526505 - Include licensing text files when distributing dictionaries

Status: RESOLVED WONTFIX

(Firefox Build System :: General, defect)

Description

[Gervase Markham [:gerv]]

Currently, we ship dictionaries in various ways - as part of distributions of Firefox, or in language packs (at least for SeaMonkey). The licensing of those dictionaries varies, but some of them require you to distribute a copy of the license along with the code. Even those under the tri-license require this, because .dic files, at least, can't have the licensing information at the top of the file because, AFAICS, they don't support comments.

Rather than special-case the build process, we should change it so that it picks up and bundles any text files in the dictionary's directory in Hg into the language pack. Then, if we realise a dictionary has a particular requirement for particular text, we can just check in a text file with that text in it. And if additional licensing information is included which doesn't have to be, no big deal. It's only 2Kbytes max (less, compressed).

Gerv

Comment 1

[Axel Hecht [:Pike]]

I don't agree with this.

hg can contain symlinks, AFAIK, and I don't know what the dictionary code reads into memory how, so putting "everything" in sounds like a bad idea, and just unnecessary attack surface.

For our Firefox distributions, we're not shipping dictionaries outside the Firefox binaries, and those have the licenses handled, AFAICT. For Thunderbird, they're probably going to just stop to include the dictionaries into the langpacks, too.

Comment 2

[Gervase Markham [:gerv]]

Axel: if bad people can check stuff into the repo, then there are easier ways to exploit things than using the build process's ability to ship any file in a particular directory. I just can't see a credible attack scenario that this change enables. And having it ship all text files just means we don't have to go around renaming lots of them, and makes it easier to import new releases from upstream by just dropping the files in.

Gerv

Comment 3

[Axel Hecht [:Pike]]

Well, I'm not going to add them without a code-review on the dictionary side. Code which is largely un-owned these days.

I don't see any "core build" issue, fwiw. The core build doesn't ship dictionaries outside of Firefox and Thunderbird, and those should have their licensing covered.

Comment 4

[Gervase Markham [:gerv]]

Axel: what do you mean by "a code review on the dictionary side"? Are you afraid that the dictionary code is going to load these text files, thinking they are dictionaries? I'm pretty sure that won't be a problem:
http://mxr.mozilla.org/mozilla-central/source/extensions/spellcheck/hunspell/src/mozHunspell.cpp#148
http://mxr.mozilla.org/mozilla-central/source/extensions/spellcheck/hunspell/src/mozHunspell.cpp#388

So Thunderbird has stopped shipping dictionaries in langpacks, leaving only SeaMonkey. If this is the wrong component for SeaMonkey build issues, feel free to move this bug.

Gerv

Comment 5

[Robert Kaiser]

It might be best to just stop shipping dictionaries in SeaMonkey langpacks as well if everybody else does it that way.

Comment 6

[Gervase Markham [:gerv]]

KaiRo: if stopping shipping dictionaries is your resolution plan, can you close this bug and open up a new one to implement it?

Thanks,

Gerv

Comment 7

[Robert Kaiser]

I filed bug 537481 on removing dictionaries from langpacks in SeaMonkey.

I think we still should care that we actually ship a license file in langpacks though to make clear all included L10n files are MPL/tri-license, as some might come without a header - which by convention implicitly means they are tri-licensed but in shipped packages we should make it clear. Should we file another bug for that?

Comment 8

[Gervase Markham [:gerv]]

No, there's no need to do that. Implicit, plus about:licence, is fine :-)

Gerv