Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 694746 - app-arch/unarj-2.65 license issues, mirror and bindist restrictions needed
Summary: app-arch/unarj-2.65 license issues, mirror and bindist restrictions needed
Status: RESOLVED FIXED
Alias: None
Product: Gentoo Linux
Classification: Unclassified
Component: Current packages (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: James Le Cuirot
URL:
Whiteboard:
Keywords: PullRequest
Depends on: 740892
Blocks:
  Show dependency tree
 
Reported: 2019-09-17 17:31 UTC by Ulrich Müller
Modified: 2020-10-12 21:13 UTC (History)
3 users (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Ulrich Müller gentoo-dev 2019-09-17 17:31:18 UTC
The "arj" license was already discussed within the licenses team in 2011. The conclusion back then was that it is non-free:

"arj restricts the way the package may be used (not allowed to create competitioning product)."
(hanno on 2011-02-23 in <20110223115043.328ea510@laverne>)

"arj for example fails freedom 0"
(robbat2 on 2011-11-04 in <robbat2-20111104T202747-503561153Z@orbis-terrarum.net>)

But does it even allow redistribution? I don't see anything that would allow it in licenses/arj. (The license says: "If you wish to distribute a modified version of this program, you MUST indicate that it is a modified version both in the program and source code.", but that's a conditional statement, and the license doesn't grant its prerequisite.)

Also, unarj-2.65.tgz includes a different license, saying the following about distribution of the source code:

     If you distribute this software to others, you are required to
     distribute the ENTIRE package consisting of the following files:

     README.DOC
     UNARJ.EXE
     UNARJ.DOC
     UNARJ.C
     DECODE.C
     ENVIRON.C
     UNARJ.H
     UNARJ.DEF
     TCCUNARJ.MAK
     BCCUNARJ.MAK
     BCC32.MAK
     QCLUNARJ.MAK
     OS2UNARJ.MAK
     TECHNOTE.DOC

However, the tarball doesn't include README.DOC, nor any of the *.MAK files.
Comment 1 Hanno Böck gentoo-dev 2019-09-17 19:34:35 UTC
These look more like misunderstandings, probably upstream cleaned up the files and forgot to remove them from the "license". I guess this could be fixed by talking to upstream.

However the question is if anyone needs this package. There's libarchive and bsdtar, which is a well maintained free implementation that unpacks arj and loads of other exotic archiving formats.
Comment 2 Ulrich Müller gentoo-dev 2019-09-18 08:46:50 UTC
(In reply to Hanno Boeck from comment #1)
> These look more like misunderstandings, probably upstream cleaned up the
> files and forgot to remove them from the "license". I guess this could be
> fixed by talking to upstream.

AFAICS, the tarball we are using originates from FreeBSD, and contains a (slightly) patched version. Upstream released 2.65 in 2002 as an ARJ archive. In principle we could repack that as a tarball, and add the BSD patch to filesdir.

> However the question is if anyone needs this package. There's libarchive and
> bsdtar, which is a well maintained free implementation that unpacks arj and
> loads of other exotic archiving formats.

Indeed.
Comment 3 Jared B. 2019-09-18 14:19:15 UTC
Just as an FYI, I grepped through the portage tree and it looks like the following are all the packages explicitly using unarj:

mail-filter/amavisd-new - RDEPEND
sys-apps/less - lesspipe.sh
games-action/descent2-data - DEPEND (unpacking game data files)
games-action/descent2-demodata - ditto

I haven't looked at the alternatives mentioned, but assuming they work as expected it should be pretty easy to rewrite both lesspipe.sh and the descent2 ebuilds to use something different.  I'm not familiar with amavisd-new and what may be required to change that.

If there's a desire to remove this from the tree, I can volunteer to update both less and descent2 and at least poke around at amavisd-new.
Comment 4 Hanno Böck gentoo-dev 2019-09-18 14:38:15 UTC
Sorry I was wrong, libarchive actually doesn't support arj.

