Ruby off the Rails: Code library yanked over license blunder, sparks chaos for half a million projects
- Reference: 1616660650
- News link: https://www.theregister.co.uk/2021/03/25/ruby_rails_code/
- Source link:
The shared-mime-info library is licensed under the [1]GPLv2 license and mimemagic was listed as an [2]MIT licensed project.
[3]
"Using a GPL file as a source makes your whole codebase a derived work, making it all GPL, so I think it's pretty important that this problem gets corrected before somebody uses it in a pure MIT codebase, or a closed-source application," wrote Nocera in an [4]Issues post .
"You will also need to re-add the GPL header to the shared-mime-info XML file as a matter of urgency. It was stripped in release tarballs by the tool used to merge translations, but is visible in the .in version of the same file."
[5]
Mendler thanked Nocera for letting him know and promptly moved the latest version, 0.4.0, and version 0.3.6 [6]under GPLv2 , and withdrew prior versions from distribution on RubyGems.org, the package registry used by Ruby developers. He then archived the [7]mimemagic GitHub repo , meaning it's no longer being actively developed.
And just like that, Amazon Web Services forked Elasticsearch, Kibana. Was that part of the plan, Elastic? [8]READ MORE
This had the unfortunate effect of [9]breaking the popular web development framework Ruby on Rails, which includes mimemagic 0.3.5 as a dependency. It also [10]affects 172 other packages, which between them touch 577,148 different software repositories.
Not all of these projects are immediately affected, though any sort of build process that tries to fetch a withdrawn version of mimemagic from RubyGems.org will fail unless dependency caching has been implemented.
Software projects that incorporate mimemagic must now consider the implications of incorporating GPLv2 licensed code, which may not be acceptable in some cases. If that's legally and practically viable, they can switch to either the 0.3.6 or the 0.4.0 version of the library, though not without some effort.
Projects like [11]a web app run by the UK government's Department for Business, Energy and Industrial Strategy, the [12]Ruby SDK for the FileStack CMS , and Rails-based taggable image app [13]Danbooru are pondering workarounds for a situation that recalls [14]the left-pad incident of 2016.
Since mimemagic is mostly [15]a database of mime type data mappings , the Rails team is looking into [16]replacement options , including 2-clause BSD–licensed [17]libmagic or a Ruby translation of the mime data. But there's a non-trivial amount of work required to make this happen.
As for everyone else, [18]Sergey Alekseev , founder of Shopify app maker ASoft, asked Mendler to [19]keep the mimemagic repo active to provide a place for the other affected projects to discuss their options.
But Mendler [20]disagreed , stating, "The Rails dependency is certainly the most impactful one. It is best if we find a solution which works for Rails and which is sanctioned by the Rails team."
Paul Berg, an open-source licensing consultant, told The Register in an email that while this is a difficult situation, the developers involved appear to be handling it well.
"Since the maintainers of the dependent mimemagic library discovered that it contained GPL code, they moved to a GPL license," he said. "The admirable thing is that they reacted once the issue was noticed rather than keeping silent about it and letting the issue persist."
"It does cause a major issue for Rails though," Berg said. "Rails is widely used under the MIT license which is a permissive license. Since so many applications are authored using Rails under the assumption that those applications are not copyleft under the GPL, it is likely that a great many of those apps would not be complying with the terms of the GPL since they were not deployed with those terms in mind."
"As a consequence of that, relicensing Rails to GPL for rails to be in compliance is likely to be a massive change for thousands of teams and really is not a tenable solution. Unfortunately, other solutions are likely not simple."
Berg said mimemagic could try to replace GPL portions of the code and retain its MIT license. Another option, he said, would be for Rails to replace mimemagic altogether, assuming a suitable replacement exists.
"In any event, resolving this issue is likely going to be a non-trivial amount of work in a short time frame given the critical nature of Rails to the industry because of its popularity," he said. "I do not envy their predicament."
