[gentoo-dev] GPL and Source code providing

[gentoo-dev] GPL and Source code providing

[Mivz]

Hello,

I have just read the following story, which scared me a bit:

http://software.newsforge.com/article.pl?sid=06/06/23/1728205&tid=150

Does this obligation, to provide your own source, also count for a none
Gentoo developer making a overlay tree for one of his projects which is
licensed under de GPL-2? Because that is a derived distro form Gentoo
right?
Would that mean that, if u write software using the portage system, that
every package that is used by one of your own should be available from a
server of your own?
If, the developer should also provide it's own file server with all
those packages, this would cause that every developer that wanted to
make a overlay should be a Gentoo file mirror?

Do my senses run wilde? Your just my imagination?
Do I understand this right?

Mivz

-- 
gentoo-dev@gentoo.org mailing list

Re: [gentoo-dev] GPL and Source code providing

[Diego 'Flameeyes' Pettenò]

[-- Attachment #1: Type: text/plain, Size: 646 bytes --]

On Wednesday 28 June 2006 11:21, Mivz wrote:
> Does this obligation, to provide your own source, also count for a none
> Gentoo developer making a overlay tree for one of his projects which is
> licensed under de GPL-2? Because that is a derived distro form Gentoo
> right?
The problem there is with binary packages. The problem does come down to, 
then, just GRP and other release methods, like solar's tinderbox and my 
Gentoo/Alt stages. For the rest, Gentoo uses sources, not binary packages.

-- 
Diego "Flameeyes" Pettenò - http://farragut.flameeyes.is-a-geek.org/
Gentoo/Alt lead, Gentoo/FreeBSD, Video, AMD64, Sound, PAM, KDE

[-- Attachment #2: Type: application/pgp-signature, Size: 189 bytes --]

Re: [gentoo-dev] GPL and Source code providing

[Mivz]

Diego 'Flameeyes' Pettenò wrote:
> On Wednesday 28 June 2006 11:21, Mivz wrote:
>> Does this obligation, to provide your own source, also count for a none
>> Gentoo developer making a overlay tree for one of his projects which is
>> licensed under de GPL-2? Because that is a derived distro form Gentoo
>> right?
> The problem there is with binary packages. The problem does come down to, 
> then, just GRP and other release methods, like solar's tinderbox and my 
> Gentoo/Alt stages. For the rest, Gentoo uses sources, not binary packages.
> 

So that would not be when a stage 3 install cd for the Overlay tree is
published? Because that cd contains binary precomplied packages.


-- 
gentoo-dev@gentoo.org mailing list

Re: [gentoo-dev] GPL and Source code providing

[Diego 'Flameeyes' Pettenò]

[-- Attachment #1: Type: text/plain, Size: 1324 bytes --]

On Wednesday 28 June 2006 12:47, Mivz wrote:
> So that would not be when a stage 3 install cd for the Overlay tree is
> published? Because that cd contains binary precomplied packages.
Well, IANAL and as Stuart said the last word is up to trustees, but from my 
understanding, as long as the overlay contains only ebuilds, it has to be 
treated as a source-only repository.

In the moment you release a stage or a CD out of that overlay, you have to 
comply to GPL for the ebuilds, which means that the overlay has to be 
available, and for the GPL software released in the stage/CD.

The main difference that I can see from Debian (and based distributions) is 
that their packages are built out of the original sources (that might and 
might not be GPL) and their debian/ directory (that is GPL).

As I said, IANAL and I'm speaking only for myself not for anyone else. I only 
try to apply some logic to the text of GNU's GPL... although seems like logic 
is overestimated with some people as we now see, unfortunately.

If we have to resort to lawyers just to get a distro going, I think there's 
something entirely wrong with what the free software is today.

-- 
Diego "Flameeyes" Pettenò - http://farragut.flameeyes.is-a-geek.org/
Gentoo/Alt lead, Gentoo/FreeBSD, Video, AMD64, Sound, PAM, KDE

[-- Attachment #2: Type: application/pgp-signature, Size: 189 bytes --]

Re: [gentoo-dev] GPL and Source code providing

[Stuart Herbert]

Hi,

On 6/28/06, Mivz <mivz@alpha.spugium.net> wrote:
> Hello,
>
> I have just read the following story, which scared me a bit:
>
> http://software.newsforge.com/article.pl?sid=06/06/23/1728205&tid=150
>
> Does this obligation, to provide your own source, also count for a none
> Gentoo developer making a overlay tree for one of his projects which is
> licensed under de GPL-2? Because that is a derived distro form Gentoo
> right?
> Would that mean that, if u write software using the portage system, that
> every package that is used by one of your own should be available from a
> server of your own?
> If, the developer should also provide it's own file server with all
> those packages, this would cause that every developer that wanted to
> make a overlay should be a Gentoo file mirror?
>
> Do my senses run wilde? Your just my imagination?
> Do I understand this right?
>
> Mivz

Questions on how the law affects Gentoo are best put to the Gentoo
Trustees, who have access to our lawyers.  They're the only people who
should be commenting on legal stuff like this.

Best regards,
Stu
-- 
gentoo-dev@gentoo.org mailing list

Re: [gentoo-dev] GPL and Source code providing

[Kevin F. Quinn]

[-- Attachment #1: Type: text/plain, Size: 1526 bytes --]

On Wed, 28 Jun 2006 11:21:45 +0200
Mivz <mivz@alpha.spugium.net> wrote:

> Does this obligation, to provide your own source, also count for a
> none Gentoo developer making a overlay tree for one of his projects
> which is licensed under de GPL-2?

If your project is licensed under the GPL-2, you have to honour the
provisions of that license.  You can't license something under the GPL
and not provide the source.

If you're distributing binary packages, you need to distribute also the
source code that went to make up those binary packages (i.e. your
changes/additions and also both upstream sources).

If you're only distributing source code (e.g. ebuild scripts, patch
files) then there's nothing further you need to do.

> Would that mean that, if u write software using the portage system,
> that every package that is used by one of your own should be
> available from a server of your own?

You need to provide the source for all binaries you distribute.

> If, the developer should also provide it's own file server with all
> those packages, this would cause that every developer that wanted to
> make a overlay should be a Gentoo file mirror?

Only if they distribute binaries, in which case source should be
provided sufficient to build those binaries.

> Do my senses run wilde? Your just my imagination?
> Do I understand this right?

