Opened 5 years ago

Closed 16 months ago

#12388 closed enhancement (wontfix)

Debian geoip-database-contrib dependency

Reported by: cypherpunks Owned by: hellais
Priority: Low Milestone:
Component: Archived/Ooni Version:
Severity: Normal Keywords: archived-closed-2018-07-04
Cc: lunar Actual Points:
Parent ID: Points:
Reviewer: Sponsor:

Description

Probably it would be better if geoip-database-contrib package is a a requirement and not a suggestion since without that package there is no information about the ASN and is misleadingly reported as AS0. Of course if this is the case, geoip-database package should be completely removed from the dependency list.

Child Tickets

Change History (12)

comment:1 Changed 5 years ago by hellais

Cc: lunar added

The problem with making the debian package depend on a contrib package is that it would mean that the package would then go in contrib, leading to a smaller user base.

The ideal solution would be to find a way to make geoip-database a package that could be part of debian (non contrib).

I would also like to know what Lunar thinks about this though.

comment:2 Changed 5 years ago by cypherpunks

fyi ooniprobe depends on geoip-database package but only geoip-database-contrib provides the ASN records.

comment:3 Changed 5 years ago by lunar

The issue here is either documentation or the reliance on non-free data. Improving one or removing the other would solve the problem. The Debian package respects the recommendations of the Debian policy.

comment:4 Changed 5 years ago by cypherpunks

https://github.com/aagbsn/geoip_org_generator

some work needs to be done to merge this into the debian-database package, though.

comment:5 Changed 5 years ago by lunar

Do you have freely licensed data to give to such tool?

comment:6 Changed 5 years ago by cypherpunks

https://download.maxmind.com/download/geoip/database/asnum/GeoIPASNum2.zip
https://download.maxmind.com/download/geoip/database/asnum/GeoIPASNum2v6.zip

http://dev.maxmind.com/geoip/legacy/geolite/
"""
License

The GeoLite databases are distributed under the Creative Commons Attribution-ShareAlike 3.0 Unported License. The attribution requirement may be met by including the following in all advertising and documentation mentioning features of or use of this database:

This product includes GeoLite data created by MaxMind, available from
<a href="http://www.maxmind.com">http://www.maxmind.com</a>.
"""
See: https://creativecommons.org/licenses/by-sa/3.0/

Also, blockfinder (https://github.com/ioerror/blockfinder) exports CSV, but I haven't normalized the export to match MaxMind's format yet, and there is a bug where, if the input dataset contains overlapping (e.g. supernets) regions, the least specific prefix is matched. MaxMind curates their dataset (see the csv) so that there aren't overlapping regions. If I do something similar, we can obtain an open dataset of IP prefixes to AS mappings from routeviews.org routing table snapshots (or similar).

comment:7 Changed 5 years ago by lunar

Oh but that's very good news! Hear: In contrast to the CC-SA 1.0 license, version 3.0 is considered to be compatible to the DFSG.

So we simply need to ask the maintainer of the geoip-database to include more databases!

comment:8 Changed 5 years ago by lunar

Debian bug #766736

comment:9 Changed 3 years ago by irl

Severity: Normal

This issue was marked as resolved in Debian by Patrick Matthäi <pmatthaei@…>.

We do still have a suggests for geoip-database-contrib though.

@hellais is this still an issue? can we drop the suggests?

comment:10 in reply to:  9 ; Changed 3 years ago by hellais

Replying to irl:

This issue was marked as resolved in Debian by Patrick Matthäi <pmatthaei@…>.

What was the resolution for this?

We do still have a suggests for geoip-database-contrib though.

@hellais is this still an issue? can we drop the suggests?

I think given the fact that ooniresources downloads the GeoIP databases (together with the testing lists) and is a requirement to running oonideckgen, perhaps the ideal way forward is to run ooniresources when installing the package and remote all geoip related dependencies.

comment:11 in reply to:  10 Changed 3 years ago by irl

Replying to hellais:

I think given the fact that ooniresources downloads the GeoIP databases (together with the testing lists) and is a requirement to running oonideckgen, perhaps the ideal way forward is to run ooniresources when installing the package and remote all geoip related dependencies.

We do run ooniresources in the postinst script. During the build of the package we use the geoip library from Debian main though, which also means our tests run without the non-free geoip database.

What was the resolution for this?

The resolution of the Debian bug was that he was working on patches but there were still license issues, so it wasn't really fixed, just the bug was marked as done.

I'm not convinced this bug is immediately resolvable, but I understand it now which is good. We should continue to hope that one day a free ASN database can be found.

comment:12 Changed 16 months ago by teor

Keywords: archived-closed-2018-07-04 added
Resolution: wontfix
Status: newclosed

Close all tickets in archived components

Note: See TracTickets for help on using tickets.