MIME-Version: 1.0
References: <DB4PR10MB6285C2EFA0AB9030B31514ABBFAB9@DB4PR10MB6285.EURPRD10.PROD.OUTLOOK.COM>
In-Reply-To: <DB4PR10MB6285C2EFA0AB9030B31514ABBFAB9@DB4PR10MB6285.EURPRD10.PROD.OUTLOOK.COM>
From: Konstantin Kulikov <k.kulikov2@gmail.com>
Date: Thu, 23 Feb 2023 13:03:52 +0300
Message-ID: <CAD+eXGQqfQOOcfGVCFWQQCcYg4un+WTRbFVX0_eUQi98FTuzaA@mail.gmail.com>
Subject: Re: Alpine Linux and package versioning: can the license change in a
 release patch ?
To: "Bleher, Eric" <eric.bleher.ext@siemens.com>
Cc: "~alpine/users@lists.alpinelinux.org" <~alpine/users@lists.alpinelinux.org>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

revbumps can alter package build options. New options can pull new
dependencies. New deps can bring new licenses.

As for fetching sources - if you find working with APKBUILDS too hard,
pkgs.a.o has links to build logs for every package, maybe parsing such
logs will be easier?

On Thu, Feb 23, 2023 at 9:26 AM Bleher, Eric
<eric.bleher.ext@siemens.com> wrote:
>
> Hello here,
>
>
>
> First, thank you all for your work on the Alpine Linux!
>
>
>
> My question is related to the versioning of the packages. Looking at http=
s://pkgs.alpinelinux.org/packages, almost every single package is versioned=
 as a.b.c-rd  where a b c d are numbers, d is the =E2=80=98patch release=E2=
=80=99 of the version a.b.c.
>
>
>
> As the name implies, I suppose the patch release is a bug or security fix=
.
>
>
>
> What about the licensing of the package?
>
> It is possible that the license of a package is changing within a patch r=
elease, or can we ensure that the license is always the same within for a f=
ixed a.b.c version, whatever the r number is ?
>
>
> Background is legal compliance: when we deliver a software based on Alpin=
e Linux (delivered as Docker container), we need to ensure that the license=
 of every single component is properly defined and delivered with our softw=
are.
>
> But "clearing" a component requires getting the source code, and is alway=
s time consuming. I see [here](https://unix.stackexchange.com/questions/496=
755/how-to-get-the-source-code-used-to-build-the-packages-of-the-base-alpin=
e-linux-d/) how to get the exact source code of a package, but this is much=
 more complex that getting just the tag of the related GitHub repository.
>
>
>
> So for compliance purposes, if the license remains the same, I would like=
 to take any package of version a.b.c and ignore the release patch. What do=
 you think?
>
>
> NB: I am posting the question on Stack Exchange too, in the opensource ch=
annel: it might be interesting to others not on that mailing list.
>
> https://opensource.stackexchange.com/questions/13745/alpine-linux-and-pac=
kage-versioning-can-the-license-change-in-a-release-patch
>
>
>
> Thanks,
>
> Eric
>
>
>
>