If you're not sure whether something you do is compliant with the
relevant licenses, talk to an appropriate lawyer.

-- 
Kevin F. Quinn

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 191 bytes --]

Re: [gentoo-dev] GPL and Source code providing

[Mivz]

Kevin F. Quinn wrote:
> On Wed, 28 Jun 2006 11:21:45 +0200
> Mivz <mivz@alpha.spugium.net> wrote:
> 
>> Does this obligation, to provide your own source, also count for a
>> none Gentoo developer making a overlay tree for one of his projects
>> which is licensed under de GPL-2?
> 
> If your project is licensed under the GPL-2, you have to honour the
> provisions of that license.  You can't license something under the GPL
> and not provide the source.
> 
> If you're distributing binary packages, you need to distribute also the
> source code that went to make up those binary packages (i.e. your
> changes/additions and also both upstream sources).
> 
> If you're only distributing source code (e.g. ebuild scripts, patch
> files) then there's nothing further you need to do.
> 
>> Would that mean that, if u write software using the portage system,
>> that every package that is used by one of your own should be
>> available from a server of your own?
> 
> You need to provide the source for all binaries you distribute.
> 
>> If, the developer should also provide it's own file server with all
>> those packages, this would cause that every developer that wanted to
>> make a overlay should be a Gentoo file mirror?
> 
> Only if they distribute binaries, in which case source should be
> provided sufficient to build those binaries.
> 
>> Do my senses run wilde? Your just my imagination?
>> Do I understand this right?
> 
> If you're not sure whether something you do is compliant with the
> relevant licenses, talk to an appropriate lawyer.
> 

Tanks for the clear explanation. I get the point, I have to distribute
only my own sources for the overlay. But when I build a custom Live cd
or Stage 3 installation, I have to provide those packages from source
also or provide a Gentoo mirror. (which contains those)
And I have to look for a lawyer to be sure I do everything right.

Then I have got this one question, I don't need a answer too.

How free is free software if you need a lawyer and a expensive server
just to be able to publish your addition under your own name?

-- 
gentoo-dev@gentoo.org mailing list

Re: [gentoo-dev] GPL and Source code providing

[Mike Doty]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Mivz wrote:
> Then I have got this one question, I don't need a answer too.
> 
> How free is free software if you need a lawyer and a expensive server
> just to be able to publish your addition under your own name?
> 
Very free.  There are many project sites that will host your content if
you have it under a GPL or similar license.  Similarly, as long as you
provide the source, you satisfy the main point of GPL.  Thousands of
projects do exactly this without any input from a lawyer.

- --
=======================================================
Mike Doty                      kingtaco -at- gentoo.org
Gentoo/AMD64 Strategic Lead
Gentoo Developer Relations
Gentoo Recruitment Lead
Gentoo Infrastructure
GPG: 0094 7F06 913E 78D6 F1BB  06BA D0AD D125 A797 C7A7
=======================================================
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (GNU/Linux)

iQCVAwUBRKKWEIBrouQZ9K4FAQJD9gP+LyFCH+xz1ohPfazJ+rz/yy2iI4BgUDbQ
K9rjXGZyPz74619shqRASWYe6q97EyUSwmZqlOeQdZv9mp+WQFSPlWEO3CaPbnW+
fQg4lVV3Lrjo5jST9zVpjXCtS4ZMlEQG4LSGeN3wBSrDF2wLUcMA7IWDtkBHBk7V
SJ+ly8TamhQ=
=nRRK
-----END PGP SIGNATURE-----
-- 
gentoo-dev@gentoo.org mailing list

Re: [gentoo-dev] GPL and Source code providing

[Mivz]

Mike Doty wrote:
> Mivz wrote:
>>> Then I have got this one question, I don't need a answer too.
>>>
>>> How free is free software if you need a lawyer and a expensive server
>>> just to be able to publish your addition under your own name?
>>>
> Very free.  There are many project sites that will host your content if
> you have it under a GPL or similar license.  Similarly, as long as you
> provide the source, you satisfy the main point of GPL.  Thousands of
> projects do exactly this without any input from a lawyer.
> 

But then it's still 'free beer', and not 'freedom'. I still can not
write a patch and make a cd with the patch applied to give to my mum and
my friends, without the risk of my intelligence being stolen and abused.
Or I have to go through the hassle of finding a provider, which of
course needs attention too.


-- 
gentoo-dev@gentoo.org mailing list

Re: [gentoo-dev] GPL and Source code providing

[Mike Doty]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Mivz wrote:
> Mike Doty wrote:
>> Mivz wrote:
>>>> Then I have got this one question, I don't need a answer too.
>>>>
>>>> How free is free software if you need a lawyer and a expensive server
>>>> just to be able to publish your addition under your own name?
>>>>
>> Very free.  There are many project sites that will host your content if
>> you have it under a GPL or similar license.  Similarly, as long as you
>> provide the source, you satisfy the main point of GPL.  Thousands of
>> projects do exactly this without any input from a lawyer.
>>
> 
> But then it's still 'free beer', and not 'freedom'. I still can not
> write a patch and make a cd with the patch applied to give to my mum and
> my friends, without the risk of my intelligence being stolen and abused.
> Or I have to go through the hassle of finding a provider, which of
> course needs attention too.
> 
> 
Then you miss the entire point of GPL.  You "own" your code, but if you
derive it from something that is GPL, then you must comply with the GPL.
 The GPL exists to protect the author from what you're trying to do.
Your statement also goes against the whole concept of free software.
you've learned and benefited from all of our work, yet you don't want to
contribute?  It's very selfish and childish.

If you truly feel that way, I'd recommend using something propriatory
like microsoft, where you can license it any way you want.

