[gentoo-dev] Local bindist descriptions

[gentoo-dev] Local bindist descriptions

[Alexander Berntsen]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

All packages should have local descriptions of what the bindist
USE-flag specifically does. This should be a policy when writing
ebuilds that include it.

The bindist USE-flag is for avoiding components in a package that
would result in non-re-distributable binary packages. The generic
global description is "Flag to enable or disable options for prebuilt
(GRP)  packages (eg. due to licensing issues)". This is very vague. It
does not in any way explain the specifics of what enabling the flag
will do.

This means that each package should describe what it specifically
does. www-client/firefox-10.0.11 is one example that does this
properly with "Disable official Firefox branding (icons, name) which
are not binary-redistributable according to upstream." This is
perfectly descriptive. net-misc/openssh is one example that does not
have a local/specific description.

To me, this is unacceptable. Someone who cares enough about licensing
and distribution etc. to set the bindist USE-flag, will likely care
about the specifics of the it as well. Furthermore, different people
find different things unacceptable. As an example, patent-encumbered
codec support in ffmpeg is something that might be considered
unacceptable to some. However, the very same people might not be worried
about trademark/branding-related issues, such as is the case with
Firefox. This is comparable to how some find the GPL acceptable, but
not the Artistic License 1.0, and ebuilds do indeed require the
licence -- not LICENSE="free-ish".

I have filed bug reports for the affected packages. However, to avoid
this becoming an issue in the future I think it would be fruitful to
have a policy or something to make sure all ebuilds that make use of the
bindist USE-flag at the very least describe *what* toggling it does in
the context of that specific package, and preferably also *why* the
flag exists in the first place. This will summarise the problem and
the solution that USE=+bindist offers for the end-user. I don't find
it acceptable to make the details "left as an exercise" to the user.

The affected packages per now* are all versions of:

dev-db/libdbi-drivers
dev-db/opendbx
dev-libs/gf2x
gnome-extra/libgda
kde-base/oxygen-icons
media-libs/freetype
media-libs/libaacplus
media-libs/mediastreamer
media-libs/mesa
media-plugins/mediastreamer-silk
media-video/ffmpeg
media-video/libav
media-video/mplayer
media-video/mplayer2
net-dialup/freeradius
net-libs/gnutls
net-libs/liboauth
net-misc/openssh
net-misc/vpnc
sci-visualization/qtiplot

Newer versions of gnutls don't have the USE-flag, so I'll let that one
slide. ffmpeg is problematic... see:
<https://bugs.gentoo.org/show_bug.cgi?id=369249>.

*27/12/12 21:38

- - --
Alexander
alexander@plaimi.net
http://plaimi.net/~alexander
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.19 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iF4EAREIAAYFAlDfgr4ACgkQRtClrXBQc7Uk1wEAjWXbV8bYtsUu6BXFRXhBXcMr
5eEHDbA9BTcXg+ouKsUA/RAKFzGA/gW40oSpJecf3zics7wQ4h7xYhPbbtvGvF9x
=xkAA
-----END PGP SIGNATURE-----

Re: [gentoo-dev] Local bindist descriptions

[Matt Turner]

On Sat, Dec 29, 2012 at 3:54 PM, Alexander Berntsen
<alexander@plaimi.net> wrote:
> All packages should have local descriptions of what the bindist
> USE-flag specifically does. This should be a policy when writing
> ebuilds that include it.

Agreed.

> media-libs/mesa

Fixed. (bug 448932)

Re: [gentoo-dev] Local bindist descriptions

[Mike Gilbert]

On Sat, Dec 29, 2012 at 6:54 PM, Alexander Berntsen
<alexander@plaimi.net> wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA256
>
> All packages should have local descriptions of what the bindist
> USE-flag specifically does. This should be a policy when writing
> ebuilds that include it.
> ...
> I have filed bug reports for the affected packages. However, to avoid
> this becoming an issue in the future I think it would be fruitful to
> have a policy or something to make sure all ebuilds that make use of the
> bindist USE-flag at the very least describe *what* toggling it does in
> the context of that specific package, and preferably also *why* the
> flag exists in the first place. This will summarise the problem and
> the solution that USE=+bindist offers for the end-user. I don't find
> it acceptable to make the details "left as an exercise" to the user.

