Winforms repo bringing in a non-open source license

[mthalman]

The inclusion of the winforms repo into the VMR has caused the use of a non-open source license to be included as well. This prevents distro maintainers from being able to use the VMR as a whole.

The license is from Code Project which is not considered to be free and open source due to the restrictions it places on use.

This license is referenced here: https://github.com/dotnet/winforms/blob/main/src/System.Windows.Forms/tests/IntegrationTests/DesignSurface/LICENSE.txt

[MichaelSimons]

cc @ViktorHofer, @mmitche

[mmitche]

Also part of dotnet/source-build#3738

This is in included in that t-shirt size costing.

[mthalman]

This offending DesignSurface test was cloaked from the VMR as part of dotnet/installer#18280. The license issue will need to be resolved before this test can be included again.

[mmitche]

Based on conversations, it's likely that cloaking will continue to be a thing for UB.

[ellahathaway]

@mthalman - Can you describe the course of action to be taken here? It sounds like this issue was originally resolved with dotnet/installer#18280? Going forward, I see it that these files will continue to be cloaked; we state that we do not allow non-OSS licenses in the VMR (dotnet/arcade#14547), which includes these files. In my opinion, we should continue to cloak these files, and it will be up to the winforms team to resolve any resulting issues.

cc @MichaelSimons

[sharwell]

What is VMR? I'm curious why Winforms tests are being included downstream. It seems like the producer/consumer setup would involve Winforms having its own tests in the producer pipeline, and then downstream consumers would obtain the Winforms artifacts not including the Winforms tests. Elimination of the test code as a downstream artifact would also eliminate the portion of this repository to which the incompatible license applies.

[mthalman]

What is VMR? I'm curious why Winforms tests are being included downstream. It seems like the producer/consumer setup would involve Winforms having its own tests in the producer pipeline, and then downstream consumers would obtain the Winforms artifacts not including the Winforms tests. Elimination of the test code as a downstream artifact would also eliminate the portion of this repository to which the incompatible license applies.

https://github.com/dotnet/dotnet is the VMR. This is part of the unified build work where all official builds of .NET will happen from that repo. While tests for individual repos aren't currently being run there, the goal is for them to be available there to run.

[sharwell]

@mthalman Thank you. I think the definition will need some clarification specifically related to integration testing. While many integration tests will meet the license requirements of the production code, teams will need the ability to write integration tests where one or more components of the integration do not meet those requirements. Regardless of the manner in which the Winforms tests currently hitting this limitation are resolved, they could be useful for documenting the process to follow if future teams encounter this.

[mmitche]

We can't have non-OSS licensed code or binaries in the VMR and there are no plans to allow this. Doing so drastically complicates the infrastructure required to support both Microsoft's and Linux distro partner builds (which cannot have non OSS code or binaries). This means that tests existing in the individual repos that don't meet those license requirements must be excluded when syncing code into the VMR. Any test that does meet the requirements (overwhelming majority) can sync across. IMO in general we shouldn't be sprinkling code into our repos that doesn't match the license of the parent repo, test or not.

@mthalman Is there further action here or should this be closed?

[mthalman]

Yeah, this can be closed. This issue is mitigated by cloaking the files so that they aren't included in the VMR.

[ellahathaway]

Reopening this issue because I discovered that the cloaks occurred in the VMR for preview1, but the offending files were never cloaked from other preview branches, and they still exist in main.