[yocto-ab] Fwd: [Openembedded-architecture] Separating out old gplv2 recipes into their own layer

[Philip Balister]

I want to make all project members aware of this effort. Richard
describes the issues much better than I can. If you care about GPLv2
only builds, please make sure the appropriate people in your
organizations are following this work.

Thanks,

Philip


-------- Forwarded Message --------
Subject: [Openembedded-architecture] Separating out old gplv2 recipes
into their own layer
Date: Thu, 02 Mar 2017 13:33:34 +0000
From: Richard Purdie <richard.purdie at linuxfoundation.org>
To: openembedded-architecture
<openembedded-architecture at lists.openembedded.org>

At OEDAM, there was discussion about moving the old/obsolete GPLv2
recipes currently in OE-Core into their own layer. These are recipes
where the upstream has moved to GPLv3 and these old versions are the
last ones under the GPLv2 license.

There are several reasons for this. There is a different quality of
service with these recipes in that they don't get security fixes and
upstream no longer care about them, in fact they're actively hostile
against people using old versions. The recipes tend to need a different
kind of maintenance to work with changes in the wider ecosystem and
there needs to be isolation between changes made in the v3 versions and
those in the v2 versions.

There are probably better ways to handle a "non-GPLv3" system but right
now having these in OE-Core makes them look like a first class citizen
when I believe they are a ticking time bomb for security issues.

Moving them into a separate layer at least makes this clearer, it also
makes it clear how many of these there are. Some are probably not
needed (e.g. mc), I also wonder whether some are useful (e.g. gmp)
since most things that use them are GPLv3 only already. Someone could
now more clearly see how to streamline the list of recipes here.

I'm proposing we make this separate layer for 2.3, I'm not seeing a
good reason not to just get on and do this. The minimal YP testing of
gplv2 only would continue for 2.3 and likely 2.4, after which the YP
would probably drop official testing of the layer.

Does anyone have any strong objections. Also, do we have any volunteers
for people who might maintain this layer in the future?

I have a draft version of the proposed layer at:

http://git.yoctoproject.org/cgit.cgi/meta-gplv2/

Cheers,

Richard
_______________________________________________
Openembedded-architecture mailing list
Openembedded-architecture at lists.openembedded.org
http://lists.openembedded.org/mailman/listinfo/openembedded-architecture