7z does. A patch for lesspipe is trivial:
diff -u a/lesspipe b/lesspipe
--- a/lesspipe	2019-09-18 16:36:34.635410564 +0200
+++ b/lesspipe	2019-09-18 16:36:15.981411742 +0200
@@ -131,7 +131,7 @@
 	*.cpi|*.cpio) cpio -itv < "$1" ;;
 	*.ace)        unace l "$1" ;;
 	*.arc)        arc v "$1" ;;
-	*.arj)        unarj l -- "$1" ;;
+	*.arj)        7z l -- "$1" ;;
 	*.cab)        cabextract -l -- "$1" ;;
 	*.lha|*.lzh)  lha v "$1" ;;
 	*.zoo)        zoo -list "$1" || unzoo -l "$1" ;;


Unfortunately 7z doesn't really qualify as "well maintained" these days. But it's at least code with an unproblematic license.
Comment 5 Hanno Böck gentoo-dev 2019-09-18 14:43:20 UTC
FWIW and I just noticed that there's also a GPLed arj implementation we have already packaged (app-arch/arj). Also doesn't qualify as "well maintained", though we seem to be using a debian patchset that at least fixes known bugs.

So packages needing an arj unpacker can also switch to that.
Comment 6 Michał Górny archtester Gentoo Infrastructure gentoo-dev Security 2019-09-18 14:56:25 UTC
I suppose app-arch/arj is then the more logical solution.
Comment 7 Ulrich Müller gentoo-dev 2019-10-07 19:14:41 UTC
So, what will be the way forward?

The pristine distfile is still available at:
https://web.archive.org/web/20060211001855/http://mysite.verizon.net/vze3nqpn/files/unarj265.exe
We could repack that as a tarball (I guess unpacking the original with app-arch/arj or app-arch/p7zip makes no sense) which would allow us to distribute it.

Or alternatively, should we update reverse dependencies and remove the package?
Comment 8 Larry the Git Cow gentoo-dev 2020-09-05 23:08:04 UTC
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=5076a5d39849249f0ddc424bf5e36b69aa167892

commit 5076a5d39849249f0ddc424bf5e36b69aa167892
Author:     James Le Cuirot <chewi@gentoo.org>
AuthorDate: 2020-09-05 23:05:16 +0000
Commit:     James Le Cuirot <chewi@gentoo.org>
CommitDate: 2020-09-05 23:07:25 +0000

    games-action/descent2-data: Use arj instead of unarj
    
    unarj has a problematic license. Unlike descent2-demodata, this is
    untested as I don't have the CD but this case is much simpler so it
    should work.
    
    Bug: https://bugs.gentoo.org/694746
    Package-Manager: Portage-3.0.5, Repoman-3.0.1
    Signed-off-by: James Le Cuirot <chewi@gentoo.org>

 games-action/descent2-data/descent2-data-1.2.ebuild | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=11824574477f8b46388c6bc44a14bbe463346ec0

commit 11824574477f8b46388c6bc44a14bbe463346ec0
Author:     James Le Cuirot <chewi@gentoo.org>
AuthorDate: 2020-09-05 23:03:36 +0000
Commit:     James Le Cuirot <chewi@gentoo.org>
CommitDate: 2020-09-05 23:07:22 +0000

    games-action/descent2-demodata: Use arj instead of unarj, EAPI 7
    
    unarj has a problematic license. arj is better anyway as it handles
    multiple volumes for us.
    
    Bug: https://bugs.gentoo.org/694746
    Package-Manager: Portage-3.0.5, Repoman-3.0.1
    Signed-off-by: James Le Cuirot <chewi@gentoo.org>

 .../descent2-demodata-1.0-r1.ebuild                | 24 +++++++---------------
 1 file changed, 7 insertions(+), 17 deletions(-)
Comment 9 James Le Cuirot gentoo-dev 2020-09-06 14:34:06 UTC
I've addressed Descent, as you can see.

amavisd-new can use arj or unarj and actually says that arj is preferred. Ralph, I'm pinging you for your blessing to change this. If I don't here, I'll apply this in a week. There doesn't seem to be any reason for the older amavisd-new versions lying around so I'll clear those up while I'm at it.

Fun fact about lesspipe. The existing unarj l -- "$1" doesn't actually work, it just displays the help text. If you remove the -- then it works but for added fun, the -- does work with arj! This line was added by vapier in 2005 so no one noticed for 15 years. I guess I can just change this directly as it looks like lesspipe isn't versioned at all? Hell, it's already broken anyway. I propose:

arj l -- "$1" || unarj l "$1"
Comment 10 Ulrich Müller gentoo-dev 2020-09-06 19:32:17 UTC
(In reply to James Le Cuirot from comment #9)
> Fun fact about lesspipe. The existing unarj l -- "$1" doesn't actually work,
> it just displays the help text. If you remove the -- then it works but for
> added fun, the -- does work with arj! This line was added by vapier in 2005
> so no one noticed for 15 years. I guess I can just change this directly as
> it looks like lesspipe isn't versioned at all? Hell, it's already broken
> anyway. I propose:
> 
> arj l -- "$1" || unarj l "$1"

