Copyleft detected - list of deps & util to detect them

[JarbasAl]

All OVOS repos intend to be "universal donors", it should be possible to use every ovos repo without dragging a viral package

A new util i wrote revealed some problems with GPL dependencies that are incompatible

Additionally and just to be on safe side we also want to avoid LGPL due to reasons discussed elsewhere

viral packages in mycroft/ovos-core

'fann2': 'LGPL',
'chardet': 'LGPL',
'unidecode': 'GPL',
`python-vlc`: `LGPL`.
'pyxdg': 'GPL-2.0'

additional viral packages in ovos_workshop / OCP

'mutagen': 'GPL-2.0-or-later'

tagging @krisgesling because this is also a concern for mycroft

TODO list

• python-vlc is already optional
• fann2 is required for padatious, but padatious is already optional in ovos-core (not mycroft)
• bump requests to >= 2.26.0 in every package we own to remove chardet
  • progress tracked in bump requests to avoid GPL transient dependency #52
• replace pyxdg in every package we own, i suggest https://github.com/srstevenson/xdg
  • ovos-core Refactor/remove pyxdg #53
  • ovos_utils refactor/replace_pyxdg ovos-utils#21
  • ovos plugin manager Fix/remove pyxdg ovos-plugin-manager#30
  • ovos precise lite plugin Refactor/replace tflit/pyxdg ovos-ww-plugin-precise-lite#1
  • ovos precise plugin
  • ovos mimic plugin
  • ....
  • json_database comply with GPL license by not using it OpenJarbas/json_database#1
• default to youtube-dl instead of yt-dlp to remove mutagenfrom OCP dragged dependencies,
  • alternatively don't install youtube-dlor yt-dlp at all it is optional already. skills that need it should list it in requirements.txt and request it directly anyway
  • solved by OpenVoiceOS/ovos-ocp-audio-plugin@4162aae and OpenVoiceOS/OVOS-workshop@01d68c7
• unidecode comes from phoneme_guesser, it is unused but pinned in some plugins to workaround an old bug, should also be removed from phoneme_guesser directly

[JarbasAl]

added a github workflow to ensure this doesn't happen again, see https://github.com/NeonJarbas/ovos-core/actions/runs/1842592706 and #53

[NeonDaniel]

I don't think it's necessarily problematic to interface with GPL dependencies if we are not contributing to those packages. That said, it is nice to support permissively licensed projects and not support restrictively licensed ones

[JarbasAl]

still some packages to go, detected in #56

[JarbasAl]

all tests passing now 🎉

[ChanceNCounter]

@NeonDaniel the applicability of language that distinguishes linked works from derivative works is ambiguous all over the copyleft world, and the only way to be certain our interpreted code is nonderivative, short of becoming the test case, is to avoid copyleft (especially the LGPL)

Stallman tried twice to account for libraries, blew it twice for interpreters, and refuses to address the problem. When you ask the FSF to clarify the classpath or linking exceptions wrt Python, they helpfully clarify, "You must comply with the terms of the license."

It needs to be acknowledged that someone who would, with a grin, say, "It's not a virus, it's a spider plant," fully aware that the latter is a destructive, invasive species impossible to expunge from your land, is a hostile person.