Re: [Qemu-devel] NSIS - including DLL dependencies for Windows

["Daniel P. Berrangé" <berrange@redhat.com>]

On Thu, Jan 31, 2019 at 11:19:04AM +0000, Peter Maydell wrote:
> On Thu, 31 Jan 2019 at 10:50, Daniel P. Berrangé <berrange@redhat.com> wrote:
> >
> > On Thu, Jan 31, 2019 at 02:45:13PM +1100, Adam Baxter wrote:
> > > Hi,
> > > How do I gather and include the required DLLs (SDL, zlib etc) in the NSIS
> > > installer? (and also in a standalone build to be zipped up, but that's less
> > > important)
> > >
> > > I noticed the wiki doesn't really mention bundling dependencies anywhere.
> > >
> > > The official unofficial windows builds are documented at
> > > https://qemu.weilnetz.de/FAQ but this doesn't cover building the actual
> > > installer.
> >
> > Yeah, this is a pretty major ommision in QEMU's build rules for the NSIS
> > installer making it pretty much useless as is. We really need to expand
> > it so that it can resolve the dlls that qemu .exe's need, locate them
> > on the host and bundle them into the installer automatically.
> 
> I think my concern here potentially is a licensing one -- if we don't
> actually ship installer binaries then that's fine for us, but an
> installer script that automatically pulls in DLLs for glib and others
> is a bit of a footgun for anybody that uses it since it will very likely
> create an installer binary that is very difficult to ship to anybody
> whilst remaining compliant with the licenses for our dependencies.

I don't see this situation as much different in terms of licensing risk
from building & hosting / distributing a docker container image. In both
cases the person is bundling up a huge set of dependancies and need to
ensure they are compliant with licenses. The only difference is the file
format that the bundled content is in.

Essentially it is relying on the fact that the distro used as input for
the docker image (or nsis installer) is providing full source + build
tool chain, as the way to achieve license compliance.

So if anything I'd say that providing a fully scripted way to pick up
the DLLs from distro packages is a better way to help users achieve
license compliance than letting them copy around DLLs manually from
unknown sources. 

I can understand that QEMU project doesn't want to get into the business
of providing binary packages as it certainly simplifies our life from the
POV of licensing by not having to think about it at all. I think it is
reasonable to allow users to have an easy way to build an installer for
their own usage though.

Regards,
Daniel
-- 
|: https://berrange.com      -o-    https://www.flickr.com/photos/dberrange :|
|: https://libvirt.org         -o-            https://fstop138.berrange.com :|
|: https://entangle-photo.org    -o-    https://www.instagram.com/dberrange :|