Packages without current source of licenses

[aviks]

The following packages do not seem to have publicly available sources, and the latest release (cached on the package servers) do not have any associated license file in them. I believe therefore that there is no permission for anyone to use that code, or even cache it on the package servers. I think these packages should be removed from the registry.

BigG
Estapir
GAPTypes
InfrastructureSensing
MeshFinder
MirroredArrayViews

(PS: there are quite a few other packages in the registry without licenses, but since they have associated github repos, I will ping their authors first. If there is no response, we will have to take a similar call about those. But that's for later)

[nilshg]

I just checked InfrastructureSensing on JuliaHub to see how much usage it got which yielded nothing but intererstingly on JuliaHub the package is credited to @rbalexan. I'm not sure where JuliaHub gets that info but assuming this is correct maybe you could find other authors in this way?

[ericphanson]

Searching GAPTypes brought me to https://discourse.julialang.org/t/swizzling-the-super-type-of-a-foreign-julia-type-or-how-evil-must-i-be/33733 by @fingolfin

[ericphanson]

Ah, #19033 (comment) has a bunch of authors: @Moelf for BigG, @PetrKryslUCSD for MeshFinder, @lucianolorenti for Estapir, and @slmcbane for MirroredArrayViews

[nilshg]

Great detective work, looks like all packages can go into the "ping author" pile (and looks like at least some of the authors are still active in the community so that's helpful).

Thanks Avik for looking at this, it's one of those things that potential enterprise users might (rightly!) freak out over.

[fingolfin]

GAPTypes could be deleted / yanked from my POV. Of course you then may wish to yank old versions of GAP.jl that depend on it.

[StefanKarpinski]

While I don't disagree that we should remove these, I think that we should probably add terms of service to the registry, stating that by registering a package, you give at least some right to use the code. It's a little hard to pick terms; we may need to talk to a lawyer about this. I do also think that there's a pretty decent legal case to be made that by publishing and registering code, you obviously intended for people to use it, so that seems like some kind of implicit permission, but obviously we'd rather have explicit permission with clear terms.

[Moelf]

in my case it was superseded by https://github.com/tlienart/Franklin.jl so can we just delete it? I'm sure nobody ever used it

[PetrKryslUCSD]

I wonder if these could be removed from the registry?

https://github.com/PetrKryslUCSD/MeshPorter.jl
https://github.com/PetrKryslUCSD/MeshKeeper.jl
https://github.com/PetrKryslUCSD/MeshMaker.jl
https://github.com/PetrKryslUCSD/MeshFinder.jl

Their original raison d'etre passed.

[nilshg]

Wouldn't the easiest way forward here for the authors to just retrospectively slap an MIT license on this and then there's no need to yank anything?

[ericphanson]

I believe these particular repos have all been deleted, so they would need to be reconstituted

[lucianolorenti]

In my case the repository was deleted, I guess it can be removed from the registry

[fingolfin]

If the repository is gone (as in the GAPTypes case), where do we "slap" that license to?

[nilshg]

I thought the issue was that these packages are still installable from package servers, so presumably the repos are mirrored there? If that's not the case then yanking is by definition fine.

[Moelf]

Julia's pkg server is designed so that even if author deleted original repo, packages are still installable -- this is a good design.

deleting stuff from pkg server is a separate item, need manual review for sure

[nilshg]

That's what I understood, and I apologise if I'm just confusing the issue here but I thought the problem was exactly that

(i) there are packages that are installable from General,
(ii) but don't have a license and therefore expose users to litigation risk, and
(iii) as a point of principle we don't want to yank things from General due to the promises we make on reproducibility.

It seemed to me that to the extent that authors are still contactable it might be feasible to get their permission to just retroactively add an MIT license to wherever these package now exist and General is getting them from, solving the litigation risk issue without yanking.

I might be misunderstanding though and again sorry if I'm just adding noise here.