As discussed in this bug report,[1] pip allows the user to search and install
software from pypi.org, some of which is proprietary. It looks like pip is
going to be removed entirely[2] to address this freedom issue. However, since
most software in the PyPI repository is free, I think it would be preferable
to modify pip so that it refuses to recommend or install any non-free
software in the PyPI repo.
For each PyPI package there is a json file at https://pypi.org/pypi/[package
name]/json containing metadata including licensing information and a list of
dependencies. I've written some code that uses this information to check the
license of a package and packages in its dependency tree to determine whether
it is or requires non-free software. I've modified pip's code so that 'pip
search' only lists packages that pass the license check and 'pip install
[package]' will refuse to install a package that is non-free or has non-free
dependencies.
Before I put more time into this, I'd like some feedback on several points.
(1) Is this approach potentially sufficient to satisfy the FSDG? If not, the
rest of these questions are irrelevant.
(2) With what I have now, attempting to install proprietary software returns
[package] has non-free or unclear license.
Not installing [package]
and attempting to install free software with proprietary dependencies returns
one or more dependencies of [package] has non-free or unclear license.
Not installing [package]
Is this appropriate, or should pip act as if the software does not exist at
all?
(3) The biggest challenge has been that the license data is inconsistent and
often unclear. Many packages do state the license using a consistent format,
such as
License :: OSI Approved :: GNU General Public License v3 (GPLv3)
but others use a variety of formats such as "GPLv3", "GNU GPL", or "GNU
General Public License", "gpl", or even the entire text of the GPL. Some
packages have multiple license statements or no license statements.
This makes it a real pain to compile a whitelist of acceptable license
statements, and it seems inevitable that some free packages are going to be
inaccurately excluded. While we should avoid excluding free software as much
as possible, the most important thing is that no proprietary software slips
through. I would appreciate input on the standard of clarity that should be
required in order to whitelist a license statement. If you think you can
provide guidance, please see here[3] for the whitelist as it currently stands
and a description of my approach so far.
(4) Is anyone aware of situations other than from 'pip search [query]' and
'pip install [non-free package]' in which pip's behavior needs to be modified
in order to satisfy the FSDG?
Thanks for any guidance or assistance anyone can provide.
[1] https://trisquel.info/en/issues/3741
[2] https://devel.trisquel.info/trisquel/ubuntu-purge/merge_requests/33
[3] https://notabug.org/chaosmonk/pip/src/fsdg/src/pip/whitelist.py
