rmrfrs appears to be plagiarized from kondo

[cstyles]

Output of brew config

N/A

Output of brew doctor

N/A

Description of issue

A formula for a package called rmrfrs was added a few days ago: Homebrew/homebrew-core#257591

I was intrigued by the name so I looked at the repo and noticed that parts of the README are reminiscent of that of kondo, a very similar project. Looking at the very first commit of the repo (trinhminhtriet/rmrfrs@d782064), the project begins at version 0.8.0 with a fully functional tool, CI, and a multi-crate architecture. That seemed suspicious so I checked out version 0.8.0¹ of kondo and compared the two. Lo and behold, the code is exactly the same, save for what appears to be a run of s/kondo/rmrfrs across the repo:

diff -r kondo/kondo rmrfs/rmrfrs

diff --color -r kondo/kondo/Cargo.toml rmrfrs/rmrfrs/Cargo.toml
2c2
< name = "kondo"
---
> name = "rmrfrs"
4c4
< authors = ["Trent Billington <trent.h.billington@gmail.com>"]
---
> authors = ["Triet Trinh <contact@trinhminhtriet.com>"]
6,8c6,7
< kondo is a filesystem cleaning tool that recursively searches directories
< for known project structures and determines how much space you could save by
< deleting the unnecessary files.
---
> rmrfrs is a filesystem cleaning tool that scans directories for known project structures, 
> identifying unnecessary files to show potential space savings.
10,12c9,11
< documentation = "https://github.com/tbillington/kondo"
< homepage = "https://github.com/tbillington/kondo"
< repository = "https://github.com/tbillington/kondo"
---
> documentation = "https://github.com/trinhminhtriet/rmrfrs"
> homepage = "https://github.com/trinhminhtriet/rmrfrs"
> repository = "https://github.com/trinhminhtriet/rmrfrs"
17c16
< exclude = ["test_dir"]
---
> exclude = ["tests"]
20d18
< 
25,26c23,24
< [dependencies.kondo-lib]
< path = "../kondo-lib"
---
> [dependencies.rmrfrs-lib]
> path = "../rmrfrs-lib"
diff --color -r kondo/kondo/src/main.rs rmrfrs/rmrfrs/src/main.rs
14c14
< use kondo_lib::{
---
> use rmrfrs_lib::{
20,21c20,21
< #[command(name = "kondo")]
< /// Kondo recursively cleans project directories.
---
> #[command(name = "rmrfrs")]
> /// rmrfrs recursively cleans project directories.

diff -r kondo/kondo-lib rmrfrs/rmrfrs-lib

diff --color -r kondo/kondo-lib/Cargo.toml rmrfrs/rmrfrs-lib/Cargo.toml
2c2
< name = "kondo-lib"
---
> name = "rmrfrs-lib"
4c4
< authors = ["Trent Billington <trent.h.billington@gmail.com>"]
---
> authors = ["Triet Trinh <contact@trinhminhtriet.com>"]
6c6
< description = "Shared code lib for kondo and kondo-ui."
---
> description = "Shared code lib for rmrfrs and rmrfrs-ui."