Once all packages currently using the flag have local descriptions, we
could remove bindist from profiles/use.desc, converting it from a
global to a local use flag. This would cause repoman to reject any new
instances without a local description.

That would be much more effective than a policy that may be
(accidentally) ignored.

Re: [gentoo-dev] Local bindist descriptions

[Diego Elio Pettenò]

On 30/12/2012 04:03, Mike Gilbert wrote:
> That would be much more effective than a policy that may be
> (accidentally) ignored.

+1

-- 
Diego Elio Pettenò — Flameeyes
flameeyes@flameeyes.eu — http://blog.flameeyes.eu/

Re: [gentoo-dev] Local bindist descriptions

[Alexander Berntsen]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

On 30/12/12 12:39, Diego Elio Pettenò wrote:
> On 30/12/2012 04:03, Mike Gilbert wrote:
>> That would be much more effective than a policy that may be 
>> (accidentally) ignored.
> 
> +1
+1 from me as well. A much simpler and reliable way of achieving what
I want.

- -- 
Alexander
alexander@plaimi.net
http://plaimi.net/~alexander
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.19 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iF4EAREIAAYFAlDgKJ8ACgkQRtClrXBQc7XRqgEAn4IGnXvevFHkfidz6BYwR9lt
ZM/s9E1s7pRcbq92RpUA/3DoaKg6qzEKV0VgjVDC9czRfP1eZDU/RYJmXJbpaoqC
=drvi
-----END PGP SIGNATURE-----

Re: [gentoo-dev] Local bindist descriptions

[Alexis Ballier]

On Sun, 30 Dec 2012 12:42:23 +0100
Alexander Berntsen <alexander@plaimi.net> wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA256
> 
> On 30/12/12 12:39, Diego Elio Pettenò wrote:
> > On 30/12/2012 04:03, Mike Gilbert wrote:
> >> That would be much more effective than a policy that may be 
> >> (accidentally) ignored.
> > 
> > +1
> +1 from me as well. A much simpler and reliable way of achieving what
> I want.

It's probably too idealistic but I tend to consider that global flags
should be enabled/disabled globally while local flags on a
per-package basis. bindist is really something you want to enable
globally.

Re: [gentoo-dev] Local bindist descriptions

[Cyprien Nicolas]

Alexis Ballier wrote:
> It's probably too idealistic but I tend to consider that global flags
> should be enabled/disabled globally while local flags on a
> per-package basis. bindist is really something you want to enable
> globally.
>
On the other hand, "doc" is a global flag you don't want to enable globally.

-- 
Cyprien (Fulax)

Re: [gentoo-dev] Local bindist descriptions

[Mike Frysinger]

[-- Attachment #1: Type: Text/Plain, Size: 484 bytes --]

On Wednesday 02 January 2013 12:58:01 Cyprien Nicolas wrote:
> Alexis Ballier wrote:
> > It's probably too idealistic but I tend to consider that global flags
> > should be enabled/disabled globally while local flags on a
> > per-package basis. bindist is really something you want to enable
> > globally.
> 
> On the other hand, "doc" is a global flag you don't want to enable
> globally.

or "vanilla" or "debug" or "examples" ...

i'm sure there are others too
-mike

[-- Attachment #2: This is a digitally signed message part. --]
[-- Type: application/pgp-signature, Size: 836 bytes --]

[gentoo-dev] Re: Local bindist descriptions

[Nuno J. Silva]

On 2012-12-30, Alexander Berntsen wrote:

> All packages should have local descriptions of what the bindist
> USE-flag specifically does. This should be a policy when writing
> ebuilds that include it.

Agreed, as a gentoo user, I like to know why is the flag there.

