Vcpkg: [boost-iostreams] Should not depend on copy-left licensed code by default

[mschofie]

Is your feature request related to a problem? Please describe.
Boost has a very specific license - The Boost License. The "boost-iostreams" package, however, consumes ports with very different licenses _by default_. "boost-iostreams" (as per the CONTROL file) depends on non-Boost ports that have other licenses. Specifically, liblzma and zstd have a mix of licenses that includes copy-left licenses. I don't think that consumers of the Boost library would expect copy-left dependencies included by default.

• liblzma - The COPYING file shows the multiple licenses that are applied. ClearlyDefined.io declares the copyleft licenses.
• zstd - This project contains two licenses, for BSD-3 and GPL-2. ClearlyDefined.io shows both.

Proposed solution
boost-iostreams should not depend on copy-left licensed code by default. Consumers should be able to opt-in.

Describe alternatives you've considered
Forking the ports is an option.

[PhoebeHui]

@mschofie, it seems the license https://github.com/boostorg/iostreams/blob/master/LICENSE is same with https://www.boost.org/LICENSE_1_0.txt, and it says 'boostorg/iostreams is licensed under the Boost Software License 1.0'.

@BillyONeal, could you help take a look?

[BillyONeal]

You would need to take this up with the boost-iostreams developers; boost-iostreams requires those external libraries. Boost makes claims about their own code, but clearly document that they need those external dependencies here: https://www.boost.org/doc/libs/1_74_0/libs/iostreams/doc/index.html

They do have some options to disable these compression features, however, they appear to default to enabling them, given the name of the supplied option being NO_Xxx rather than USE_Xxx or similar.

As a result I believe we should respect the upstream project's decision, and they turn those on by default.

We would certainly accept a patch to the port enabling those features to be disabled so that you could disable the problematic parts by saying something like boost-iostreams[core].

[BillyONeal]

clearly document that they need those external dependencies here

Well that link didn't work because they use frames :/

https://www.boost.org/doc/libs/1_74_0/libs/iostreams/doc/installation.html#ide

[mschofie]

Thanks, @BillyONeal, I appreciate the perspective. I agree, making a change to support opting out seems to be the right thing to do given the boost-iostream decisions.