Legalesse (was: [RFC] PECL binary creation and distribution)

A concern which recently came up for me with regards to precompiled binaries was the issue of the licensing of bundled libraries. At the time Edin setup a .dsp for my oggvorbis extension, he took the shortcut of compiling libogg and libvorbis in staticly which also has the added benefit of saving trouble for the user later on. Unfortunately this creates two issues: (1) Size. php_oggvorbis.dll is larger than all the other PECL binaries by half an order of magnitude. (because of the staticly linked libraries) (2) License. While libogg and libvorbis are covered under a fairly loose BSD style license which does permit bundling in binary packages. Their license DOES say that certain disclaimers and copyright notices must accompany the binary or be placed in the documentation. That issue is covered for the time being by a page I rushed together which is linked from the package homepage http://pear.php.net/oggvorbis . Linking to an external site for something this important is sloppy though, I'm considering placing it on its peardoc manual page despite the fact that it is only necessary for Win32 users. In the case of this package (and most others which link externally) we can certainly limit potential problems by sticking to dynamic linking thereby putting the onus for licensing on the end user. However, I would not be surprised to find libraries out there which require static linking to function properly while containing a license which limits and/or controls distribution in binary form. By using dynamic linking (and thereby requiring the end user to find and install libraries themselves), however, we short change the ease of use which is one of the prime selling points of PECL. To the point of including LICENSE and/or README files, an .rpm/.msi packaging system is a simple and elegant solution which will satisfy most (if not all?) of the above needs. We even have the option of including whole library packages as needed. However, I am inclined to urge extreme caution when it comes to allowing developers to build packages which include libraries (staticly or dynamicly) in their distributions. From a purely practical standpoint, it encourages the potential for duplicate installation of libraries, and from a legal standpoint it opens PHP to an unknown risk. -Sara ...And I won't even get into the issue of PECL extensions linking against GPL libraries...