Re: [yocto] [Question] How to handle GPLv3 packages?

From: Alexander Kanavin <alex.kanavin@gmail.com>
To: Mans Zigher <mans.zigher@gmail.com>
Cc: Yocto-mailing-list <yocto@lists.yoctoproject.org>
Subject: Re: [yocto] [Question] How to handle GPLv3 packages?
Date: Wed, 6 Apr 2022 11:03:47 +0200	[thread overview]
Message-ID: <CANNYZj_UvDZWC+hD1pjxzkOKK_sL4wB+mu3a8GiPZVwUnEO4iA@mail.gmail.com> (raw)
In-Reply-To: <CAEhQi8=HC7K9XxcCx4e83=JKCG3q=tAb2=BZmfvSqpwt4EG97g@mail.gmail.com>

I'd suggest you start by setting INCOMPATIBLE_LICENSE per image, e.g.
enable gpl3 ban only in the images that ship to the customers and not
across the entire build. Then carefully look at what pulls in bash
into those images and why, and reconfigure those pieces to not do that
(e.g. by reconfiguring the PACKAGECONFIGs), or rewrite the scripts in
posix shell.

Alex

On Wed, 6 Apr 2022 at 10:59, Mans Zigher <mans.zigher@gmail.com> wrote:
>
> Hi,
>
> I cannot use GPLv3 packages in our image build. I am no legal expert
> but from what I can understand most companies will not be able to
> comply with this license without allowing the customer to compile and
> deploy a new version of any GPLv3 package to the target. I know it is
> possible to comply with this but we are using secure boot and have not
> the time and probably no interest in setting up a solution for
> allowing customers to be able to deploy GPLv3 packages on the target.
> We are trying to make use of INCOMPATIBLE_LICENSE but that results in
> several issues. We have made sure that we don't include GPLv3 in the
> image build using a manual process but would like to use
> INCOMPATIBLE_LICENSE to alert any developer about the issue. It seems
> like INCOMPATIBLE_LICENSE is a bit harsh since it will catch any
> packages even if it is only part of the SDK and also for native
> packages that are not part of the image build.
>
> I cannot be the only one with this problem so how are other companies
> solving this issue? Are they just not using the INCOMPATIBLE_LICENSE?
> Are you setting up a parallel process for checking for any
> incompatible licenses issues?
>
> A more specific issue is that there are so many packages with bash
> dependencies which are pulling in bash which is GPLv3 so how have you
> solved that? Currently we have done some pretty uggly hacks which I am
> not that happy with but we needed to keep it out of the image.
>
> Thanks
>
> -=-=-=-=-=-=-=-=-=-=-=-
> Links: You receive all messages sent to this group.
> View/Reply Online (#56672): https://lists.yoctoproject.org/g/yocto/message/56672
> Mute This Topic: https://lists.yoctoproject.org/mt/90285507/1686489
> Group Owner: yocto+owner@lists.yoctoproject.org
> Unsubscribe: https://lists.yoctoproject.org/g/yocto/unsub [alex.kanavin@gmail.com]
> -=-=-=-=-=-=-=-=-=-=-=-
>