Paperclip mimemagic dependency licensing implication

[sb8244]

Paperclip is deprecated, but there may still be users of the gem that haven't upgraded for whatever reason.

There was a mimemagic change (rails/rails#41750 mimemagicrb/mimemagic#97) that stems from incorrectly licensing mimemagic as MIT with a GPLv2 dependency. The old versions were yanked (new 0.3.6 added) and new versions are published as GPLv2. Codebases that pull in paperclip will possibly be taking the risk of GPLv2 code (IANAL) instead of MIT code.

I am not sure there's any alternative at the moment, but wanted to create this issue in case someone else runs into it.

Deprecation notice

Paperclip is currently undergoing deprecation in favor of ActiveStorage. Maintainers of this repository will no longer be tending to new issues. We're leaving the issues page open so Paperclip users can still see & search through old issues, and continue existing discussions if they wish.

[sd]

I have a Pull Request that removes the dependency on mimemagic.

#2677

In the meantime, you can test my branch by using this in your Gemfile:

gem 'paperclip', git: 'https://github.com/sd/paperclip', branch: 'remove-mimemagic'

And report back if it works for you.

[Supernats]

https://github.com/kreeti/kt-paperclip is the listed maintained fork. There have not been changes to this repository in over a year.

[wisetara]

@sd I hope you'll submit your PR to https://github.com/kreeti/kt-paperclip as @Supernats suggests. I'd rather switch to the "officially" maintained gem than point to your branch, which does not negate my appreciation for your efforts!

[sd]

kreeti#52

[wennerma]

I see there's a few PRs, is there an update on when these could be merged? Is a better route for some of us to fork this and make the change ourselves?

[ryantk]

Has anyone got feedback for @sd 's branch?
I see the build has failed on Travis but I don't know if this is normal for this project (one would hope not but who knows).
I would like to just use that branch and have done with it but just looking to see if anyone has had any glaring issues.

[GProst]

@ryantk FWIW, tested in our project, image creation/update/deletion - looks good
Ruby 2.5.7

[sd]

@ryantk we have deployed to prod without issues. We do have the file command available on the server. Otherwise Paperclip blocks all uploads due to "anti-spoofing" checks that cannot confirm the file contents.

[ryantk]

Thank you for your work @sd I have done a bit of work and determined I can safely upgrade to minimagic 0.3.7 in the very short term with a view to removing it when it is removed form paperclip.

[johnnyshields]

How about we do #2685 - Transfer gem ownership to Kreeti and apply their fixes from kt-paperclip instead?

[joshnabbott]

@sd I'm more than a year late, but thank you