ImageSharp v4 now requires a license for every contributor

[Piedone]

ImageSharp enforces a license now

ImageSharp v4.0.0 is out. The breaking changes are minimal for us, and it appears to be working fine too, see my PR. However, with this version ImageSharp libraries enforce a license check, see the Six Labors blog. This requires a license file to be present, see details here. I applied for one for OC, but that was actually a misunderstanding on my part, see Problems below.

The license itself didn't change, and as before, OC, as an open-source project, can keep on using them, and the license doesn't affect transitive dependents, i.e. users of OC.

Problems

I see multiple issues here:

1. There's no single license for Orchard Core, but there needs to be one license for CI builds, and individual ones for everyone who wants to build OC from source, see the docs (and this thread for a confirmation). This breaks the F5 experience, and thus raises the barrier for contribution.
2. It seems that these licenses are only valid for a year, and when they expire, the build will fail. This requires periodic license updates for the CI builds and for every contributor.
3. People who build OC from source will now become the subject of the license, and thus required to apply for or buy a license too. It will come as a surprise to people working with OC from the full source in their own solutions (what they shouldn't really do, but I'm aware of this happening), or who publish OC to an internal NuGet feed, that they now have to pay.
4. I'd presume that when you use OC packages in your project, i.e. depend on ImageSharp only transitively, then there won't be a license check and thus no expiry and a yearly enforced update. But I have an open question about this, see here. This is not an issue.

Decisions

We need to decide whether to bite the bullet and update IS despite the inconveniences, or figure out alternatives. We can of course stay on the old version for now, but eventually, something needs to be done. We could even fork v3.x. It might also be possible to figure out a (technical) solution for this with the IS team. E.g., if we could add a license file to the repo that would cover everyone would solve the issue, see my comment.

What do you think?

[hishamco]

I noticed that several days ago while I updating avatar module in OCC, seems we need to request a license but not commit it in the source. Finally I ended up with using SkiaSharp

We might need to check the impact

[Piedone]

Moving to a different library is indeed an alternative too. However, probably too big of an impact unless it compares favorably with IS feature-wise.

[BenedekFarkas]

Saying this without researching much about it, but it also depends on whether they're planning to support v3.x on the long term - I'd imagine not. Otherwise (based on the maintainer's comment) committing the license file to the repo is a no-go, but IMO keeping the "F5 experience" as-is is pretty fundamental. Currently it looks like to me that we need to look for a migration path.

[Piedone]

Given how there were patches for 2.x even long after v3 was released (see) there's a chance that at least bug fixes will come to 3.x too.

[BenedekFarkas]

If that's (will be) the case, then we should stay on 3.x.