If nobody has noticed it for 15 years, then I'd suggest to remove the line altogether.
Comment 11 Ralph Seichter 2020-09-06 20:30:15 UTC
I have opened a pull request for amavisd-new, replacing RDEPEND=app-arch/unarj with app-arch/arj.
Comment 12 Larry the Git Cow gentoo-dev 2020-09-07 20:05:31 UTC
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=49e5ef6551f5d4e11e684d7ab4c32e09dcaf0295

commit 49e5ef6551f5d4e11e684d7ab4c32e09dcaf0295
Author:     Ralph Seichter <github@seichter.de>
AuthorDate: 2020-09-06 20:23:53 +0000
Commit:     James Le Cuirot <chewi@gentoo.org>
CommitDate: 2020-09-07 19:59:50 +0000

    mail-filter/amavisd-new: Depend on app-arch/arj
    
    Depend on app-arch/arj instead of app-arch/unarj because of licensing.
    
    Bug: https://bugs.gentoo.org/694746
    Package-Manager: Portage-3.0.4, Repoman-3.0.1
    Signed-off-by: Ralph Seichter <gentoo@seichter.de>
    Signed-off-by: James Le Cuirot <chewi@gentoo.org>

 .../amavisd-new/amavisd-new-2.12.0-r4.ebuild       | 203 +++++++++++++++++++++
 1 file changed, 203 insertions(+)
Comment 13 Larry the Git Cow gentoo-dev 2020-09-13 20:43:06 UTC
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=d4fa1ffef9503e2a5f7f1151ffba5892a4049b24

commit d4fa1ffef9503e2a5f7f1151ffba5892a4049b24
Author:     James Le Cuirot <chewi@gentoo.org>
AuthorDate: 2020-09-13 20:41:58 +0000
Commit:     James Le Cuirot <chewi@gentoo.org>
CommitDate: 2020-09-13 20:42:51 +0000

    sys-apps/less: Fix lesspipe handling of *.arj archives
    
    unarj is being last-rited so prefer arj. The way unarj was being
    called was also broken for years.
    
    Bug: https://bugs.gentoo.org/694746
    Package-Manager: Portage-3.0.6, Repoman-3.0.1
    Signed-off-by: James Le Cuirot <chewi@gentoo.org>

 sys-apps/less/files/lesspipe.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=b1fd5fa7032160601b99a9d9cbbbea7273a83820

commit b1fd5fa7032160601b99a9d9cbbbea7273a83820
Author:     James Le Cuirot <chewi@gentoo.org>
AuthorDate: 2020-09-13 20:40:08 +0000
Commit:     James Le Cuirot <chewi@gentoo.org>
CommitDate: 2020-09-13 20:42:48 +0000

    mail-filter/amavisd-new: Drop old 2.12.0-r3
    
    Bug: https://bugs.gentoo.org/694746
    Package-Manager: Portage-3.0.6, Repoman-3.0.1
    Signed-off-by: James Le Cuirot <chewi@gentoo.org>

 .../amavisd-new/amavisd-new-2.12.0-r3.ebuild       | 203 ---------------------
 1 file changed, 203 deletions(-)

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=2780b873f99f77d270424d8d6b0abaa32df34f56

commit 2780b873f99f77d270424d8d6b0abaa32df34f56
Author:     James Le Cuirot <chewi@gentoo.org>
AuthorDate: 2020-09-13 20:39:10 +0000
Commit:     James Le Cuirot <chewi@gentoo.org>
CommitDate: 2020-09-13 20:42:45 +0000

    mail-filter/amavisd-new: Stabilise 2.12.0-r4 on all arches
    
    The only difference is replacing unarj with arj. We want to last-rite
    the former and upstream recommends the latter anyway.
    