> The bindist USE-flag is for avoiding components in a package that
> would result in non-re-distributable binary packages. The generic
> global description is "Flag to enable or disable options for prebuilt
> (GRP)  packages (eg. due to licensing issues)". This is very vague. It
> does not in any way explain the specifics of what enabling the flag
> will do.

And, if the global description is kept, maybe it should be rewritten so
that it reads something like "Disable compilation of features or content
that render the resulting binaries undistributable (due to,
eg. licensing or patents)".

> This means that each package should describe what it specifically
> does. www-client/firefox-10.0.11 is one example that does this
> properly with "Disable official Firefox branding (icons, name) which
> are not binary-redistributable according to upstream." This is
> perfectly descriptive. net-misc/openssh is one example that does not
> have a local/specific description.
>
> To me, this is unacceptable. Someone who cares enough about licensing
> and distribution etc. to set the bindist USE-flag, will likely care
> about the specifics of the it as well. Furthermore, different people
> find different things unacceptable. As an example, patent-encumbered
> codec support in ffmpeg is something that might be considered
> unacceptable to some. However, the very same people might not be worried
> about trademark/branding-related issues, such as is the case with
> Firefox. This is comparable to how some find the GPL acceptable, but
> not the Artistic License 1.0, and ebuilds do indeed require the
> licence -- not LICENSE="free-ish".

It is indeed like LICENSE="free-ish". The description does not tell much
more than "there may be some issue". And issues are different. While,
with Firefox, the issue is just that you can't distribute the binaries,
with patents I wonder if there are cases were you aren't even legally
allowed to compile the code for your own personal use (but, well,
IANAL).

[...]
> ffmpeg is problematic... see:
> <https://bugs.gentoo.org/show_bug.cgi?id=369249>.

I see his point that emerge will sort of imply what does bindist do, but
it requires running emerge several times with different USE flag
combinations, while just writing a small explanation wouldn't hurt and
would save a lot of time.

-- 
Nuno Silva (aka njsg)
http://njsg.sdf-eu.org/

Re: [gentoo-dev] Re: Local bindist descriptions

[Alexander Berntsen]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

On 30/12/12 13:15, Nuno J. Silva wrote:
> I see his point that emerge will sort of imply what does bindist
> do, but it requires running emerge several times with different USE
> flag combinations, while just writing a small explanation wouldn't
> hurt and would save a lot of time.
You can't check in advance what's going on except for maybe reading
the ebuild. If you happen to have the constraints satisfied for some
reason, you will never even get an error. Furthermore, just *why* is
the constraint there? Patent infringement? Licence incompatibility?
Etc. ffmpeg is like the holy grail of local bindist descriptions.

- -- 
Alexander
alexander@plaimi.net
http://plaimi.net/~alexander
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.19 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iF4EAREIAAYFAlDgPHgACgkQRtClrXBQc7U7wwD/Rv4llPlDda83NokcA44tgeSy
3LkRZM6/Oz7RBLXpDQ4A/0OY2sdRPYLrAnBumfr9ZLEhqx5/W6x6bwOI1JVs7Kt9
=2E3Y
-----END PGP SIGNATURE-----

Re: [gentoo-dev] Re: Local bindist descriptions

[Alexis Ballier]

On Sun, 30 Dec 2012 14:07:04 +0100
Alexander Berntsen <alexander@plaimi.net> wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA256
> 
> On 30/12/12 13:15, Nuno J. Silva wrote:
> > I see his point that emerge will sort of imply what does bindist
> > do, but it requires running emerge several times with different USE
> > flag combinations, while just writing a small explanation wouldn't
> > hurt and would save a lot of time.
> You can't check in advance what's going on except for maybe reading
> the ebuild.

Maybe you could suggest a nice beforehand UI for REQUIRED_USE
constraints.

> If you happen to have the constraints satisfied for some
> reason, you will never even get an error.

Meaning you can redistribute the binary.

> Furthermore, just *why* is
> the constraint there? Patent infringement? Licence incompatibility?

