Gregory's Server@danderson y'know, that worries me more than "may contain curl". You made the thing... you should know if there's curl in there or not!
|
13 comments
 @danderson @evana This is the likely explanation. We did a similar thing for infotainment at an auto company I worked for: we listed the license of everything that was built in Yocto, but some of those (like GCC, bison, meson, autotools, and other build tools) are never shipped in the image, so technically we may not have needed to list them. The source code tarball you can request under the GPL written offer clause also contains those (even if they're not GPL).  @danderson This explanation is plausible. I cannot honestly argument with that. But it says some about the company using such scheme. And it isn't nice for them. So, probably you are right.  @evana @danderson The “yous” that made the thing—engineers—know. The “yous” that decreed the text be put in there—lawyers—don’t.  @ankitpati @evana @danderson This, and it's also easier to have a blanket statement than to ask the engineers every time.  @evana What makes you think because they "made the thing" they know what's inside? At many vendors, what they call the "development team" is mostly clicking things together from some "modular system". They have no clue what gets dragged in or, when you tell them, how to get rid of some unwanted dependency ("but we don't use that!"). Telling them "use exclude:group in your build.gradle" overtaxes them (yepp, a real case I had) 🤷♂️ @danderson @IzzyOnDroid @danderson I guess I need to be more clear: I think it's unfortunate that our tools don't automatically record what they put inside. I'm hopeful that the addition of SBOM requirements for federal contracting will help drive improvements in the tooling so that we can get the contents of our software automatically. Right now, I'm hearing that we know everything that goes into the factory, so we assume that all of that goes into the Twinkies that come out. Including the bolts... @evana Oopsie… No offense meant! Wasn't aware you were involved. Still, my "rant" holds its truth unfortunately in far too many places. But I should add that with the current tools it's not always easy to be aware what went it or what dragged in other things (well, one can check the dependency tree in most cases, but does not always remember too). One reason more than one FOSS dev expressed their thanks to the additional checks at the #IzzyOnDroid repo, for example… So: apologies 4 my phrasing! @IzzyOnDroid no problem! The post went a little further than I expected, and I wanted to follow up with how I thought we could genuinely make software better. @evana That's a driving force for me as well. If I might exaggerate a bit, I guess you'll have a hard time looking at just 10 Github repos without finding some issue, issue comment, PR or review by me 🙈 Especially if it's the repo of some Android app. And it's usually a clear win-win. Not being an Android dev, I've learned a lot about that during the discussions – while my reports usually uncovered something the devs were not aware of. Respect from both sides, precious outcome for all :awesome: |
@evana Knowing nothing about how garmin build firmware, my suspicion is it's something like: this is a list of all OSS present in their Yocto source tree, or similar. Rather than track what OSS makes it into which firmware builds for which SKUs, they just make a list of all OSS that gets too close to their build system, and put that one list in all products. But I dunno 🤷