- --
=======================================================
Mike Doty                      kingtaco -at- gentoo.org
Gentoo/AMD64 Strategic Lead
Gentoo Developer Relations
Gentoo Recruitment Lead
Gentoo Infrastructure
GPG: 0094 7F06 913E 78D6 F1BB  06BA D0AD D125 A797 C7A7
=======================================================
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (GNU/Linux)

iQCVAwUBRKKhcIBrouQZ9K4FAQKcggP/aR8HNcIjBZ33rWX5x9X+AFUJ9md1x1VI
Z8XPhloE1DOwC+OGfod0BbyJMepjtUXGISILseRpgVl63VNyT1Hznlk90Am+YFxR
ooGiZzsJI1ghZLWy8gBHEC0O6iCA72TnstVx8YceUiK58iOkBwwd9MayGGftMblc
52Sdikeg5NE=
=Qq6b
-----END PGP SIGNATURE-----
-- 
gentoo-dev@gentoo.org mailing list

Re: [gentoo-dev] GPL and Source code providing

[Mivz]

Mike Doty wrote:
> Mivz wrote:
>>> Mike Doty wrote:
>>>> Mivz wrote:
>>>>>> Then I have got this one question, I don't need a answer too.
>>>>>>
>>>>>> How free is free software if you need a lawyer and a expensive server
>>>>>> just to be able to publish your addition under your own name?
>>>>>>
>>>> Very free.  There are many project sites that will host your content if
>>>> you have it under a GPL or similar license.  Similarly, as long as you
>>>> provide the source, you satisfy the main point of GPL.  Thousands of
>>>> projects do exactly this without any input from a lawyer.
>>>>
>>> But then it's still 'free beer', and not 'freedom'. I still can not
>>> write a patch and make a cd with the patch applied to give to my mum and
>>> my friends, without the risk of my intelligence being stolen and abused.
>>> Or I have to go through the hassle of finding a provider, which of
>>> course needs attention too.
>>>
>>>
> Then you miss the entire point of GPL.  You "own" your code, but if you
> derive it from something that is GPL, then you must comply with the GPL.
>  The GPL exists to protect the author from what you're trying to do.
> Your statement also goes against the whole concept of free software.
> you've learned and benefited from all of our work, yet you don't want to
> contribute?  It's very selfish and childish.

With stolen or abuse I do not mean just used. I mean stolen and abused
as you would consider GPL licensed software stolen or abused.
-- 
gentoo-dev@gentoo.org mailing list

Re: [gentoo-dev] GPL and Source code providing

[Mivz]

Mike Doty wrote:
> Then you miss the entire point of GPL.  You "own" your code, but if you
> derive it from something that is GPL, then you must comply with the GPL.
>  The GPL exists to protect the author from what you're trying to do.
> Your statement also goes against the whole concept of free software.
> you've learned and benefited from all of our work, yet you don't want to
> contribute?  It's very selfish and childish.
> 
> If you truly feel that way, I'd recommend using something propriatory
> like microsoft, where you can license it any way you want.
> 
> --
> =======================================================
> Mike Doty                      kingtaco -at- gentoo.org
> Gentoo/AMD64 Strategic Lead
> Gentoo Developer Relations
> Gentoo Recruitment Lead
> Gentoo Infrastructure
> GPG: 0094 7F06 913E 78D6 F1BB  06BA D0AD D125 A797 C7A7
> =======================================================

That other people don't have a 9 line counting footer and are not
official Gentoo developers does not say they are so much different from
you or stupid.
You called me selfish, childish and a M$ lover...
Well... I'm a squatter, I try to live anarchistic and I do not prejudge
people. And if I disagree... I certainly do not say things that go
straight against the subject in discussion and break the social Gentoo
rules on offending other people.
I think you ow me a apology.

Mivz
-- 
gentoo-dev@gentoo.org mailing list

Re: [gentoo-dev] GPL and Source code providing

[Luca Barbato]

Mivz wrote:
> 
> You called me selfish, childish 

Whoever complains about the distribution rules from GPL after using
GPL'd source/stuff is...

> and a M$ lover...

Never said.

> Well... I'm a squatter, I try to live anarchistic and I do not prejudge
> people. And if I disagree... I certainly do not say things that go
> straight against the subject in discussion and break the social Gentoo
> rules on offending other people.

If you are feeling offended then you are either breaching the GPL or are
 thinking you are.

> I think you owe me a apology.

Or maybe you need better explanations since I think you are
misunderstanding.

lu
-- 
gentoo-dev@gentoo.org mailing list

Re: [gentoo-dev] GPL and Source code providing

[Mike Doty]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Mivz wrote:
> That other people don't have a 9 line counting footer and are not
> official Gentoo developers does not say they are so much different from
> you or stupid.
> You called me selfish, childish and a M$ lover...
> Well... I'm a squatter, I try to live anarchistic and I do not prejudge
> people. And if I disagree... I certainly do not say things that go
> straight against the subject in discussion and break the social Gentoo
> rules on offending other people.
> I think you ow me a apology.
> 
> Mivz
Heh,  You want an apology from me yet you attack my signature?  My
previous email stated that what you were attempting to do was childish
and selfish, not that you yourself were either childish or selfish.
Perhaps you should take another English class before you make a bigger
fool out of yourself than you just did.

- --
=======================================================
Mike Doty                      kingtaco -at- gentoo.org
Gentoo/AMD64 Strategic Lead
Gentoo Developer Relations
Gentoo Recruitment Lead
Gentoo Infrastructure
GPG: 0094 7F06 913E 78D6 F1BB  06BA D0AD D125 A797 C7A7
=======================================================
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (GNU/Linux)

iQCVAwUBRKK0kIBrouQZ9K4FAQIiTAP9E38d0uBF7ybkvwl4UMYYSqVFbtRJoXFK
MVh2iiMEP7Ftky/L6DqF76AGKA6v/sRoFJEkAFxaSoD8w00IRMKjCLPR1qVqhhOV
mvJG32k8VVpCUfAosS3HhzdurS5YjU18DjD/6CpPXZ448OvUDtvDps5TM1FKgBiS
PGITgBa2OuI=
=3Cze
-----END PGP SIGNATURE-----
-- 
gentoo-dev@gentoo.org mailing list

Re: [gentoo-dev] GPL and Source code providing

[Ciaran McCreesh]

On Wed, 28 Jun 2006 11:55:47 -0500 Mike Doty <kingtaco@gentoo.org>
wrote:
| Perhaps you should take another English class before you make a bigger
| fool out of yourself than you just did.

I don't think Gentoo developers should be making those kinds of
comments towards users, no matter how much they deserve it. After all,
you're supposed to be encouraging contributions, aren't you?

