TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

Maintainer of Rust crate 'dirs-sys' intentionally poisons dependents with MPL

3 点作者 rustman123超过 1 年前

2 条评论

rustman123超过 1 年前
They intentionally added a copyleft-licensed library (options-ext) written by himself to poison the supply chain via `dirs-sys`. (Commit: <a href="https:&#x2F;&#x2F;github.com&#x2F;dirs-dev&#x2F;dirs-sys-rs&#x2F;commit&#x2F;e169da7af901eb621e5d244efe960f4da8ed150d#r109131407">https:&#x2F;&#x2F;github.com&#x2F;dirs-dev&#x2F;dirs-sys-rs&#x2F;commit&#x2F;e169da7af901e...</a>)<p>The dependency adds nothing of value and can trivially be removed. (<a href="https:&#x2F;&#x2F;github.com&#x2F;dirs-dev&#x2F;dirs-sys-rs&#x2F;pull&#x2F;22&#x2F;files">https:&#x2F;&#x2F;github.com&#x2F;dirs-dev&#x2F;dirs-sys-rs&#x2F;pull&#x2F;22&#x2F;files</a>)<p>When asked about it, they claim to prefer MPL and that the current license was an accident they &#x27;may or may not correct&#x27;.<p>Popular dependents include - cross (<a href="https:&#x2F;&#x2F;crates.io&#x2F;crates&#x2F;cross" rel="nofollow">https:&#x2F;&#x2F;crates.io&#x2F;crates&#x2F;cross</a>) - terminfo (<a href="https:&#x2F;&#x2F;crates.io&#x2F;crates&#x2F;terminfo" rel="nofollow">https:&#x2F;&#x2F;crates.io&#x2F;crates&#x2F;terminfo</a>)
cpburns2009超过 1 年前
MPL 2.0 is not a &quot;viral&quot; license like the GPL. It is cross compatible with both Apache 2.0 and MIT. The knee jerk reaction to drop dirs-sys-rs over a non-existent licensing issue makes no sense.