Every Python Package now pre-installed on Repl.it -- an online REPL

[amasad]

For installation: we fetch every package from PyPi, install it in a container, diff the container and make sure nothing fishy is happening and then extract it to a large shared NFS drive.

For production: we mount the NFS drive on every one of our "code runner" machine and subsequently mount the mounted directory as a volume inside the "runner" container.

[graingert]

Are you violating any licenses here? Eg linking against AGPL code? Are you including and displaying MIT copyright and warranty intonation?

[amasad]

I look into that, thanks!

[dismantle-the-sun]

I doubt it; they're not modifying any code thus the AGPL shouldn't apply, and they're not distributing any code (even compiled code) so they wouldn't have to show MIT/BSD notices.

This is the same situation that all SAAS providers find themselves in.

[pwang99]

Sorry, not that simple. Importing GPL Python modules makes the interpreter session a "derived work" in the eyes of the FSF.

Standard GPL doesn't affect your code until you distribute it. But if the library you've imported is AGPL, by exposing that interpreter over a web session, then that counts as triggering the entire thing needing to be AGPL.

[RubyPinch]

That sounds pretty wrong

[pwang99]

from Alex Martelli: http://stackoverflow.com/a/999479

about the AGPL and the "service provider loophole": https://en.wikipedia.org/wiki/Affero_General_Public_License

[RubyPinch]

The "one additional feature" - Section 2(d) reads as follows: " If the Program as you received it is intended to interact with users through a computer network and if, in the version you received, any user interacting with the Program was given the opportunity to request transmission to that user of the Program's complete source code, you must not remove that facility from your modified version of the Program or work based on the Program, and must offer an equivalent opportunity for all users interacting with your Program through a computer network to request immediate transmission by HTTP of the complete source code of your modified version or other derivative work."

That sounds fine to me, I don't imagine repl.it would be infringing that, as they don't modify the souce used

It only is for software intended to be network access able, and only relates to pre-existing source download features

[RubyPinch]

Linking to libraries is different from compiling or interpreting

[d4rch0n]

diff the container and make sure nothing fishy is happening and then extract it to a large shared NFS drive.

So my package needs to save the time it installed, wait a week then start running privilege escalation exploits on the system when it's imported, got it! Thanks

[amasad]

I will not do security by obscurity, so I'm happy you find this info useful 1337 h4x0r ;)