-- 
Ciaran McCreesh
Mail            : ciaran dot mccreesh at blueyonder.co.uk


-- 
gentoo-dev@gentoo.org mailing list

Re: [gentoo-dev] GPL and Source code providing

[Chris Gianelloni]

[-- Attachment #1: Type: text/plain, Size: 2040 bytes --]

On Wed, 2006-06-28 at 17:18 +0200, Mivz wrote:
> Mike Doty wrote:
> > Mivz wrote:
> >>> Then I have got this one question, I don't need a answer too.
> >>>
> >>> How free is free software if you need a lawyer and a expensive server
> >>> just to be able to publish your addition under your own name?
> >>>
> > Very free.  There are many project sites that will host your content if
> > you have it under a GPL or similar license.  Similarly, as long as you
> > provide the source, you satisfy the main point of GPL.  Thousands of
> > projects do exactly this without any input from a lawyer.
> > 
> 
> But then it's still 'free beer', and not 'freedom'. I still can not
> write a patch and make a cd with the patch applied to give to my mum and
> my friends, without the risk of my intelligence being stolen and abused.
> Or I have to go through the hassle of finding a provider, which of
> course needs attention too.

This is a common misconception.  All that you really need to provide is
the patches.  If you, for example, made a Gentoo-based distribution, and
made changes to 3 packages, you would only need provide the source for
those three packages.  At most, providing a link to the upstream (us)
packages/code/etc for everything else would be required.  Also, you are
only required to provide source to the people you provide binaries to,
and you're only required to do so on request.  Meaning that if you made
a CD and only gave it to your mom, you don't need a server.  You just
need to burn her a CD of source if she asked.  It really is that simple.
The only way you need a server is if you're going about distributing it
to the world, and you made a ton of changes.  Remember, the GPL just
says that you have to provide the code.  Pointing someone to where they
can get it *is* providing it, so long as any patches/changes you've made
are also available under some means.

-- 
Chris Gianelloni
Release Engineering - Strategic Lead
x86 Architecture Team
Games - Developer
Gentoo Linux

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

Re: [gentoo-dev] GPL and Source code providing

[Ciaran McCreesh]

On Wed, 28 Jun 2006 11:42:47 -0400 Chris Gianelloni
<wolf31o2@gentoo.org> wrote:
| This is a common misconception.  All that you really need to provide
| is the patches.

Careful with that. The GNU people say otherwise.

http://www.gnu.org/licenses/gpl-faq.html#DistributingSourceIsInconvenient

-- 
Ciaran McCreesh
Mail            : ciaran dot mccreesh at blueyonder.co.uk


-- 
gentoo-dev@gentoo.org mailing list

Re: [gentoo-dev] GPL and Source code providing

[Mivz]

Chris Gianelloni wrote:
> On Wed, 2006-06-28 at 17:18 +0200, Mivz wrote:
>> Mike Doty wrote:
>>> Mivz wrote:
>>>>> Then I have got this one question, I don't need a answer too.
>>>>>
>>>>> How free is free software if you need a lawyer and a expensive server
>>>>> just to be able to publish your addition under your own name?
>>>>>
>>> Very free.  There are many project sites that will host your content if
>>> you have it under a GPL or similar license.  Similarly, as long as you
>>> provide the source, you satisfy the main point of GPL.  Thousands of
>>> projects do exactly this without any input from a lawyer.
>>>
>> But then it's still 'free beer', and not 'freedom'. I still can not
>> write a patch and make a cd with the patch applied to give to my mum and
>> my friends, without the risk of my intelligence being stolen and abused.
>> Or I have to go through the hassle of finding a provider, which of
>> course needs attention too.
> 
> This is a common misconception.  All that you really need to provide is
> the patches.  If you, for example, made a Gentoo-based distribution, and
> made changes to 3 packages, you would only need provide the source for
> those three packages.  At most, providing a link to the upstream (us)
> packages/code/etc for everything else would be required.  Also, you are
> only required to provide source to the people you provide binaries to,
> and you're only required to do so on request.  Meaning that if you made
> a CD and only gave it to your mom, you don't need a server.  You just
> need to burn her a CD of source if she asked.  It really is that simple.
> The only way you need a server is if you're going about distributing it
> to the world, and you made a ton of changes.  Remember, the GPL just
> says that you have to provide the code.  Pointing someone to where they
> can get it *is* providing it, so long as any patches/changes you've made
> are also available under some means.
> 

Tank you :) Now it all makes sens. Cause if you publish a live cd to a
large audience, you should be able to publish the rest also. Then it's
only a couple of GB on disk. If you make just a few for friends, a text
file with your email is enough. Now I see how nice the GPL adopts to the
size of your plans and audience.
And if it grows, it is also reasonable to provide a Gentoo mirror,
because it probably would also use the Gentoo network for distribution
of the base files.

-- 
gentoo-dev@gentoo.org mailing list

Re: [gentoo-dev] GPL and Source code providing

[Diego 'Flameeyes' Pettenò]

[-- Attachment #1: Type: text/plain, Size: 563 bytes --]

On Wednesday 28 June 2006 17:42, Chris Gianelloni wrote:
> This is a common misconception.  All that you really need to provide is
> the patches.
Not really, no. As Ciaran already said, FSF seems not to think this way and 
this is the most important thing on that article.

But there's a simple way of course to handle the whole stuff, and is to just 
send the changes upstream. This is anyway a good idea, btw.

-- 
Diego "Flameeyes" Pettenò - http://farragut.flameeyes.is-a-geek.org/
Gentoo/Alt lead, Gentoo/FreeBSD, Video, AMD64, Sound, PAM, KDE

[-- Attachment #2: Type: application/pgp-signature, Size: 189 bytes --]

Re: [gentoo-dev] GPL and Source code providing

[Luca Barbato]

Diego 'Flameeyes' Pettenò wrote:
> On Wednesday 28 June 2006 17:42, Chris Gianelloni wrote:
>> This is a common misconception.  All that you really need to provide is
>> the patches.
> Not really, no. As Ciaran already said, FSF seems not to think this way and 
> this is the most important thing on that article.
> 

Yawn, the misguided article is due the Mephis distributor having a long
track of misbehavior and depicting himself as a victim...

As gpl2 you should provide a written offer for the source and hand them
over upon request using any machine readable medium.

my 2 (fake) eurocents

lu

-- 

Luca Barbato

Gentoo/linux Gentoo/PPC
http://dev.gentoo.org/~lu_zero

-- 
gentoo-dev@gentoo.org mailing list

Re: [gentoo-dev] GPL and Source code providing

[Chris Gianelloni]

[-- Attachment #1: Type: text/plain, Size: 1158 bytes --]

On Wed, 2006-06-28 at 21:48 +0200, Luca Barbato wrote:
> Diego 'Flameeyes' Pettenò wrote:
> > On Wednesday 28 June 2006 17:42, Chris Gianelloni wrote:
> >> This is a common misconception.  All that you really need to provide is
> >> the patches.
> > Not really, no. As Ciaran already said, FSF seems not to think this way and 
> > this is the most important thing on that article.

