Le lundi 05 mars 2018 à 10:07 -0500, Lokesh Mandvekar a écrit :
When you ship a Go binary like cri-o, do you need to include the licenses of all vendored dependencies at %license? Or does it suffice to specify just the license file of the main package itself?
You *must* follow Fedora licensing guidelines for everything you ship, whether it is built or not. That includes license files and package licensing tag.
There used to be some tolerance for items removed as first step in %prep (ie rm -fr vendor), as long as they were under a Fedora-friendly license. For stuff Fedora actually forbids, packagers were required and are probably still required to regenerate the archive used by the spec file without the offending content before uploading to koji.
Apart from Fedora requirements, that go a bit beyond the law to simplify maintenance, from a legal POW, you should never state a package is under a particular license before making sure all the licenses in play actually devolve to this license.
And lastly any time you ship other people's code, either built or not, it is good taste to document and preserve its licensing.
Which is why, vendoring (bundling) and static linking (when all the code ends up a single binary) is a terrible idea from a legal POW.
So:
1. for devel-only Go packages: don't ever vendor, rm all traces of bundled code, that will save you loads of legal problems
2. for Go packages that build binaries: if you don't vendor anything, (rm -fr vendor as first step or better get an upstream archive without third-party code) and you have satisfied yourself all the licenses devolve to a single one, it's probably ok to document just this one
3. it is *way* simpler with dynamic linking where all the objects are nicely separated, in different packages, with separate documentation, and legal analysis can be made at the time you assemble the packages, not at the time you ship them. Volunteers willing to convert Fedora packages to dynamic linking are welcome.
4. if you publish a Go project: don't vendor, use stable releases of other components, and if you do vendor don't include the vendored files in you git repo, just the vendor config file.
But do ask spot or fedoral-legal when in doubt.
Regards,