diff -r kondo/kondo-ui rmrfrs/rmrfrs-ui

diff --color -r kondo/kondo-ui/Cargo.lock rmrfrs/rmrfrs-ui/Cargo.lock
814c814
< name = "kondo-lib"
---
> name = "rmrfrs-lib"
822c822
< name = "kondo-ui"
---
> name = "rmrfrs-ui"
826c826
<  "kondo-lib",
---
>  "rmrfrs-lib",
diff --color -r kondo/kondo-ui/Cargo.toml rmrfrs/rmrfrs-ui/Cargo.toml
2c2
< name = "kondo-ui"
---
> name = "rmrfrs-ui"
4c4
< authors = ["Trent Billington <trent.h.billington@gmail.com>"]
---
> authors = ["Triet Trinh <contact@trinhminhtriet.com>"]
6c6
< kondo-ui is a filesystem cleaning tool that recursively searches directories
---
> rmrfrs-ui is a filesystem cleaning tool that recursively searches directories
10,12c10,12
< documentation = "https://github.com/tbillington/kondo"
< homepage = "https://github.com/tbillington/kondo"
< repository = "https://github.com/tbillington/kondo"
---
> documentation = "https://github.com/trinhminhtriet/rmrfrs"
> homepage = "https://github.com/trinhminhtriet/rmrfrs"
> repository = "https://github.com/trinhminhtriet/rmrfrs"
22,23c22,23
< [dependencies.kondo-lib]
< path = "../kondo-lib"
---
> [dependencies.rmrfrs-lib]
> path = "../rmrfrs-lib"
diff --color -r kondo/kondo-ui/src/main.rs rmrfrs/rmrfrs-ui/src/main.rs
21c21
< use kondo_lib::{clean, pretty_size, scan, ScanOptions};
---
> use rmrfrs_lib::{clean, pretty_size, scan, ScanOptions};
220c220
<         .title(LocalizedString::new("kondo-main-window-title").with_placeholder("Kondo 🧹"))
---
>         .title(LocalizedString::new("rmrfrs-main-window-title").with_placeholder("rmrfrs 🧹"))
258c258
<         Label::new("Kondo 🧹")
---
>         Label::new("rmrfrs 🧹")
414c414
<             Label::new("See the source, report a bug, or contribute at https://github.com/tbillington/kondo 🎉")
---
>             Label::new("See the source, report a bug, or contribute at https://github.com/trinhminhtriet/rmrfrs 🎉")

Perhaps "plagiarized" is too harsh of a word but A) usually forks are upfront about their lineage and rmrfrs is not (the README was even updated to remove the "Similar Projects" section); and B) the "fork" is functionally identical, save for a few bumped dependencies over the past year. Is this sort of duplicate project allowed per Homebrew's acceptable formula rules?

Footnotes

1. Technically I checked out d100ffb which isn't the exact commit tagged v0.8 but was the most recent commit as of August 5th, 2024 (the date of the first commit in rmrfs). It includes some unreleased changes (e.g., Pixi support) that are also present in rmrfrs, suggesting that the initial commit of rmrfrs was copied from the master branch of kondo in early August. ↩

[SMillerDev]

Homebrew doesn't have a policy about this, this seems mostly something for kondo to take action on.
That being said, I would be sympathetic to a PR deprecating the copy if it doesn't have any active development. In that case users would be better off with kondo.

[cstyles]

I'm not sure what the kondo maintainer(s) can realistically do. The existence of rmrfrs on GitHub isn't really a problem IMO. It's its inclusion in Homebrew that feels weird. I'll go ahead and open a PR to remove it.

[p-linnane]

The last release of kondo was in December of 2023. The author of rmrfrs is following the MIT license that kondo is released under, so there's no real problem here. Value judgements are not part of our inclusion requirements for Homebrew. The rmrfrs project meets our inclusion criteria. It won't be removed.

[cstyles]

Gotcha, thanks for the response! I guess that's just an unfortunate consequence of permissive licensing, though it doesn't feel great that someone can republish another person's work without attribution.

This might be a moot point since you said you're not in the business of value judgments but I looked up a couple other repos by the same GitHub user and each one is a clone of an existing project:

• blast is a clone of rakyll/hey
• sizr is a clone of nachoparker/dutree
• dwipe is a clone of ikebastuz/wiper
• spiko is a clone of hatoo/oha
• curli is a clone of rs/curlie

Some of the sources are older, others are still seeing active development. As far as I can tell this user just clones popular tools, removes attribution, sets up GitHub CI, and then "maintains" them by rubber-stamping dependabot PRs.

It's possible (likely, even) that this is simply a scheme to farm GitHub stars and pad the author's résumé. But given the recent npm hacks and that XZ Utils exploit from last year, you'll forgive me for being a little paranoid about supply chain security and the potential to rake in users with cloned tools and then ship malware later down the line.

Ultimately, y'all are the maintainers so I'll defer to you but I felt like I should at least flag this as a concern. I am curious though: are there (or should there be) any rules or guidelines about accepting packages from users who mainly repackage existing software?

[p-linnane]

You can try reporting them to GitHub, though I’m not sure this violates their TOS. It definitely isn’t ideal behavior, but it falls into the “allowed but unpleasant” category.

Homebrew’s role is to take software under an OSI-approved license, build it, and provide the resulting binaries. Users are responsible for understanding what they install. Just as we don’t have the capacity to audit every upstream code change, we also don’t have the capacity to vet every repository author or decide which projects should be distributed beyond our standard notability requirements.