[Question] Legal matter regarding using that repo to generate and store currently active php versions

[yoanm]

TLDR;
From a legal perspective (repo license), can I clone this repository, use an existing function and store the result on one of my own repositories?

---

Hello,

I have an internal software checking if my projects are up to date with currently active PHP versions.
I found the active.php website page which provides exactly what I need.

It worked like a charm for a while, but since recently I can't fetch anymore that url as I'm blocked by a kind of DDOS prevention mechanism.
I fully understand the need for that kind of mechanism, but thing is, now my software is stuck and become quite useless
And I found nothing else to rely on at the moment.

As I understand the primary goal of https//php.net website is not really to provide that kind of feature, I had the following idea:

• Create a dedicated repo on my side and clone that one thanks to a github action
• Retrieve the same content as what active.php page provides currently (basically, simple php script including branches.inc to be able to access get_active_branches() function)
• Store the result inside my own repo

That way would avoid php.net to implement a real API (and all mechanism it would imply) while keeping anyone the ability to access that information.

However, I'm not 100% sure it's OK from a legal matter. I checked the repository license, but it's actually the license of the website itself, so it's confusing a bit.
Moreover, I do not really copy/modify/etc the content of the repo, I'm just using the existing content.

Do you have some advices ?

Thanks a lot.

Related issues:

• No specific license for that website? #489
• www.php.net blocks "fetch libfetch/2.0" user-agent #483
• https://bugs.php.net/bug.php?id=81056

[cmb69]

I don't see any legal issues with this. However, IANAL. Anyhow, I think you could also just include https://raw.githubusercontent.com/php/web-php/master/include/version.inc; $RELEASES has almost the same structure as the result of get_active_branches().

[yoanm]

Yup, I looked at that too, but as goal is basically to replace https://www.php.net/releases/active.php, it's easier/faster to use the same method as original code :)

[cmb69]

Ah, right! I wonder, though, whether you're blocked from https://www.php.net/releases/active.php deliberately, or what is going on there. Maybe @saschaschumann can clarify.

[yoanm]

I don't know exactly why indeed. It works from a browser without any issue, it works from terminal with curl, but it doesn't from the software.
At first, I thought it was due to VPN, but it's the same with and without.
Lonely difference is that software is using a NodeJs Axios lib. It doesn't work from the server where app is hosted, but it doesn't work either locally when executing the same code.
Example:

const Axios = require('axios');

const phpDotNet = Axios.create({
  baseURL: 'https://www.php.net/',
});

(async () => {
  await phpDotNet.get('/releases/active.php').then(res => console.log('OK', {res}))
  .catch(err => console.error('ARGH !', {err}));
})();

That code always throws an HTTP 503 error (service unavailable). When inspecting the response, there is the following html code :

Which actually makes sense, as it's a bot which executes the query, and in the resulting page, there is the following:

This page checks to see if it is really you sending the requests and not a bot.

[kelunik]

@yoanm Try using a custom user agent. @cmb69 Any reason we have bot checks enabled?

[cmb69]

@kelunik, I think that is a MyraCloud protection.

[yoanm]

@yoanm Try using a custom user agent.

Already tried, I used the exact same user-agent than the working request sent from my browser, but doesn't change anything

const Axios = require('axios');

const phpDotNet = Axios.create({
  baseURL: 'https://www.php.net/',
});

(async () => {
  await phpDotNet.get('/releases/active.php', { headers: { 'User-Agent': 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36' }  } ).then(res => console.log('OK', {res}))
  .catch(err => console.error('ARGH !', {err}));
})();

I double checked if header was correctly sent and it was, I also tried with user-agent instead of User-Agent (just to be sure 😅 ), tried with curl/7.64.1, still the same error

As said, I understand the need for that kind of protection, I'm just trying to find a quick alternative for my software (and I'm totally fine having to create a repo on my own for that).

[yoanm]

No additional advice, so I switched my POC from private to public: https://github.com/yoanm/php-versions

For anyone looking to retrieve current active PHP versions programmatically, you can fetch the actives.json file.

In case something pops up on legal matter, feel free to ping me here, re-open this issue, or create one on my repo, up to you.