Apparently, I was mistaken on how this works.

Anyway, who is going to re-write our mirroring scripts so that we aren't
stripping stuff anymore?  After all, we're still "shipping" 1.2 ISO
images under /historical, and I can guarantee you that the source code
for all of this stuff isn't available from us.  Good examples of this
are packages that no longer merge due to missing distfiles when using a
release's portage snapshot instead of a current tree.  This happens
every release, so I know that we aren't keeping all of this stuff.

We will need to work on compliance ourselves with this, before the FSF
comes knocking on our door.

-- 
Chris Gianelloni
Release Engineering - Strategic Lead
x86 Architecture Team
Games - Developer
Gentoo Linux

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

[gentoo-dev] Re: GPL and Source code providing

[Duncan]

Chris Gianelloni <wolf31o2@gentoo.org> posted
1151529396.2774.25.camel@cgianelloni.nuvox.net, excerpted below, on  Wed,
28 Jun 2006 17:16:35 -0400:

> After all, we're still "shipping" 1.2 ISO images under /historical, and I
> can guarantee you that the source code for all of this stuff isn't
> available from us.
> 
> We will need to work on compliance ourselves with this, before the FSF
> comes knocking on our door.

Good point.  Do note, however, that Gentoo is in better shape here than
most, since only the actual binaries on the CD are at issue.  That's far
less source to worry about than most distributions, with /everything/ as
binary, must worry about.

We /do/ need to worry about the packages CDs, however.  That's a lot of
source to manage there, and I'd say much more likely to be at risk than
the mostly fairly core (and therefore likely still widely available
sources, tho we /will/ need to ensure we make the sources available
ourselves) stuff on the LiveCD itself.

For that reason, I'd suggest ceasing to distribute the packages CD ISOs 30
days after the next release is available, thereby limiting at least the
general source requirements of the packages CD to a narrower timeslot,
even if the far more limited source requirements of the LiveCD are allowed
to continue somewhat longer, I'd suggest 30 days after the /second/
release.

As for the sources themselves, the mirrors should hopefully have the
current versions, at least.  Whether we keep previous LiveCD (and packages
CD if we continue to distribute it) sources on-mirror or on an archive
repository setup for the purpose could be debated, tho I'd suggest the
archive repository, so the mirrors don't have to carry it.

-- 
Duncan - List replies preferred.   No HTML msgs.
"Every nonfree program has a lord, a master --
and if you use the program, he is your master."  Richard Stallman

-- 
gentoo-dev@gentoo.org mailing list

Re: [gentoo-dev] GPL and Source code providing

[Greg KH]

On Wed, Jun 28, 2006 at 04:28:42PM +0200, Mivz wrote:
> How free is free software if you need a lawyer and a expensive server
> just to be able to publish your addition under your own name?

*plonk*
-- 
gentoo-dev@gentoo.org mailing list

Re: [gentoo-dev] GPL and Source code providing

[Bo Ørsted Andresen]

[-- Attachment #1: Type: text/plain, Size: 405 bytes --]

On Wednesday 28 June 2006 16:28, Mivz wrote:
> How free is free software if you need a lawyer and a expensive server
> just to be able to publish your addition under your own name?

There is nothing preventing you from just publishing a patch with your name. 
The problem arises only if you distribute a binary without either source or 
an offer to provide source on request...

-- 
Bo Andresen

[-- Attachment #2: Type: application/pgp-signature, Size: 189 bytes --]

Re: [gentoo-dev] GPL and Source code providing

[Stuart Herbert]

On 6/28/06, Mivz <mivz@alpha.spugium.net> wrote:
> How free is free software if you need a lawyer and a expensive server
> just to be able to publish your addition under your own name?

With the GPL v2, you don't need a server at all.  You're perfectly
entitled to distribute the code on DVD (for example), for a fee.  You
don't have to keep the source online at all.

If the GPL v3 does require you to keep the source online, that'd be a
shame.  Relying on third parties (such as SourceForge, or Berlios) to
host your source online is risky ... if they disappear, *you* are
still liable to keep your source code online (presumably the three
year rule still applies).  If the third party disappears, taking older
versions of the code with it, what then for you?  Technically, you're
in violation.

The idea that everyone has cheap hosting available to them is sadly an
incomplete view of the world :(

Best regards,
Stu
-- 
gentoo-dev@gentoo.org mailing list

[gentoo-dev] Re: GPL and Source code providing

[Wiktor Wandachowicz]

Mivz <mivz <at> alpha.spugium.net> writes:

> Then I have got this one question, I don't need a answer too.
> 
> How free is free software if you need a lawyer and a expensive server
> just to be able to publish your addition under your own name?

This is free as in *freedom*. GPL says that you cannot restrict the freedom of
other people. So, ditributing the modified, GPL-ed programs without the access
to the source code with said modifications restrict others from seeing how it
was achieved and tinkering with the code (i.e. improving it more).

Sorry, but there's no free lunch (as in *beer). If you build upon the work of
others and it happens that this work is under GPL, then you either must behave
(give access to the source code) or write your own version of the software from
the ground. And compiling a distro from the source code and creating a binary
download, CDs, upgrades, etc. *is* a derivative work IMHO. The same is for
single packages that are under GPL.

I mean, if someone is able to create its own web page and put a binary
download(s) of its work, then how hard is it to comply with the GPL
license and just put some more links to the source code?
It's like the (old?/new?) Decalogue: "You shall not steal".

Read this:
"Richard Stallman, interviewed at GPLv3 Conference in Barcelona, by Sean Daly"
http://www.groklaw.net/article.php?story=20060625001523547
The interesting thing starts at 07:36 of the transcript.

Also read this, if you haven't done so before:
http://www.gnu.org/licenses/gpl.txt
http://www.gnu.org/copyleft/gpl.html

Cheers,
Wiktor Wandachowicz (SirYes)

PS. Sorry for the noise, but I thought this issue needed clarification.