    Bug: https://bugs.gentoo.org/694746
    Package-Manager: Portage-3.0.6, Repoman-3.0.1
    Signed-off-by: James Le Cuirot <chewi@gentoo.org>

 mail-filter/amavisd-new/amavisd-new-2.12.0-r4.ebuild | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
Comment 14 Larry the Git Cow gentoo-dev 2020-09-13 21:02:53 UTC
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=512014d68e1c4d72d31e8399d346cf823cb29a71

commit 512014d68e1c4d72d31e8399d346cf823cb29a71
Author:     James Le Cuirot <chewi@gentoo.org>
AuthorDate: 2020-09-13 21:00:47 +0000
Commit:     James Le Cuirot <chewi@gentoo.org>
CommitDate: 2020-09-13 21:02:27 +0000

    profiles: Last-rite app-arch/arj
    
    License issues. app-arch/arj is a better alternative. Removal in 30
    days.
    
    Bug: https://bugs.gentoo.org/694746
    Signed-off-by: James Le Cuirot <chewi@gentoo.org>

 profiles/package.mask | 5 +++++
 1 file changed, 5 insertions(+)

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=db67267782e6fc775d83041ad0237767c4a861b3

commit db67267782e6fc775d83041ad0237767c4a861b3
Author:     James Le Cuirot <chewi@gentoo.org>
AuthorDate: 2020-09-13 20:56:47 +0000
Commit:     James Le Cuirot <chewi@gentoo.org>
CommitDate: 2020-09-13 21:02:23 +0000

    games-action/descent1-demodata: Use arj instead of unarj, EAPI 7
    
    unarj has a problematic license. arj is better anyway as it handles
    multiple volumes for us.
    
    Bug: https://bugs.gentoo.org/694746
    Package-Manager: Portage-3.0.6, Repoman-3.0.1
    Signed-off-by: James Le Cuirot <chewi@gentoo.org>

 .../descent1-demodata/descent1-demodata-1.4-r1.ebuild   | 17 ++++++-----------
 1 file changed, 6 insertions(+), 11 deletions(-)

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=dc06ee05fc4ce252a8279d4ab46dc7a014ddd115

commit dc06ee05fc4ce252a8279d4ab46dc7a014ddd115
Author:     James Le Cuirot <chewi@gentoo.org>
AuthorDate: 2020-09-13 20:53:26 +0000
Commit:     James Le Cuirot <chewi@gentoo.org>
CommitDate: 2020-09-13 21:02:20 +0000

    app-arch/xarchiver: Remove mention of app-arch/unarj
    
    It's about to be last-rited.
    
    Bug: https://bugs.gentoo.org/694746
    Package-Manager: Portage-3.0.6, Repoman-3.0.1
    Signed-off-by: James Le Cuirot <chewi@gentoo.org>

 app-arch/xarchiver/xarchiver-0.5.4.15.ebuild | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
Comment 15 Larry the Git Cow gentoo-dev 2020-10-12 21:13:59 UTC
The bug has been closed via the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=b3247af81789446309b23bef68ccd5e5842cc04d

commit b3247af81789446309b23bef68ccd5e5842cc04d
Author:     James Le Cuirot <chewi@gentoo.org>
AuthorDate: 2020-10-12 21:10:41 +0000
Commit:     James Le Cuirot <chewi@gentoo.org>
CommitDate: 2020-10-12 21:13:13 +0000

    app-arch/unarj: Remove last-rited package
    
    Closes: https://bugs.gentoo.org/694746
    Signed-off-by: James Le Cuirot <chewi@gentoo.org>

 app-arch/unarj/Manifest                            |   1 -
 .../unarj/files/unarj-2.65-CAN-2004-0947.patch     |  49 --------
 .../unarj/files/unarj-2.65-Wformat-security.patch  |  66 -----------
 app-arch/unarj/files/unarj-2.65-gentoo-fbsd.patch  |  10 --
 app-arch/unarj/files/unarj-2.65-sanitation.patch   | 126 ---------------------
 app-arch/unarj/metadata.xml                        |   5 -
 app-arch/unarj/unarj-2.65.ebuild                   |  31 -----
 7 files changed, 288 deletions(-)

Additionally, it has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=ddbf228495ab2654cc522f7780e3144e3265b25a

commit ddbf228495ab2654cc522f7780e3144e3265b25a
Author:     James Le Cuirot <chewi@gentoo.org>
AuthorDate: 2020-10-12 21:12:16 +0000
Commit:     James Le Cuirot <chewi@gentoo.org>
CommitDate: 2020-10-12 21:13:20 +0000

    profiles: app-arch/unarj has been last-rited and removed
    
    Bug: https://bugs.gentoo.org/694746
    Signed-off-by: James Le Cuirot <chewi@gentoo.org>

 profiles/package.mask | 5 -----
 1 file changed, 5 deletions(-)