Nokogiri: Nokogiri LGPL-2.1?

[sarahtjones]

In closing issue #1417, you have added the pkg-config gem which is LGPL-2.1.

Certainly this should be an optional gem for those who cannot have the LGPL license in their projects.

[amilligan]

This is something of a big deal for anyone who cares about software licensing. Which should be everyone.

Anyone on Team Nokogiri care to comment, please?

[md5]

I just discovered this today and find it problematic as well.

[flavorjones]

Sorry for not responding more quickly. Apologies for putting people in a position where this is affecting your license constraints.

The unfortunate fact here is that, because pkg-config is used at gem installation time, unless it's declared as a dependency, there's no way to guarantee that it's already been installed. That is, if it's made optional, then it may get installed after Nokogiri, and in that case wouldn't actually be used.

I think the only alternatives are:

• remove the gem entirely,
• or convince the upstream maintainer to change the license.

Neither is great. I beg a bit more of your time to determine whether we can remove the gem without breaking some platforms' installation.

[amilligan]

Could we please have a progress update for this issue, and ideally an ETA? Version 1.6.7 suffers from CVE-2015-8806, and this version suffers from the LGPL license issue. Neither Scylla nor Charybdis appeals to any of the stakeholders I've discussed this with.

[larskanis]

@flavorjones I opened PR #1498 as a third alternative - what do you think about it?

[will-dealogic]

@flavorjones Would you be able to provide an update on this issue? We're starting a new project where nokogiri would be perfect, except for the restrictive license.

[amilligan]

@flavorjones Bump.

[amilligan]

@flavorjones Bump.

[flavorjones]

I need to understand #1498 better. But if that doesn't work, honestly, ripping it out is probably fine, it was only introduced to handle an edge case on freebsd anyway.

[amilligan]

@flavorjones How's this coming, Mike?

[amilligan]

@flavorjones Any updates, Mike?

[flavorjones]

We'll make the package optional and cut 1.6.9 soon. Thanks for your patience -- it's hard to find time to work on OSS these days.

[flavorjones]

Cutting 1.6.8.1 now ... (version corrected from above comment)

[kou]

FYI: There are many people who don't know about LGPL. If Nokogiri uses LGPL software as a library, we doesn't need to change Nokogiri's license. It means that Nokogiri uses MIT license and libraries used by Nokogiri use LGPL are no problem. For example, libxslt can use libgcrypt that uses LGPL but libxslt with libgcrypt can use MIT license not LGPL.

If Nokogiri embeds a LGPL licensed library into Nokogiri itself, Nokogiri must use LGPL, GPL or AGPL. But Nokogiri just uses LGPL licensed software as a library. So there are no problem that Nokogiri uses LGPL licensed software as a library.

[flavorjones]

@kou this issue is closed, pkg-config is no longer a hard dependency.

[unleashed]

This is wrong. It makes users explicitly depend on pkg-config even when the two gems are license compatible. :(

[flavorjones]

@unleashed It's already been fixed in the most recent version of nokogiri. As noted above. Several times.