8000 ffmpeg: drop libfdk-aac/nonfree (redistributable GPL build); edgedelta closed_source; cite terms by bryan-minimal · Pull Request #1110 · gominimal/pkgs · GitHub
[go: up one dir, main page]

Skip to content

ffmpeg: drop libfdk-aac/nonfree (redistributable GPL build); edgedelta closed_source; cite terms - #1110

Merged
bryan-minimal merged 2 commits into
mainfrom
redistributable-audit
Oct 28, 2026
Merged

bryan-minimal merged 2 commits into
mainfrom
redistributable-audit

Conversation

@bryan-minimal
@bryan-minimal bryan-minimal commented Oct 26, 2026 •
Copy link
Copy Markdown
Member

Follow-up to #656. This is a license audit of all 640 catalog packages for terms that forbid redistributing what we build or cache. The prod buildbot keeps redistributable = false packages out of the shared binary cache (build-servers#180).

Changes

package change evidence
ffmpeg Dropped --enable-libfdk-aac and --enable-nonfree, and the libfdk-aac runtime dep. license_spdx = "GPL-3.0-or-later". Still redistributable. Before: FFmpeg's configure (n9.0.2, ~l.4840) set license="nonfree and unredistributable" whenever nonfree was enabled, and libfdk_aac is on EXTERNAL_LIBRARY_NONFREE_LIST because the FDK AAC license is GPL-incompatible. Now: --enable-gpl --enable-version3 with nothing nonfree gives "GPL version 3 or later". AAC encoding uses the native aac encoder. build.sh now fails the build unless config.h's FFMPEG_LICENSE is exactly "GPL version 3 or later".
edgedelta closed_source = true (new) + citation Edge Delta ToS §2.3: a "non-exclusive, non-transferable, non-assignable license". The customer will not "distribute, sublicense, transfer, … make publicly available, publish". Object code only, and deriving source is prohibited (§2.3(e)).
android-sdk citation only Android SDK License Agreement §3.4: "you may not copy (except for backup purposes), modify, adapt, redistribute … the SDK or any part of the SDK".
claude-code citation only LICENSE.md: "© Anthropic PBC. All rights reserved. Use is subject to Anthropic's Commercial Terms of Service."

libfdk-aac stays as a standalone package; the FDK license allows source and binary redistribution. No catalog package depends on ffmpeg. mip dump --packages evaluates the whole catalog with this branch.

Checked and left alone

These are redistributable, with notes where it matters:

  • terraform: BUSL-1.1 grants redistribution; only production use is limited.
  • redis: AGPL-3.0 OR SSPL-1.0, both of which permit redistribution.
  • The catalog has no Elastic-licensed package.
  • chromium-bin, chromium-headless-shell-bin and chromedriver-bin are redistributable (BSD-3-Clause, no Widevine).
  • gcloud, jdk-* (Temurin), ghidra, and grafana (OSS build).
  • cf: npm declares MIT. closed_source = true is accurate, since there's no public source.
  • LicenseRef-BuDDy, LicenseRef-PMD, lsof, GD, NIST-PD and CC-PDDC are all permissive.
  • I compared the 404 GitHub-provenance packages against GitHub's detected license. That turned up no hidden proprietary repo.

Draft #510 (ampcode) already carries closed_source + redistributable = false. The ffmpeg artifacts built under the old nonfree configuration are still in the shared cache. A purge plan is being prepared separately; it isn't part of this PR.

🤖 Generated with Claude Code

Summary by CodeRabbit

  • Package Updates
    • FFmpeg now uses its native AAC encoder instead of libfdk-aac, and its build stops if the detected license does not match GPL version 3 or later.
    • FFmpeg’s license metadata now reflects GPL-3.0-or-later, with nonfree libraries excluded.
    • EdgeDelta is marked as closed-source; its redistribution setting is unchanged.
  • License Information
    • Added license notices for the Android SDK and Claude Code packages, including stated restrictions on redistribution.

…_source; cite terms

ffmpeg is configured --enable-gpl --enable-nonfree --enable-libfdk-aac,
which FFmpeg's own configure labels "nonfree and unredistributable".
edgedelta's agent is object-code-only under a non-transferable licence,
so it is closed_source too. Each non-redistributable package now cites
the clause that forbids redistribution.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@bryan-minimal
bryan-minimal requested a review from a team as a code owner October 26, 2026 21:09
@coderabbitai
coderabbitai Bot commented Oct 26, 2026 •
Copy link
Copy Markdown
Contributor

Review in Change Stack →

No actionable comments were generated in the recent review.

Recent review info
Run configuration
Commits

Reviewing files that changed from the base of the PR and between 44a31a3 and 9c3155c.

