.NET 8: Enable private NuGet dependencies for alternative licensing

[richlander]

The ImageSharp project is considering a new licensing scheme. The license language discusses a bunch about the nature of dependencies. It seems like private NuGet dependencies (for implementation-only dependencies (no API exposure) could be an important tool for enabling projects to establish alternate licensing approaches. At present, that's difficult.

It would be good to validate the assumption that private NuGet dependencies would help. It seems like they would.

After that, it would be good to consider this feature for .NET 8. It has other benefits as well. It is a subset of the functionality proposed in: dotnet/designs#242.

@clairernovotny @mhutch @JimBobSquarePants

[Sergio0694]

This looks very promising! I wonder if it's essentially the same as NuGet/Home#10375, or whether it at least overlaps with that? We've wanted something like this for years in the Windows Community Toolkit, and I could use this on my own as well 😄

[richlander]

Yes, same (or same enough). Let's leave them both open for a bit. We can close this one once the team goes through planning. Mine is pushing (quite obviously) on one specific scenario to help motivate the experience.

[KalleOlaviNiemitalo]

I wonder whether specifying the version of such a package by central package versioning would be considered a direct dependency for the purposes of the license.

[richlander]

I would say "no" or "it depends". Also, all my opinion:

• Fair use: changing the version of a private dependency via CPVM to bump to a secure version.
• Fair use: changing the version of multiple private dependencies via CPVM to ensure a common version.
• Not: changing the version of direct dependency and a private dependencies via CPVM to ensure a common version.

The last one is a red herring. The private dependency and CPVM are inconsequential.

You shouldn't adopt software that doesn't allow you to bump versions via CPVM. CPVM is a great security tool.

There's a separate question on how private dependencies should work with CPVM in the general case. That's a separate topic.

[JimBobSquarePants]

In my proposed license change I'm not treating a direct dependency as "You call this API", rather, "You explicitly installed the package or included the source" it so I'm not sure of the relevance here. However I see the relevance in more traditional direct vs transitive dependency definition.

[richlander]

I think we're talking about the same thing, @JimBobSquarePants.

Private NuGet dependencies are an answer to the problem you are mentioning. They make it so that you have to explicitly install the package to use it. If another package is using ImageSharp as an implementation-only dependency, the app user doesn't see it.

If you don't care about this topic, then that means the more popular ImageSharp gets, the less your test passes "you explicitly installed the package". For example, Json.NET is pretty much everywhere. You can install tons of other packages, and you can end up being able to call JSON.NET APIs w/o explicitly installing the package. Is that a fine outcome from your point of view?

[JimBobSquarePants]

Ah riiiight.... OK Yeah. Private NuGet dependencies solve the transitive bad actor problem really well!

Is that a fine outcome from your point of view?

Well.... fine is subjective. The way the proposed license works is that if the party that took the direct dependency qualifies for the Apache License then transitive consumption falls under that license. My Commercial License would grant similar freedoms so in real terms I wouldn't have means to stop consumption due to the non-virility of the Split License.

I'm stuck with the problem in that, because this is an established library with a massive OSS userbase with permissive licenses, I have to avoid license virility. I simply can't cut people off so I have to work with loopholes.

For others starting fresh this is an awesome tool to have.

[richlander]

It's possibly slightly better than that. Imagine there were n very popular packages on NuGet that used ImageSharp. You could talk to them and ask them to use this feature. Meaning, you can do some repair on past usage, too.

[zivkan]

What does "private dependency" actually mean? I've only skimmed over this issue, so I'm sorry if I missed it.

Does the existing NuGet feature PrivateAssets="compile" already meet the objective? https://github.com/dotnet/roslyn-sdk/blob/df51b014fcb8c9e667a0b09a000f2050615f7afb/src/Microsoft.CodeAnalysis.Testing/Microsoft.CodeAnalysis.Analyzer.Testing/Microsoft.CodeAnalysis.Analyzer.Testing.csproj?q=PrivateAssets%3D%22compile%22#L58-L65

[richlander]

Great question, but I believe that feature does something different. AFAIK, that's a consumption-based feature. It is declaring whether you want the NuGet asset copied to your bin folder or used for a more exclusive purpose. The private dependency suggestion discussed in this issue is a production-based feature. It specifies whether a given dependency should be publicly available within the NuGet graph.

Did I get that right @mhutch @clairernovotny?