julia/deps/build.jl automatically downloads non-ASF binary build

[leezu]

https://github.com/apache/incubator-mxnet/blob/2be8b956bbe653ce8c1261eccc626a7190506923/julia/deps/build.jl#L113-L130

This may be in violation of ASF policy.

[iblislin]

well, IIRC that code exists in the era of early stage of MXNet.jl.

I think there are two ways to provide a binary release and replace the current code

1. Just download stuff from PyPI, unpack and get the libmxnet.so, maybe some hacks are needed for Julia.
2. Introduce BinaryBuild.jl to build and release binary. Here is a Julia blog post about the binary package system: https://julialang.org/blog/2019/11/artifacts/. But I never tried this approach before, there are some details needed to be figured out.

[leezu]

Thanks @iblis17 for clarifying. Note that Option 1

Just download stuff from PyPI, unpack and get the libmxnet.so, maybe some hacks are needed for Julia.

won't work as of now, as the PyPI builds are not official ASF builds either. However, nothing of the MXNet code automatically downloads the unofficial PyPI builds. We may add an official PyPI apache-mxnet build in the future but that will only cover CPU builds due to issues with CUDA EULA. If and once that's done, downloading this build is an option.

For Option 2: The same route as with PyPI can be taken: Have an official apache-mxnet CPU build and potentially CUDA builds provided by third-parties. Would you like to look into having either of them? Note that the third-party builds can't be hosted as part of https://github.com/apache/incubator-mxnet and need to be properly labeled as per Apache Software Foundation Trademark policy.

[ciyongch]

Hi @leezu, may I know if this is an actual concern for the 1.7.0 release? Thanks!

[iblislin]

Hi @leezu,

Would you like to look into having either of them?

Sure. I'm going to survey the new artifact system in Julia 1.3+.

About the CUDA build in Python, could you show more details about the releasing process done by third-party?
And I'm not sure what is this about:
" ... need to be properly labeled as per Apache Software Foundation Trademark policy"

[leezu]

@ciyongch it may be prudent to remove it for the 1.7 release.

@iblis17 we're currently clarifying the exact requirements with the Apache Software Foundation Trademark team. It'd probably boil down to building the binary from the official MXNet release tarball and clarifying in the description that it ships optional features that are https://www.apache.org/legal/resolved.html#category-x

I'll let you know once there is a clear process.

[ciyongch]

Thanks @leezu, I'm not sure the replacement for removing it, may I know your suggestion to handle this issue for the 1.7 release? Thanks!

[leezu]

There'd be no replacement to automatically download non-ASF binaries from our source code due to ASF policy. We can simply remove the code in question and only keep the "If not found, try to build automatically using BinDeps". Would you create a PR for the 1.7, 1.x and master branch?

Later, @iblis17 may provide binaries that our website may link with a disclaimer in the Julia install docs.

[ciyongch]

Sure, no problem :)
I will submit a hot-fix to address this license issue: remove this piece of code and replace with a warning for windows platform.

[szha]

This issue has been resolved as the logic for downloading third-party release has been removed. If windows support is desired, members who work on Julia can propose the solution and we can make sure of the ASF-compliant approach in the new proposal then.