Because you can't redistribute the binary if the constraint is not
satisfied :)

> Etc. ffmpeg is like the holy grail of local bindist descriptions.

bindist does absolutely nothing by itself there. do you really want a
description like "Enforces license compatibility constraints" ?
I consider this a subset of the current bindist description. If you
don't then maybe the bindist description should be updated.

A.

Re: [gentoo-dev] Re: Local bindist descriptions

[Alexander Berntsen]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

On 30/12/12 15:01, Alexis Ballier wrote:
> Maybe you could suggest a nice beforehand UI for REQUIRED_USE 
> constraints.
I think this is orthogonal to the discussion. If ffmpeg had a local
description of bindist,
	# equery u ffmpeg
would output an explanation -- and I believe this is the most common
way to check USE-flags on beforehand.

>> If you happen to have the constraints satisfied for some reason,
>> you will never even get an error.
> 
> Meaning you can redistribute the binary.
Yes, but you will never be made aware of the issue.

>> Furthermore, just *why* is the constraint there? Patent
>> infringement? Licence incompatibility?
> 
> Because you can't redistribute the binary if the constraint is not 
> satisfied :)
Yes, but why not? What is it with this constraint that makes it
inherently not re-distributable unless it is satisfied?

> bindist does absolutely nothing by itself there. do you really want
> a description like "Enforces license compatibility constraints" ?
That would satisfy the *what* of a local bindist. If you are able to
satisfy the *why* as well, that would be nice.

- -- 
Alexander
alexander@plaimi.net
http://plaimi.net/~alexander
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.19 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iF4EAREIAAYFAlDgS00ACgkQRtClrXBQc7X4wAD/bHYhg9f9Esya/Mr3kBqTghfY
ZTbE8q4VpLyufIfRJAgA+wUbP3B/Lt0cawxW5AyRTNst3Kcgfd6HYvn/dnlu0j4K
=Ffxa
-----END PGP SIGNATURE-----

Re: [gentoo-dev] Re: Local bindist descriptions

[Alexis Ballier]

On Sun, 30 Dec 2012 15:10:21 +0100
Alexander Berntsen <alexander@plaimi.net> wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA256
> 
> On 30/12/12 15:01, Alexis Ballier wrote:
> > Maybe you could suggest a nice beforehand UI for REQUIRED_USE 
> > constraints.
> I think this is orthogonal to the discussion. If ffmpeg had a local
> description of bindist,
> 	# equery u ffmpeg
> would output an explanation -- and I believe this is the most common
> way to check USE-flags on beforehand.

as said before, the global useflag description should be updated (GRP
is long dead...)

> 
> >> If you happen to have the constraints satisfied for some reason,
> >> you will never even get an error.
> > 
> > Meaning you can redistribute the binary.
> Yes, but you will never be made aware of the issue.

Good for you since there is no issue :)

> >> Furthermore, just *why* is the constraint there? Patent
> >> infringement? Licence incompatibility?
> > 
> > Because you can't redistribute the binary if the constraint is not 
> > satisfied :)
> Yes, but why not? What is it with this constraint that makes it
> inherently not re-distributable unless it is satisfied?
> 
> > bindist does absolutely nothing by itself there. do you really want
> > a description like "Enforces license compatibility constraints" ?
> That would satisfy the *what* of a local bindist. If you are able to
> satisfy the *why* as well, that would be nice.

the *why* is not the purpose of a useflag imho: you cant link to openssl
from a gpl binary because its a 4 clauses bsd license; i dont remember
on top of my head but other constraints also have different reasons;
being "license incompatible" as the answer to the *why* is the best you
can do there.

Re: [gentoo-dev] Re: Local bindist descriptions

[Michał Górny]

[-- Attachment #1: Type: text/plain, Size: 852 bytes --]

On Sun, 30 Dec 2012 11:01:52 -0300
Alexis Ballier <aballier@gentoo.org> wrote:

> > Etc. ffmpeg is like the holy grail of local bindist descriptions.
> 
> bindist does absolutely nothing by itself there. do you really want a
> description like "Enforces license compatibility constraints" ?
> I consider this a subset of the current bindist description. If you
> don't then maybe the bindist description should be updated.

