taskSavannah Administration - Tasks: task #16461, Submission of sinaps is not a...

 
 

task #16461: Submission of sinaps is not a password safe

Submitter:  xwst
Submitted:  Fri 10 Nov 2023 09:14:06 PM UTC
   
 
Should Start On:  Thu 09 Nov 2023 11:00:00 PM UTC Should be Finished on:  Sun 19 Nov 2023 11:00:00 PM UTC
Category:  Project Approval Priority:  * 5 - Normal
Status:  Cancelled Privacy:  Public
Assigned to:  ineiev Open/Closed:  Closed
* Mandatory Fields

Add a New Comment Rich Markup
   

Jump to the original submission

Sat 13 Jan 2024 07:44:17 AM UTC, comment #10: 

It looks like the used tools make it unreasonably hard do comply with Savannah hosting requirements.

Cancelling since no response followed.

Ineiev <ineiev>
Site Administrator
Tue 21 Nov 2023 09:32:00 AM UTC, comment #9: 


> Ok, so the documentation part is much tougher than I expected. Thank you for all the input and guidance. Let me try to organize it a bit, please comment on my thoughts.
>
> 1. I currently use doxygen to generate "HTML output". This is the term that is used by doxygen itself, but it includes HTML, css, javascript, png and .md5 and .map files.


What category includes the *.svg files?

>   a) The latter two are intermediate files and not part of the documentation so I do not see the necessity to put in notices.


Since they are not part of the documentation, don't you see the necessity to exclude them from the tarball?

>   b) The css and javascript files are boilerplate so I don't think I can or should put a copyright in there. I am not sure about a license notice though.


The point you have here is, there are files in the wild you can't add legal notices to---for example, proprietary files.  However, that doesn't override the Savannah requirement for all copyrightable files included to have valid copyright and license notices.

Also, looking at files like doc/doxygen-header.html, it may seem that you don't fully realize what you said here.

> If you think I should include one, I can do it.


We can't continually monitor all the packages we host on Savannah, to say nothing of fixing the new issues they may have.  You must be able and willing to think yourself.

>   c) The HTML files already contain copyright and license notices.


Have you verified that, e.g. using a command like the following?


find doc/html/ -type f -name \*.html -exec less -N {} \;


Many files in doc/html/search/ have no notices.

>   d) The png files are also generated from the source code so I put a note in the README to declare their license.


Do you mean, from the source code of your package?  Can you explain how a file like folderopen.png was generated from it?

> 2. Just to clairfy: I think all the files mentioned above make up one particular type of a "produced document" to which the GPLv2 of doxygen does not apply.


Let us discuss the points that led you to such conclusion (once more omitting the question about the version of the GPL).

> 3. I see that lynx does not render the menus; I added a direct link so the license will be accessible.


Nice; perhaps it would be consistent to add a link to it not only to the "main page" (by the way, index.html seems to include the license notice, but its footer still surprisingly refers to "main page").

Now on the license notice itself in doc/html/index.html#autotoc_md6.  It says that the copies of code in the documentation are not covered by the FDL, but by GPLv3.  This is confusing in at least two ways:

  1. The users may think that they have a GPLv3-only package.
  2. The non-FDL'ed parts that are not clearly and explicitly separated from the FDL'ed parts.


But the main problem is, such combination makes your documentation proprietary because it mixes works under incompatible licenses, the FDL and the GPL.

> 4. Regarding doxygen.conf: Now that I have dropped all boilerplate, there is no copied expression in there because all of the remaining settings were handwritten after reading the documentation.


Dropping the boilerplate implies that it was there at some point, which in turn suggests that the result was derived from the original file.

Ineiev <ineiev>
Site Administrator
Mon 20 Nov 2023 08:43:35 PM UTC, comment #8: 

Ok, so the documentation part is much tougher than I expected. Thank you for all the input and guidance. Let me try to organize it a bit, please comment on my thoughts.

1. I currently use doxygen to generate "HTML output". This is the term that is used by doxygen itself, but it includes HTML, css, javascript, png and .md5 and .map files.

  a) The latter two are intermediate files and not part of the documentation so I do not see the necessity to put in notices.
  b) The css and javascript files are boilerplate so I don't think I can or should put a copyright in there. I am not sure about a license notice though. If you think I should include one, I can do it.
  c) The HTML files already contain copyright and license notices.
  d) The png files are also generated from the source code so I put a note in the README to declare their license.

