Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 912274 - app-portage/eix-0.36.6 problematic output for packages with changed license
Summary: app-portage/eix-0.36.6 problematic output for packages with changed license
Status: UNCONFIRMED
Alias: None
Product: Gentoo Linux
Classification: Unclassified
Component: Current packages (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Michał Górny
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2023-08-14 11:05 UTC by steffen_brauer
Modified: 2023-08-16 07:09 UTC (History)
2 users (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description steffen_brauer 2023-08-14 11:05:08 UTC
The result for eix -v dev-libs/openssl for a host is

host-1 / # eix -v dev-libs/openssl
* dev-libs/openssl
     Available versions:  [M]1.0.2u-r1^td 1.1.1t-r1(0/1.1)^t 1.1.1t-r3(0/1.1)^t ~3.0.8-r4(0/3)^t **3.1.0-r3(0/3)^t
     IUSE (all versions): +asm bindist fips gmp kerberos ktls rfc3779 sctp sslv2 (+)sslv3 static-libs test tls-compression (+)tls-heartbeat vanilla verify-sig weak-ssl-ciphers ABI_MIPS="n32 n64 o32" ABI_S390="32 64" ABI_X86="32 64 x32" CPU_FLAGS_X86="sse2"
     Installed versions:  Version:   1.1.1t-r3(0/1.1)^t
                          Date:      00:22:25 04/24/23
                          USE:       asm -rfc3779 -sctp -sslv3 -static-libs -test -tls-compression -tls-heartbeat -vanilla -verify-sig -weak-ssl-ciphers ABI_MIPS="-n32 -n64 -o32" ABI_S390="-32 -64" ABI_X86="-32 -64 -x32" CPU_FLAGS_X86="-sse2"
                          RDEPEND:   !<net-misc/openssh-8.0_p1-r3
                          PDEPEND:   app-misc/ca-certificates
                          BDEPEND:   >=dev-lang/perl-5
                          EAPI:      8
     Best versions/slot:  1.1.1t-r3(0/1.1)^t
     Homepage:            https://www.openssl.org/
     Find open bugs:      https://bugs.gentoo.org/buglist.cgi?quicksearch=dev-libs%2Fopenssl
     Description:         Robust, full-featured Open Source Toolkit for the Transport Layer Security (TLS)
     License:             Apache-2.0


Installed is a OpenSSL 1.x version which is licensed under the openssl-license, yet eix returns the APL-2.0 which is what a 3.x version is licensed under.

Reproducible: Always
Comment 1 Martin Väth 2023-08-14 18:55:03 UTC
NOt a bug. eix does not claim that this license belongs to a particular version.

In fact, license is not special here. The eix database contains for every package and almost all metadata only one version. There are only very few exceptions from this rule which you can all see with options -vl.

The common metadata is always fetched from the newest version providing it.

WONTFIX.
Comment 2 steffen_brauer 2023-08-15 07:11:14 UTC
So by your argument it is perfectly fine to knowingly display wrong information to the user?

Also the manpage states
"-v, --verbose
              Use a verbose layout with additional information about search results such as the license of a package."

And it does NOT display the license of the specified package if it just displays the license of the package it has in its latest version. From a user standpoint relying on it you could just as well print a random license there or better just do not print it ever in any case.

It is a conceptually a mistake to regard it as a "onetime_info", as clearly some packages change their license over time. I can even an argument for packages having different homepages for different versions.
Comment 3 Martin Väth 2023-08-15 18:16:43 UTC
> knowingly display wrong information

Do you really think that such an aggressive lie will help you to convince me?

> if it just displays the license of the package it has in its latest version

That's obviously what makes most sense to call the license of the package.

> some packages change their license over time

The same holds for any other metadata of a package like description, homepage, etc. Nevertheless, eix does neither output nor store any of that metadata per version but only per package. This is part of the reason why eix is so fast and does not need huge disk space. eix is a quick search tool and not a full database of all metadata for all versions. Use equery or some other tool specialized on that if you want the latter.

As I already said: WONTFIX.
Comment 4 steffen_brauer 2023-08-16 07:09:44 UTC
>> knowingly display wrong information
> Do you really think that such an aggressive lie will help you to convince me?

BS. I will boil it down for you:

> dev-libs/openssl
> License:             Apache-2.0
(-v / -vl, makes no difference)

Maybe 50% correct without any warning to the user or any coverage in the man-page. So now you know a second time and my point still holds.

> equery m =dev-libs/openssl-1.1.1u
> License:     openssl
100% correct.

Whats the point of a query tool - fast or not- , if the output is inaccurate in some scenarios and its just taken for granted?

>> if it just displays the license of the package it has in its latest version
> That's obviously what makes most sense to call the license of the package.
Since some packages do change their license over time that logic is conceptually flawed.

And yes, I know WONTFIX. We already established that. At least place a warning in the man-page that the license field is tied to the most recent version.