-- 
gentoo-dev@gentoo.org mailing list

Re: [gentoo-dev] Re: GPL and Source code providing

[Mivz]

Wiktor Wandachowicz wrote:
> I mean, if someone is able to create its own web page and put a binary
> download(s) of its work, then how hard is it to comply with the GPL
> license and just put some more links to the source code?
> It's like the (old?/new?) Decalogue: "You shall not steal".
> 

But if your modification is on top of the Gentoo system and your build
your own Live cd, like Kororaa, do you have to provide all the sources
of all the program's on the live cd?
-- 
gentoo-dev@gentoo.org mailing list

[gentoo-dev] Re: GPL and Source code providing

[Wiktor Wandachowicz]

Mivz <mivz <at> alpha.spugium.net> writes:

> But if your modification is on top of the Gentoo system and your build
> your own Live cd, like Kororaa, do you have to provide all the sources
> of all the program's on the live cd?

Well, if you *modify* programs that you want to put on said live cd (like adding
your own patches, different from the official ones found in portage) then IMO
you should at least give access to the patches. If you aim to create a completely
separate distribution, thus using your own repository, web site and portage tree
(for example), then it makes perfect sense to provide a full source code as well.

But in the case of Gentoo offshot which intends to use existing Gentoo
infrastucture (mirrors, sources, etc.) I'd suggest to consult the original
copyright (copyleft?) holders, that means Gentoo officials. Just in case.

Cheers,
Wiktor Wandachowicz

PS. I'll stop posting now as IANAL and the above are only my own opinions.


-- 
gentoo-dev@gentoo.org mailing list

Re: [gentoo-dev] Re: GPL and Source code providing

[Kevin F. Quinn]

[-- Attachment #1: Type: text/plain, Size: 1297 bytes --]

On Wed, 28 Jun 2006 17:30:27 +0200
Mivz <mivz@alpha.spugium.net> wrote:

> Wiktor Wandachowicz wrote:
> > I mean, if someone is able to create its own web page and put a
> > binary download(s) of its work, then how hard is it to comply with
> > the GPL license and just put some more links to the source code?
> > It's like the (old?/new?) Decalogue: "You shall not steal".
> > 
> 
> But if your modification is on top of the Gentoo system and your build
> your own Live cd, like Kororaa, do you have to provide all the sources
> of all the program's on the live cd?

To all the binary files you created, yes.  You don't have to do this
for binary files copied from a Gentoo Live CD, as in that case you're a
third party (like a courier, or the postman) and can can simply refer
back to Gentoo. However if you distribute binaries that are different,
then you have to distribute the sources sufficient to build the
modified binaries to anyone who asks for it (well, anyone to whom
you distributed your binaries).

I suggest you burn a disc when you build a release containing all the
source, include an offer on the your release media (clearly
and obviously places) describing how people can request a copy of the
source disc from you if they wish.

-- 
Kevin F. Quinn

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 191 bytes --]

Re: [gentoo-dev] Re: GPL and Source code providing

[Maurice van der Pot]

[-- Attachment #1: Type: text/plain, Size: 965 bytes --]

On Wed, Jun 28, 2006 at 07:54:12PM +0200, Kevin F. Quinn wrote:
> You don't have to do this
> for binary files copied from a Gentoo Live CD, as in that case you're a
> third party (like a courier, or the postman) and can can simply refer
> back to Gentoo. 

According to the FSF you need to provide the sources also for things you
did not modify (see the link ciaran provided), because you are
redistributing those binaries and distribution means you have to provide
sources yourself. It is not enough to refer to other parties, because
those other parties can take their sources offline and you will still
have to provide your users with the sources if/when they want them.

You are responsible for providing the sources of any GPL binaries you
distribute.

Maurice.

-- 
Maurice van der Pot

Gentoo Linux Developer   griffon26@gentoo.org     http://www.gentoo.org
Creator of BiteMe!       griffon26@kfk4ever.com   http://www.kfk4ever.com


[-- Attachment #2: Type: application/pgp-signature, Size: 191 bytes --]

Re: [gentoo-dev] Re: GPL and Source code providing

[Kevin F. Quinn]

[-- Attachment #1: Type: text/plain, Size: 2649 bytes --]

On Wed, 28 Jun 2006 21:20:00 +0200
Maurice van der Pot <griffon26@gentoo.org> wrote:

> On Wed, Jun 28, 2006 at 07:54:12PM +0200, Kevin F. Quinn wrote:
> > You don't have to do this
> > for binary files copied from a Gentoo Live CD, as in that case
> > you're a third party (like a courier, or the postman) and can can
> > simply refer back to Gentoo. 
> 
> According to the FSF you need to provide the sources also for things
> you did not modify (see the link ciaran provided), because you are
> redistributing those binaries and distribution means you have to
> provide sources yourself. It is not enough to refer to other parties,
> because those other parties can take their sources offline and you
> will still have to provide your users with the sources if/when they
> want them.
> 
> You are responsible for providing the sources of any GPL binaries you
> distribute.
> 
> Maurice.

I was thinking about what they say here:

http://www.gnu.org/licenses/gpl-faq.html#TOCWhatDoesWrittenOfferValid

which implies that if someone receives binaries from a third party,
it's the original distributor that has to honour the offer (said offer
being distributed/forwarded with the binaries).

In particular clause 3c of the license permits non-commercial
distribution of binary code without source code provided the offer from
the originator accompanies the binaries:


---- except from http://www.gnu.org/licenses/gpl.txt
  3. You may copy and distribute the Program (or a work based on it,
under Section 2) in object code or executable form under the terms of
Sections 1 and 2 above provided that you also do one of the following:

    a) Accompany it with the complete corresponding machine-readable
    source code, which must be distributed under the terms of Sections
    1 and 2 above on a medium customarily used for software
    interchange; or,

    b) Accompany it with a written offer, valid for at least three
    years, to give any third party, for a charge no more than your
    cost of physically performing source distribution, a complete
    machine-readable copy of the corresponding source code, to be
    distributed under the terms of Sections 1 and 2 above on a medium
    customarily used for software interchange; or,

    c) Accompany it with the information you received as to the offer
    to distribute corresponding source code.  (This alternative is
    allowed only for noncommercial distribution and only if you
    received the program in object code or executable form with such
    an offer, in accord with Subsection b above.)
----

-- 
Kevin F. Quinn

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 191 bytes --]

[gentoo-dev] Re: Re: GPL and Source code providing

[Duncan]