Files selected for processing: 5
  • packages/android-sdk/build.ncl
  • packages/claude-code/build.ncl
  • packages/edgedelta/build.ncl
  • packages/ffmpeg/build.ncl
  • packages/ffmpeg/build.sh

Included review availability: This review used your included allowance. 0 included reviews remain after this review. Your included PR review attempts over the past 7 days set your current allowance at 1 review per hour.

Walkthrough

The package license declarations were updated for Android SDK, Claude Code, EdgeDelta, and FFmpeg. FFmpeg’s build configuration no longer enables libfdk-aac or nonfree mode, and its script checks the configured license before building.

Changes: Package license classification

Layer / File(s) Summary
Package license declarations
packages/android-sdk/build.ncl, packages/claude-code/build.ncl, packages/edgedelta/build.ncl
Comments describing license restrictions were added for Android SDK and Claude Code. EdgeDelta was marked closed_source = true; its existing redistributable = false setting remains.

FFmpeg license and build configuration

Layer / File(s) Summary
FFmpeg configuration and license check
packages/ffmpeg/build.ncl, packages/ffmpeg/build.sh
The SPDX metadata changed to GPL-3.0-or-later. The libfdk-aac dependency and --enable-nonfree option were removed. The build script now checks that the configured license is exactly GPL version 3 or later before running make.

Priority: Normal

Estimated code review effort: 3 (Moderate) | ~20 minutes

Change: Bug fix

Sequence Diagram(s)

sequenceDiagram
  participant BuildScript as build.sh
  participant FFmpegConfigure as FFmpeg configure
  participant ConfigHeader as config.h
  participant Make
  BuildScript->>FFmpegConfigure: Configure without libfdk-aac or --enable-nonfree
  FFmpegConfigure->>ConfigHeader: Write configured license
  BuildScript->>ConfigHeader: Read and check license
  BuildScript->>Make: Run only if license is GPL version 3 or later
Loading

Possibly related PRs

  • gominimal/pkgs#656: Adds redistributable = false to Android SDK, Claude Code, and EdgeDelta, which are also classified in this pull request.

Suggested reviewers: mitodrummer, msample

Merge Risk: Minimal · up to 9c315

The licensing updates and FFmpeg build changes are consistent with the stated redistribution requirements and present no identified merge-blocking risk.

Pre-merge checks: Passed 5
Check name Status Explanation
Description Check Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check Passed The title clearly identifies the main changes: removing FFmpeg's nonfree libfdk-aac configuration, marking EdgeDelta as closed source, and citing license terms.
Docstring Coverage Passed No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1 files. (4 skipped: 4 …
Linked Issues check Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check Passed Check skipped because no linked issues were found for this pull request.
Full details: Docstring Coverage

Explanation

No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1 files. (4 skipped: 4 unsupported.)

Finishing Touches
📝 Generate docstrings
  • Commit to this branch
  • Create a new PR
🧪 Generate unit tests (beta)
  • Commit to this branch
  • Create a new PR
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Comment @coderabbitai help to get the list of available commands.

…GPL build

Replaces the redistributable=false marking from the first commit. Without
--enable-libfdk-aac/--enable-nonfree, FFmpeg's configure derives "GPL
version 3 or later" (gpl + version3) instead of "nonfree and
unredistributable". AAC encoding uses the native `aac` encoder. build.sh
now refuses to build unless config.h's FFMPEG_LICENSE says exactly that.
libfdk-aac stays as a standalone package (its own license allows
redistribution); nothing else depended on it through ffmpeg.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@bryan-minimal bryan-minimal changed the title attrs: ffmpeg redistributable=false (nonfree build); edgedelta closed_source; cite terms ffmpeg: drop libfdk-aac/nonfree (redistributable GPL build); edgedelta closed_source; cite terms Oct 26, 2026
@mitodrummer mitodrummer left a comment
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Checked FFmpeg n9.0.2 configure: libfdk_aac is on EXTERNAL_LIBRARY_NONFREE_LIST, and with --enable-gpl --enable-version3 and nothing nonfree, the license it writes to FFMPEG_LICENSE is "GPL version 3 or later". build.sh now fails the build on any other value. GPL-3.0-or-later is the right SPDX value, nothing in the catalog depends on ffmpeg, and the edgedelta closed_source flag and the license citations do not change behaviour.

@bryan-minimal
bryan-minimal added this pull request to the merge queue Oct 28, 2026
Merged via the queue into main with commit 50ca703 Oct 28, 2026
12 checks passed
@bryan-minimal
bryan-minimal deleted the redistributable-audit branch October 28, 2026 18:37
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants

0