General question about how rancher desktop manage license and requirement for dependency packages

[KevinLiAWS]

I see Rancher Desktop distribute the executables for lima, qemu and other dependency packages. I heard some license of these pacakges also require distribution of the source code of these pacakges required by the license. I would like to learn about how Rancher Desktop deal with the license and dependency source code distribution. Thanks

[jandubois]

I think QEMU (and possible dependencies) are the only packages that require source distribution. So far Rancher Desktop just bundles the homebrew binaries, whose source code is available through the corresponding formula.

This is not really good enough though, and there is a further issue that needs to be addressed as well: we currently don't control which version of the dependencies are bundled, beyond "the latest versions at the time the Github action is running".

I think the following procedure would be a good way to both control the various versions (for repeatable builds) as well as capturing the sources:

• Add homebrew as another git submodule to lima-and-qemu

• Add another step between building all submoduled dependencies (lima, vde_vmnet, socket_vmnet):

• Uninstall all packages from homebrew

• Reset homebrew to the version in the submodule

• (if that isn't possible, uninstall homebrew and reinstall from the submodule)

• delete everything in ~/Library/Caches/Homebrew/

• build (and install) qemu from source (using homebrew formula)

• this assumes it will build all prerequisites from source as well

• otherwise we have to build prerequisites individually from source, in reverse topological order

• create a tarball of both the cache directory (which now has all the sources) and the src/ directory

• make sure any license files are installed into /usr/local or /opt/homebrew as well

• update lima-and-qemu.pl to copy the license files into the tarball too

This is just a quick braindump; I may be forgetting something right now.

I assume you are working on finch. Are you able to help implementing these changes?

[KevinLiAWS]

Hi @jandubois, currently Finch has some temp solution to collect dependency source code and we rely on dependency source code itself to distribute license since it is complex that each depdency can have different location or multiple files for its license. We haven't started to migrate to a better approach yet and still evaluate it. After we finish it, we can help add that flow into Rancher in the lima&qemu repo. Thanks

[jandubois]

Thanks for your reply @KevinLiAWS!

Let me know when you have a plan for a better solution, so maybe we can discuss it here before you start implementing it, to make sure it works both for finch and for Rancher Desktop?

[KevinLiAWS]

Sure, I will keep you updated once we have the plan