[21]
"This illustrates why being diligent in enumerating all dependencies and reused code whenever they are introduced and working to ensure that the licensing of those dependencies is compatible with your intent is so important." ®
Get our [22]Tech Resources
[1] https://www.gnu.org/licenses/old-licenses/gpl-2.0.html
[2] https://opensource.org/licenses/MIT
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/devops&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YFxtXOtx5X-nYtzmMMrcBQAAAI8&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[4] https://github.com/minad/mimemagic/issues/97
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/devops&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YFxtXOtx5X-nYtzmMMrcBQAAAI8&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[6] https://github.com/minad/mimemagic/commit/c0f7b6b21a192629839db87612794d08f9ff7e88
[7] https://github.com/minad/mimemagic
[8] https://www.theregister.com/2021/01/22/aws_elastic_fork/
[9] https://github.com/minad/mimemagic/issues/98
[10] https://github.com/minad/mimemagic/network/dependents?package_id=UGFja2FnZS0xMDYyMDY%3D
[11] https://github.com/UKGovernmentBEIS/beis-report-official-development-assistance/pull/1015
[12] https://github.com/filestack/filestack-ruby/issues/77
[13] https://github.com/danbooru/danbooru/issues/4776
[14] https://www.theregister.com/2016/03/23/npm_left_pad_chaos/
[15] https://github.com/minad/mimemagic/blob/master/lib/mimemagic/tables.rb
[16] https://github.com/rails/rails/issues/41750#issuecomment-805977682
[17] https://man7.org/linux/man-pages/man3/libmagic.3.html
[18] https://github.com/sergey-alekseev
[19] https://github.com/rails/rails/issues/41750#issuecomment-805831354
[20] https://github.com/rails/rails/issues/41750#issuecomment-805834045
[21] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/devops&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YFxtXOtx5X-nYtzmMMrcBQAAAI8&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[22] https://whitepapers.theregister.com/
I don't think you can revoke a license once granted if the license doesn't give you a right to do so. No matter if you hold the copyright or not.
You can delete the code and stop licensing out new copies, but you can't de-license the code already licensed, and that code can be relicensed per its license terms.
Correction: Uh oh. https://www.copyright.gov/docs/203.html
> Section 203 of the Copyright Act permits authors (or, if the authors are not alive, their surviving spouses, children or grandchildren, or executors, administrators, personal representatives or trustees) to terminate grants of copyright assignments and licenses that were made on or after January 1, 1978 when certain conditions have been met. Notices of termination may be served no earlier than 25 years after the execution of the grant or, if the grant covers the right of publication, no earlier than 30 years after the execution of the grant ...
I don't think this was written with software licenses in mind.
This seems a good writeup on the topic: https://en.wikisource.org/wiki/Shrinking_the_Commons:_Termination_of_Copyright_Licenses_and_Transfers_for_the_Benefit_of_the_Public
Surprisingly, some room to manoevre
Looking at the text
"Notices of termination may be served no earlier than 25 years after the execution of the grant...
However, termination of a grant cannot be effective until 35 years after the execution of the grant"
So best case situation is a ten year window.
As to the writeup, it's probably better left to legal types to read because it's not written for easy reading.
surely not
Even if I were still alive, I don't think I could tell people to cease and desist using or distributing code that I had released as GPL or MIT previously, could I?
Re: surely not
Apparently, according to §203 USC, at least in the US you can. The law was originally created to allow authors to revoke overbroad copyright assignments to publishers.
This won't even be the worst of it.
At some point, someone's going to die and their estate will go to a relative that's an arsehole. The kind of arsehole that thinks free software and other community projects are communism.
And that relative will seek to claim the copyright of that person's code, and pull it from all the projects. (Mostly in the mistaken belief that they can and should profit from this.) If it's widely used code, then all hell will break loose.
This is why companies like Canonical had copyright assignment requirements. Many in the open source community don't like them, and think it's some kind of corporate trap. But legally, they're almost certainly the right thing to do. In fact the community should really think about setting up some kind of "clearing house" to process & store copyright assignments for its own protection.
If you do contribute to open source, make sure you put a paragraph in your will about what you want done with your works when you're gone. Just in case...