1519804 - Additional license notices for libgcrypt etc. needed by Thunderbird

Status: RESOLVED FIXED

(Chat Core :: Security: OTR, enhancement)

Description

[Kai Engert (:KaiE:)]

This was originally mentioned in bug 1518091. Forked here as separate bug. This is relevant if we are indeed adding libcrypt.

libgcrypt includes some code with additional (compatible) licenses, which requires that permission notices are included. We'll have to check which of the following require additions to about:license:
https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgcrypt.git;a=blob;f=LICENSES;h=f6733a69246bb2d0236af42cff28c1a6fee43c36;hb=HEAD

Comment 1

[Kai Engert (:KaiE:)]

Thunderbird will import additional third party licenses into its source tree, which will require additional license notices in the binary, so they must be included in about:license.

Should these additions be made to the general set of licenses contained in toolkit? Or should they become private additions only for the mail applications, only (inside the comm repository).

If you "only add to Mail app's set of licenses", how should we do that technically? Will we need scripts, that use build time logic to combine the contents of toolkit/content/license.html with additional contents for comm applications?

Comment 2

[Kai Engert (:KaiE:)]

Attachment: 1519804-v1.patch

This patch requires the suggested enhancement from bug 1559900.

It adds the license notices from libgcrypt.

The other libraries, libgpg-error and libotr, don't seem to need additional notices, beyond what we already show.

Comment 3

[Kai Engert (:KaiE:)]

Attachment: 1519804-v2.patch

Adjusted for patch v2 from bug 1559900.

Comment 4

[Kai Engert (:KaiE:)]

There's a circular dependency between this bug and bug 1518164.

We cannot import the code until we have the license added.

However, before we can add the license, we need to know in which directory the code will be placed, because the license page mentions the filenames that the license is related to. And that's being discussed in bug 1518164.

Comment 5

[Kai Engert (:KaiE:)]

It has been clarified that we'll use directory name third_party (toplevel in comm-central). I'll attach an updated patch.

Comment 6

[Kai Engert (:KaiE:)]

Attachment: 1519804-v3.patch

Comment 7

[Kai Engert (:KaiE:)]

Once reviewed, this will require uplift to the comm-esr68 branch.

It depends on bug 1559900, we'll need to uplift that one to Thunderbird's v68 release branch of mozilla-esr68.

Comment 8

[Jorg K (CEST = GMT+2)]

Comment on attachment 9076771 [details] [diff] [review]
1519804-v3.patch

No NI needed here, the flag will do it (unlike bug 1559900).

Comment 9

[Magnus Melin [:mkmelin]]

Comment on attachment 9076771 [details] [diff] [review]
1519804-v3.patch

Review of attachment 9076771 [details] [diff] [review]:
-----------------------------------------------------------------

LGTM, r=mkmelin

Comment 10

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/comm-central/rev/082bd1210cb5
Add additional license notices for libgcrypt, etc. r=mkmelin

Comment 11

[Kai Engert (:KaiE:)]

Comment on attachment 9076771 [details] [diff] [review]
1519804-v3.patch

Bug 1559900 has been uplifted to mozilla-beta (tracked in bug 1566397).

We could uplift this one to comm-beta, too, for consistency.

Comment 12

[Jorg K (CEST = GMT+2)]

Comment on attachment 9076771 [details] [diff] [review]
1519804-v3.patch

Sure, this is for TB 69 beta.

Comment 13

[Jorg K (CEST = GMT+2)]

https://hg.mozilla.org/releases/comm-esr68/rev/00890b6960a8f30d85284545ef5a87457dfcb479

Comment 14

[Jorg K (CEST = GMT+2)]

TB 69 beta:
https://hg.mozilla.org/releases/comm-beta/rev/15201c339dd09db23839d47533448f53c0d29f97