Well, that's another problem we have there. I really like the ffmpeg
idea of 'bindist' not doing anything by itself. If all packages did
that, I would see no problem with having global meaningful 'bindist'.

But if in some cases USE=bindist does something, then I believe ffmpeg
should describe that it just 'enforces REQUIRED_USE contraints' with no
hidden magic beneath.

-- 
Best regards,
Michał Górny

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 316 bytes --]

Re: [gentoo-dev] Re: Local bindist descriptions

[Alexis Ballier]

On Sun, 30 Dec 2012 15:15:25 +0100
Michał Górny <mgorny@gentoo.org> wrote:

> On Sun, 30 Dec 2012 11:01:52 -0300
> Alexis Ballier <aballier@gentoo.org> wrote:
> 
> > > Etc. ffmpeg is like the holy grail of local bindist descriptions.
> > 
> > bindist does absolutely nothing by itself there. do you really want
> > a description like "Enforces license compatibility constraints" ?
> > I consider this a subset of the current bindist description. If you
> > don't then maybe the bindist description should be updated.
> 
> Well, that's another problem we have there. I really like the ffmpeg
> idea of 'bindist' not doing anything by itself. If all packages did
> that, I would see no problem with having global meaningful 'bindist'.
> 
> But if in some cases USE=bindist does something, then I believe ffmpeg
> should describe that it just 'enforces REQUIRED_USE contraints' with
> no hidden magic beneath.

Yep you're right, I guess in that case it's good to add such a
description.

[gentoo-dev] Re: Local bindist descriptions

[Nuno J. Silva]

On 2012-12-31, Alexis Ballier wrote:

> On Sun, 30 Dec 2012 15:15:25 +0100
> Michał Górny <mgorny@gentoo.org> wrote:
>
>> On Sun, 30 Dec 2012 11:01:52 -0300
>> Alexis Ballier <aballier@gentoo.org> wrote:
>> 
>> > > Etc. ffmpeg is like the holy grail of local bindist descriptions.
>> > 
>> > bindist does absolutely nothing by itself there. do you really want
>> > a description like "Enforces license compatibility constraints" ?
>> > I consider this a subset of the current bindist description. If you
>> > don't then maybe the bindist description should be updated.
>> 
>> Well, that's another problem we have there. I really like the ffmpeg
>> idea of 'bindist' not doing anything by itself. If all packages did
>> that, I would see no problem with having global meaningful 'bindist'.
>> 
>> But if in some cases USE=bindist does something, then I believe ffmpeg
>> should describe that it just 'enforces REQUIRED_USE contraints' with
>> no hidden magic beneath.
>
> Yep you're right, I guess in that case it's good to add such a
> description.

And maybe "check ebuild for more information", although I think this is
rather suboptimal approach, if we're providing a description for it, we
may as well provide a more complete one, and, for the same cost, make
life easier for other people:

   "Do not allow the compilation of patent-encumbered AAC
   encoders. Please note that disabling this flag does not enable these
   features, which are ruled by separate flags (encoding and either faac
   or aacplus)."

-- 
Nuno Silva (aka njsg)
http://njsg.sdf-eu.org/

Re: [gentoo-dev] Re: Local bindist descriptions

[Diego Elio Pettenò]

On 31/12/2012 14:28, Nuno J. Silva wrote:
>    "Do not allow the compilation of patent-encumbered AAC
>    encoders. Please note that disabling this flag does not enable these
>    features, which are ruled by separate flags (encoding and either faac
>    or aacplus)."

Congrats for missing the point. It's not "patent-encumbered" being the
keyword, but the license incompatibility.

-- 
Diego Elio Pettenò — Flameeyes
flameeyes@flameeyes.eu — http://blog.flameeyes.eu/