"Kevin F. Quinn" <kevquinn@gentoo.org> posted
20060629001752.01c9e617@c1358217.kevquinn.com, excerpted below, on  Thu,
29 Jun 2006 00:17:52 +0200:

> On Wed, 28 Jun 2006 21:20:00 +0200
> Maurice van der Pot <griffon26@gentoo.org> wrote:
> 
>> On Wed, Jun 28, 2006 at 07:54:12PM +0200, Kevin F. Quinn wrote:
>> > You don't have to do this
>> > for binary files copied from a Gentoo Live CD, as in that case
>> > you're a third party (like a courier, or the postman) and can can
>> > simply refer back to Gentoo. 
>> 
>> According to the FSF you need to provide the sources also for things
>> you did not modify (see the link ciaran provided), because you are
>> redistributing those binaries and distribution means you have to
>> provide sources yourself. It is not enough to refer to other parties,
>> because those other parties can take their sources offline and you
>> will still have to provide your users with the sources if/when they
>> want them.
> 
> I was thinking about what they say here:
> 
> http://www.gnu.org/licenses/gpl-faq.html#TOCWhatDoesWrittenOfferValid
> 
> which implies that if someone receives binaries from a third party,
> it's the original distributor that has to honour the offer (said offer
> being distributed/forwarded with the binaries).
> 
> In particular clause 3c of the license permits non-commercial
> distribution of binary code without source code provided the offer from
> the originator accompanies the binaries:
> 
> ---- except from http://www.gnu.org/licenses/gpl.txt
>   3. You may copy and distribute the Program (or a work based on it,
> under Section 2) in object code or executable form under the terms of
> Sections 1 and 2 above provided that you also do one of the following:
> 
>     a) Accompany it with the complete corresponding machine-readable
>     source code, which must be distributed under the terms of Sections
>     1 and 2 above on a medium customarily used for software
>     interchange; or,

This is what most distributions do (including Gentoo AFAIK).  This is fine
because as long as the binaries are provided, so are the sources.  The
binaries are not available from the provider except where sources are
available, and the sources can come down at the same time as the binaries
(no 3-year minimum availability).

>     b) Accompany it with a written offer, valid for at least three
>     years, to give any third party, for a charge no more than your
>     cost of physically performing source distribution, a complete
>     machine-readable copy of the corresponding source code, to be
>     distributed under the terms of Sections 1 and 2 above on a medium
>     customarily used for software interchange; or,
> 
>     c) Accompany it with the information you received as to the offer
>     to distribute corresponding source code.  (This alternative is
>     allowed only for noncommercial distribution and only if you
>     received the program in object code or executable form with such
>     an offer, in accord with Subsection b above.)
> ----

Note that the 3c exception SPECIFICALLY only applies to those with an
upstream using 3b.  Most modern distributions prefer 3a to 3b, in part
because they don't want to have to worry about the 3-year minimum of 3b.

The problem here is a time-sync issue.  Gentoo isn't responsible for
downstream, and by choosing 3a, only has to distribute sources as long as
it distributes binaries.  It's quite conceivable that downstream will
still be distributing the unmodified-source binaries long after upstream
(Gentoo in our case) ceases to distribute them, and therefore has ceased
distributing sources as well.  To ensure sources continue to be available
and comply with the GPL, therefore, the downstream supplier must provide
sources under 3a or 3b themselves, even if non-commercial, if upstream
uses 3a, because the 3c exception only applies to 3b.

However, as I said in my earlier post, this shouldn't be the issue it's
being made out to be.  Simply keeping a tarballed copy of the sources
somewhere, available to burn and mail on request, suffices, if 3b is
chosen. Because few worry about sources and because a fee covering physical
costs may be charged further discouraging non-serious requests, it's
unlikely that more than a handful (if that) of requests will actually ever
be made.  Alternatively, if the 3-year thing is a worry, ensure they are
always available under 3a, so at the same time (and often in the same
format) as the binaries is also coverage.  In either case, since Gentoo is
already source-based clear out to the user, managing the sources is even
easier with Gentoo than in the case of a binary-based upstream
distribution, where tracking separate source packages would be required.

-- 
Duncan - List replies preferred.   No HTML msgs.
"Every nonfree program has a lord, a master --
and if you use the program, he is your master."  Richard Stallman

-- 
gentoo-dev@gentoo.org mailing list

Re: [gentoo-dev] Re: Re: GPL and Source code providing

[Kevin F. Quinn]

[-- Attachment #1: Type: text/plain, Size: 1075 bytes --]

On Fri, 30 Jun 2006 20:53:42 +0000 (UTC)
"Duncan" <1i5t5.duncan@cox.net> wrote:

> "Kevin F. Quinn" <kevquinn@gentoo.org> posted
> >     a) Accompany it with the complete corresponding machine-readable
> >     source code, which must be distributed under the terms of
> > Sections 1 and 2 above on a medium customarily used for software
> >     interchange; or,
> 
> This is what most distributions do (including Gentoo AFAIK).  This is
> fine because as long as the binaries are provided, so are the
> sources.

This is not true for Gentoo LiveCDs, stage tarballs etc.  It may be
true at the moment they are first uploaded, in that everything should
be available on the mirrors, but as time goes on and we continue to
distribute them it becomes false. Just try to retrieve the source for
the historical distributions.

For example, if we hand out CDs at conventions etc, we would have to
also hand out source CDs.

For comparison, RedHat et. al. distribute binary & source CDs together,
both on-line and in their retail packs.

-- 
Kevin F. Quinn

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 191 bytes --]

[gentoo-dev] Re: Re: Re: GPL and Source code providing

[Duncan]

"Kevin F. Quinn" <kevquinn@gentoo.org> posted
20060701111437.0ed09223@c1358217.kevquinn.com, excerpted below, on  Sat,
01 Jul 2006 11:14:37 +0200:

> On Fri, 30 Jun 2006 20:53:42 +0000 (UTC)
> "Duncan" <1i5t5.duncan@cox.net> wrote:
> 
>> "Kevin F. Quinn" <kevquinn@gentoo.org> posted
>> >     a) Accompany it with the complete corresponding machine-readable
>> >     source code, which must be distributed under the terms of
>> >     Sections 1 and 2 above on a medium customarily used for software
>> >     interchange; or,
>> 
>> This is what most distributions do (including Gentoo AFAIK).
> 
> This is not true for Gentoo LiveCDs, stage tarballs etc.  It may be
> true at the moment they are first uploaded, in that everything should
> be available on the mirrors, but as time goes on and we continue to
> distribute them it becomes false. Just try to retrieve the source for
> the historical distributions.
> 
> For example, if we hand out CDs at conventions etc, we would have to
> also hand out source CDs.

