Opened 8 weeks ago

Closed 8 weeks ago

#33771 closed defect (fixed)

Missing LibEvent License

Reported by: sysrqb Owned by: tbb-team
Priority: Medium Milestone:
Component: Applications/Tor Browser Version:
Severity: Normal Keywords: TorBrowserTeam202004R, tbb-9.5a10, tbb-9.0.8
Cc: boklm, gk Actual Points:
Parent ID: Points:
Reviewer: boklm Sponsor:

Description

Unless I missed the license somewhere, we are not distributing libevent (in binary form) along with its license. We should correct this.

Child Tickets

Change History (7)

comment:1 Changed 8 weeks ago by sysrqb

Cc: gk added
Keywords: TorBrowserTeam202004R added
Status: newneeds_review

comment:2 Changed 8 weeks ago by sysrqb

Also, we have OpenSSL's license under PluggableTransports and that is a little weird, but as far as I know that should not be a problem.

The licenses included in the commits in the previous comment were copied from the currently used git tags for the respective projects.

Maybe we should add into our release process confirming that we are bundling the correct license whenever we include a new version of a project.

comment:3 Changed 8 weeks ago by sysrqb

gk pointed me at about:licenses where Firefox already includes a license for libevent. However, the included is quite old (earlier than 2009). The in-tree license (under ipc/chromium/src/third_party/libevent/ is correct, but that's not the one shipped with Firefox). It seems like copied the corresponding licenses in https://bugzilla.mozilla.org/show_bug.cgi?id=531821 and never updated them after that. Firefox bumped its vendored libevent in 2017.

In any case, I'll open an upstream bug for updating the libevent license in Firefox. We should include updated licenses for Tor Browser-specific components/libraries. gk mentioned we could add all of our unique licenses into about:license, as well, instead of bundling them in different text files in tor-browser-build. I'll open another ticket for that.

In the meantime, I'd still like review for the above patches. Shipping a license for libevent that is 11 years old is not appropriate.

comment:4 in reply to:  3 Changed 8 weeks ago by sysrqb

Replying to sysrqb:

In any case, I'll open an upstream bug for updating the libevent license in Firefox.

https://bugzilla.mozilla.org/show_bug.cgi?id=1626380

We should include updated licenses for Tor Browser-specific components/libraries. gk mentioned we could add all of our unique licenses into about:license, as well, instead of bundling them in different text files in tor-browser-build. I'll open another ticket for that.

#33773

comment:5 in reply to:  1 ; Changed 8 weeks ago by boklm

Status: needs_reviewneeds_revision

Replying to sysrqb:

Master: https://gitweb.torproject.org/user/sysrqb/tor-browser-build.git/commit/?h=bug_33771&id=e9bfa29052a68ab85d8666a34c5bf8a0f8b82594

The patch looks good to me. Just a minor thing: the commit message should include this bug number.

comment:6 in reply to:  5 ; Changed 8 weeks ago by sysrqb

Keywords: tbb-9.5a10 added
Status: needs_revisionneeds_review

Replying to boklm:

Replying to sysrqb:

Master: https://gitweb.torproject.org/user/sysrqb/tor-browser-build.git/commit/?h=bug_33771&id=e9bfa29052a68ab85d8666a34c5bf8a0f8b82594

The patch looks good to me. Just a minor thing: the commit message should include this bug number.

Thanks for reviewing this. I pushed bug_33771-01. I'll merge it into 9.5a10.

https://gitweb.torproject.org/user/sysrqb/tor-browser-build.git/commit/?h=bug_33771-01&id=c382d84e5ebc4d367c8d7410d99ecca82184ab46

comment:7 in reply to:  6 Changed 8 weeks ago by boklm

Keywords: tbb-9.0.8 added
Resolution: fixed
Status: needs_reviewclosed

Replying to sysrqb:

Thanks for reviewing this. I pushed bug_33771-01. I'll merge it into 9.5a10.

https://gitweb.torproject.org/user/sysrqb/tor-browser-build.git/commit/?h=bug_33771-01&id=c382d84e5ebc4d367c8d7410d99ecca82184ab46

Thanks. I merged the patch to master with commit 4613dcbd5e923a1c20f498d76b2f0bd76b35b951 and cherry-picked it to maint-9.0 as commit f2a8e0c8bc11981505c3c7dc5b3476c070277eae.

Note: See TracTickets for help on using tickets.