Re: [yocto] License reporting for golang (and rust)

["Randy MacLeod" <randy.macleod@windriver.com>]

On 2020-06-22 4:53 a.m., Irving ST wrote:
> Hello,
> 
> I am building a device that uses some Go (and Rust) dependencies. This
> is on Yocto 2.7 / Warrior.
> 
> I noticed that after building an image, the generated license.manifest
> and package.manifest (in tmp/deploy/licenses/) does not contain any
> mention of go packages or rust crates. The go packages seem to
> generate directories in tmp/deploy/licenses/ but they do not seem to
> be reported in the final image.
> 
> For example, an image that contains docker (from meta-virtualization
> layer) has build dependencies on, say, go-cli (also from
> meta-virtualization layer). This is specified in the docker recipe
> having DEPENDS on go-cli recipe. I saw tmp/deploy/licenses/go-cli
> directory exists with licensing information, but
> tmp/deploy/licenses//license.manifest does not contain any reference
> to go-cli.
> 
> My best *guess* at the moment is because go packages are build
> dependencies (DEPENDS instead of RDEPENDS), they are not considered
> shipped packages by bitbake (because they are not shipped, the final
> docker package is) and are not listed in the manifest files. This
> makes licensing compliance more difficult since I still need to show
> the copyright notices even for permissive licenses like MIT - but I
> can't show it if I don't know that it has been shipped with the image
> (since it's not in the manifest).
> 
> Is there a way to get a manifest of go packages shipped into the image?
> This issue seems to happen with rust crates as well, so a solution /
> explanation for rust would be greatly appreciated too.
> 
> Sorry if this has been resolved somewhere, I'm not exactly super
> familiar with the golang build system or its integration with Yocto.


Hi Irving,

I haven't heard or such a problem until now.

If possible, please check if it's still happening on a newer release
or the master branch.

If it is still an issue, please open a bug with detailed steps
to reproduce in:

    https://bugzilla.yoctoproject.org/
See:
    https://wiki.yoctoproject.org/wiki/Bug_reporting_and_Information_levels

We're a little short on people to fix bugs so you could assign
the defect to yourself. If you're not able to do that, we review new
bugs once a week so maybe someone will decide to work on the defect.

Thanks,
../Randy
> 
> Best regards,
> Irving Tjiptowarsono
> 
> 
> 
> 


-- 
# Randy MacLeod
# Wind River Linux