[Openembedded-architecture] Separating out old gplv2 recipes into their own layer

[Mark Hatle]

I don't necessarily want to add a 'me too' post.

But the question has come up elsewhere.  As a member of the OpenEmbedded
community I agree this is the right way we need to do things.

We simply do not have enough resources and time to manage everything for
everyone.  By moving the GPLv2 'alternative' versions of the software into an
external layer we can now:

*) Make it clear who is doing any security work (avoiding GPLv3 contamination)

*) Implement [if necessary] additional test cases

*) Clear maintainer(s) in case someone has a problem, or additional components
are needed or are offered.

My only objection, is I don't consider the GPLv2 to be a ticking timebomb of
security problems.  But more then likely they are places where additional
resources (not ones that regular OE-core maintainers and contributors wish to
provide.)


(The commercial hat I wear says I must have this and will likely need this for
the future as well... but moving it to another layer with a different maintainer
does not hurt my commercial use-cases, and may over the longer term help them.)

--Mark

On 3/2/17 7:33 AM, Richard Purdie wrote:
> At OEDAM, there was discussion about moving the old/obsolete GPLv2
> recipes currently in OE-Core into their own layer. These are recipes
> where the upstream has moved to GPLv3 and these old versions are the
> last ones under the GPLv2 license.
> 
> There are several reasons for this. There is a different quality of
> service with these recipes in that they don't get security fixes and
> upstream no longer care about them, in fact they're actively hostile
> against people using old versions. The recipes tend to need a different
> kind of maintenance to work with changes in the wider ecosystem and
> there needs to be isolation between changes made in the v3 versions and
> those in the v2 versions.
> 
> There are probably better ways to handle a "non-GPLv3" system but right
> now having these in OE-Core makes them look like a first class citizen
> when I believe they are a ticking time bomb for security issues.
> 
> Moving them into a separate layer at least makes this clearer, it also
> makes it clear how many of these there are. Some are probably not
> needed (e.g. mc), I also wonder whether some are useful (e.g. gmp)
> since most things that use them are GPLv3 only already. Someone could
> now more clearly see how to streamline the list of recipes here.
> 
> I'm proposing we make this separate layer for 2.3, I'm not seeing a
> good reason not to just get on and do this. The minimal YP testing of
> gplv2 only would continue for 2.3 and likely 2.4, after which the YP
> would probably drop official testing of the layer.
> 
> Does anyone have any strong objections. Also, do we have any volunteers
> for people who might maintain this layer in the future?
> 
> I have a draft version of the proposed layer at:
> 
> http://git.yoctoproject.org/cgit.cgi/meta-gplv2/
> 
> Cheers,
> 
> Richard
> _______________________________________________
> Openembedded-architecture mailing list
> Openembedded-architecture at lists.openembedded.org
> http://lists.openembedded.org/mailman/listinfo/openembedded-architecture
>