps It is clearly accounted for there, but is just not formatted in a way that the grep query used can find it.

dwaite 4y ago
https://github.com/dtolnay/ryu https://github.com/dtolnay/ryu lists that choice of license in its README, in its Cargo.toml, and includes the license texts in its repository.
jsmith45 4y ago
I have verified that ryu is a dependency of json_serde, which is a dependency of ripgrep. Apache-2.0 OR BSL-1.0 is indeed the correct license for ryu. It is not included in the Debian copyright file. I suppose this is because the library is not included in the source package, and the BSL does not mandate notice preservation for a binary output. And Debian policy for the copyright file is that only notices or info that must be preserved are required to be present in the file.
- Aissen 4y ago
  Funny, I initially thought that BSL was the infamous Business Source License, a proprietary source-available license with an automatic switch to (usually) Apache 2.0 four years after each release. But no, it was the Boost Software License. https://spdx.org/licenses/BSL-1.0.html https://spdx.org/licenses/BSL-1.0.html https://spdx.org/licenses/BUSL-1.1.html https://spdx.org/licenses/BUSL-1.1.html