2. Just to clairfy: I think all the files mentioned above make up one particular type of a "produced document" to which the GPLv2 of doxygen does not apply.

3. I see that lynx does not render the menus; I added a direct link so the license will be accessible.

4. Regarding doxygen.conf: Now that I have dropped all boilerplate, there is no copied expression in there because all of the remaining settings were handwritten after reading the documentation.

(file #55343)

xwst
Sun 19 Nov 2023 11:57:43 AM UTC, comment #7: 

comment #6:

>
> > > Yes, I forgot to also license the generated html files. I just added the notices.
> >
> > Did I say, "HTML"?  Do you mean HTML?  And a question with an asterisk: are all added notices valid?
> The HTML documentation is the only one that I generated, so I assumed that's what you were talking about.


So no, we don't refer to the same thing when we speak of "HTML."  By HTML, I mean text files of the specific format standardized by the W3C.  Again, I didn't say, "HTML files." I said, "all copyrightable files."

> The doxygen webpage states the following: "Documents produced by doxygen are derivative works derived from the input used in their production; they are not affected by this license."
> My understanding is that I can choose any license for the produced documents. If that was not the case, using doxygen would force me to also use GPL...


And what are the "produced documents"?  If we assume that it must be something that isn't derived from Doxygen, then I can only suggest that it may be a snapshot of a page as rendered in a browser---which is definitely not what the tarball is to contain.

> ...v2.


The license versions of Doxygen and other dependencies will be the next issue to resolve.

> > I see neither the tree view nor the top menu with my browser.
>
> Hmm... just to be on the same page: Are we talking about the generated HTML-documentation? Out of curiosity and to trouble shoot: Which browser do you use?


Just to be on the same page:


tar xzf sinaps_2.tgz && lynx file://`pwd`/sinaps/doc/html/index.html


> > > I dropped all default lines and kept only the ones I changed; then, it shouldn't be an issue.
> >
> > Why not?  The file is still derived, isn't it?
>
> Well, ... technically it is.


Why just technically?

> But taking pieces from the doxygen manual to construct a doxygen.conf is also derived, isn't it?


It depends on the nature of the "taking pieces": when one takes expressions, it makes a derivative; when one takes ideas, it doesn't.

For the record, the GNU Project releases examples in manuals under an additional license.

> I suppose the easy way out is to strip off the doxygen.conf and generated documentation and leave it to interested people to run doxygen themselves.


It doesn't matter who runs the compiler.  The package should take care to make the result GFDL-compatible.

Ineiev <ineiev>
Site Administrator
Fri 17 Nov 2023 08:57:36 PM UTC, comment #6: 


comment #5:

> comment #4:
> > Yes, I forgot to also license the generated html files. I just added the notices.
>
> Did I say, "HTML"?  Do you mean HTML?  And a question with an asterisk: are all added notices valid?

The HTML documentation is the only one that I generated, so I assumed that's what you were talking about.
The doxygen webpage states the following: "Documents produced by doxygen are derivative works derived from the input used in their production; they are not affected by this license."
My understanding is that I can choose any license for the produced documents. If that was not the case, using doxygen would force me to also use GPLv2.

>
> > The section containing the GNU Free Documentation License can be found in the tree view on the left-hand side or from "Related Pages" in the top menu.
>
> I see neither the tree view nor the top menu with my browser.


Hmm... just to be on the same page: Are we talking about the generated HTML-documentation? Out of curiosity and to trouble shoot: Which browser do you use?

>
> > Regarding doxygen.conf: Are you concerned that the file should inherit the license of doxygen because of all the boilerplate code?
>
> You are right.
>
> > I dropped all default lines and kept only the ones I changed; then, it shouldn't be an issue.
>
> Why not?  The file is still derived, isn't it?


Well, ... technically it is. But taking pieces from the doxygen manual to construct a doxygen.conf is also derived, isn't it? So am I forced into GPLv2 when using doxygen? I assumed the license requirements are less prohibitive. Thoughts?

I suppose the easy way out is to strip off the doxygen.conf and generated documentation and leave it to interested people to run doxygen themselves.

xwst
Fri 17 Nov 2023 08:22:26 AM UTC, comment #5: 

comment #4:

> Yes, I forgot to also license the generated html files. I just added the notices.


Did I say, "HTML"?  Do you mean HTML?  And a question with an asterisk: are all added notices valid?

> The section containing the GNU Free Documentation License can be found in the tree view on the left-hand side or from "Related Pages" in the top menu.


I see neither the tree view nor the top menu with my browser.

> Regarding doxygen.conf: Are you concerned that the file should inherit the license of doxygen because of all the boilerplate code?


You are right.

> I dropped all default lines and kept only the ones I changed; then, it shouldn't be an issue.


Why not?  The file is still derived, isn't it?

Ineiev <ineiev>
Site Administrator
Thu 16 Nov 2023 09:53:30 PM UTC, comment #4: 

Yes, I forgot to also license the generated html files. I just added the notices.

The section containing the GNU Free Documentation License can be found in the tree view on the left-hand side or from "Related Pages" in the top menu.

Regarding doxygen.conf: Are you concerned that the file should inherit the license of doxygen because of all the boilerplate code? I dropped all default lines and kept only the ones I changed; then, it shouldn't be an issue. Or did you refer to something else?

I uploaded a new version with said changes so you can check.



(file #55334)

xwst
Thu 16 Nov 2023 11:49:24 AM UTC, comment #3: 

Thank you!

When adding the generated documentation, didn't you forget that all copyrightable files should have valid copyright and license notices?  While at it: the license notice mentions a certain section, but I failed to find it.

Also, are you sure the copyright notice in doxygen.conf is valid?

Ineiev <ineiev>
Site Administrator
Tue 14 Nov 2023 09:28:57 PM UTC, comment #2: 

Thank you for your feedback. I added the missing license versions and copyright and license notices in doxygen.conf.
I attached a new version including the generated documentation.

Please let me know if anything else is missing.

(file #55330)

xwst
Mon 13 Nov 2023 08:36:53 AM UTC, comment #1: 

Please identify licenses of your dependencies, including the versions of the licenses.

Then, doxygen.conf is copyrightable, but has no copyright and license notices.

At last, README.md mentions further documentation, but the tarball misses it.  Being GFDL-compatible is a requirement for the documentation, so probably it will need more work.

Ineiev <ineiev>
Site Administrator
Fri 10 Nov 2023 09:14:06 PM UTC, original submission:  

A new group has been registered at Savannah.
This group will remain inactive until a site admin approves
or discards the registration.


Registration Administration


Approving or discarding the registration must be done using the specific
Group administration page, accessible only to site
administrators logged in as superusers.

Registration Details


  • Name: sinaps is not a password safe
  • System Name:  sinaps
  • Type: non-GNU software and documentation
  • License: GNU General Public License v3 or later





Description:

sinaps is a stateless password manager that derives passwords using a single
master pin and different contexts (site names, user names, ...).
In that sense, it is very much like lesspass (https://www.lesspass.com/) but it
also supports configuration files with tab completion, a history and will
support encrypted secrets, as well as special commands to set default values.

sinaps aims to bridge the gap between classical and stateless password managers.
On the one hand, passwords should be deterministically generated on the fly to
avoid copying/syncing password databases all the time; on the other hand, it
should still be possible to also store small secrets that can not be chosen at
will (e.g. credit card numbers).


Other Software Required:

libsodium
gtkmm
libsigc++
GNU readline library
CxxTest

Tools: CMake and doxygen

The dependencies are also mentioned in the README including the corresponding licenses and links to the webpages.

There are two additional dependencies on python packages for a short script that serves as a reference implementation (argon2-cffi: MIT, PyCryptodome: public domain & BSD 2-Clause). These dependencies are not mentioned in the README.


Tarball URL:

https://savannah.nongnu.org/submissions_uploads/sinaps.tgz


xwst

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

Attached Files
file #55343:  sinaps_3.tgz added by xwst (527KiB - application/x-compressed-tar)
file #55334:  sinaps_2.tgz added by xwst (527KiB - application/x-compressed-tar - New version including licensing of doxygen output)
file #55330:  sinaps.tgz added by xwst (2MiB - application/x-compressed-tar - Updated tarball including doxygen output)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by ineiev (Posted a comment)
  • -email is unavailable- added by xwst (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 7 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2024-01-13 ineiev StatusIn Progress Cancelled
        Open/ClosedOpen Closed
    2023-11-20 xwst Attached File- Added sinaps_3.tgz, #55343
    2023-11-16 xwst Attached File- Added sinaps_2.tgz, #55334
    2023-11-14 xwst Attached File- Added sinaps.tgz, #55330
    2023-11-13 ineiev StatusNone In Progress
        Assigned toNone ineiev

    Back to the top

    Powered by Savane 3.13-8ccc.
    Corresponding source code