That is indeed a problem.  I believe it was Solar that mentioned that in
another subthread.  Infra and legal should look into this, before Gentoo
ends up with a letter of its own from the FSF "encouraging" full GPLv2
compliance.

As my reply there, however, Gentoo does still have it better than most, in
that the LiveCDs contain relatively few binaries, and they tend to be
relatively core packages to which sources should still be available even
for historic releases, should we wish to continue distributing the
historical LiveCDs. The packages CDs OTOH...

Again as I mentioned there, I'd suggest retiring package CDs 30 days after
the next release is out, thus eliminating the largest share of the
problem.  With the limited binaries on the LiveCDs, it may be worth
keeping the sources around as well as the LiveCDs, for historical reasons.
Elsewise, I'd suggest retiring them 30 days after the /second/ release to
come out after them.  That should reduce Gentoo's sources requirement to a
manageable level.  Beyond that, whether those current minus-one packages,
and current minus-two liveCDs, sources should be hosted on an archive
server or continue on the mirrors is for Infra to decide.  I'd suggest a
policy that has RelEng archiving sources to an archive host as part of the
RelEng process, as the most reliable and least hassle.  Then they'd be
there, and could be removed at any point after the parallel CDs using
their binaries had been removed.  However, others may have more workable
ideas, and I'm not a dev let alone Infra, so wouldn't wish to pretend to
decide what's best for them.

-- 
Duncan - List replies preferred.   No HTML msgs.
"Every nonfree program has a lord, a master --
and if you use the program, he is your master."  Richard Stallman

-- 
gentoo-dev@gentoo.org mailing list

Re: [gentoo-dev] Re: Re: Re: GPL and Source code providing

[Chris Gianelloni]

[-- Attachment #1: Type: text/plain, Size: 1890 bytes --]

On Sat, 2006-07-01 at 11:12 +0000, Duncan wrote:
> > For example, if we hand out CDs at conventions etc, we would have to
> > also hand out source CDs.

> As my reply there, however, Gentoo does still have it better than most, in
> that the LiveCDs contain relatively few binaries, and they tend to be
> relatively core packages to which sources should still be available even
> for historic releases, should we wish to continue distributing the
> historical LiveCDs. The packages CDs OTOH...

Umm... The LiveCD has almost 700 packages on it.  Perhaps you mean the
InstallCD?

> Again as I mentioned there, I'd suggest retiring package CDs 30 days after
> the next release is out, thus eliminating the largest share of the
> problem.  With the limited binaries on the LiveCDs, it may be worth
> keeping the sources around as well as the LiveCDs, for historical reasons.
> Elsewise, I'd suggest retiring them 30 days after the /second/ release to
> come out after them.  That should reduce Gentoo's sources requirement to a
> manageable level.  Beyond that, whether those current minus-one packages,
> and current minus-two liveCDs, sources should be hosted on an archive
> server or continue on the mirrors is for Infra to decide.  I'd suggest a
> policy that has RelEng archiving sources to an archive host as part of the
> RelEng process, as the most reliable and least hassle.  Then they'd be
> there, and could be removed at any point after the parallel CDs using
> their binaries had been removed.  However, others may have more workable
> ideas, and I'm not a dev let alone Infra, so wouldn't wish to pretend to
> decide what's best for them.

Please don't pretend that you can decide what's best for Release
Engineering, either.  =]

-- 
Chris Gianelloni
Release Engineering - Strategic Lead
x86 Architecture Team
Games - Developer
Gentoo Linux

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

Re: [gentoo-dev] Re: Re: Re: GPL and Source code providing

[Patrick McLean]

Chris Gianelloni wrote:
> On Sat, 2006-07-01 at 11:12 +0000, Duncan wrote:
>>> For example, if we hand out CDs at conventions etc, we would have to
>>> also hand out source CDs.
> 
>> As my reply there, however, Gentoo does still have it better than most, in
>> that the LiveCDs contain relatively few binaries, and they tend to be
>> relatively core packages to which sources should still be available even
>> for historic releases, should we wish to continue distributing the
>> historical LiveCDs. The packages CDs OTOH...
> 
> Umm... The LiveCD has almost 700 packages on it.  Perhaps you mean the
> InstallCD?
> 

I have absolutely zero experience with catalyst, but couldn't it be made
to create a source CD ISO when it is generating the binary one? Just
make a cd with all the distfiles used in the ISO, and keep the source
ISO with the binary one in /historical.
-- 
gentoo-dev@gentoo.org mailing list

Re: [gentoo-dev] Re: Re: Re: GPL and Source code providing

[Marius Mauch]

Patrick McLean schrieb:
> I have absolutely zero experience with catalyst, but couldn't it be made
> to create a source CD ISO when it is generating the binary one? Just
> make a cd with all the distfiles used in the ISO, and keep the source
> ISO with the binary one in /historical.

Creating an ISO isn't a problem (assuming you have the sources, which 
for historical releases might be a problem), but it would require 
another several hundred megabytes per release on the mirrors which isn't 
exactly a trivial amount.

Marius
-- 
gentoo-dev@gentoo.org mailing list

Re: [gentoo-dev] Re: Re: Re: GPL and Source code providing

[Patrick McLean]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Marius Mauch wrote:
> Patrick McLean schrieb:
>> I have absolutely zero experience with catalyst, but couldn't it be made
>> to create a source CD ISO when it is generating the binary one? Just
>> make a cd with all the distfiles used in the ISO, and keep the source
>> ISO with the binary one in /historical.
> 
> Creating an ISO isn't a problem (assuming you have the sources, which
> for historical releases might be a problem), but it would require
> another several hundred megabytes per release on the mirrors which isn't
> exactly a trivial amount.
> 
No it's not a trivial amount, but it's also important that we comply
with the licenses of the software that we distribute. I think that
storing a gig or two extra on the mirrors (or more on the mirrors that
archive /historical) is fairly trivial compared to violating the GPL.

If we violate the GPL in this case, we really won't be able to enforce
it in the future if someone were to violate it in the case of our stuff.

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.3 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFEqsTnWt/XSf2CZdkRAk6FAJ9Sph9N43xafN/ihxUOREjKgJX8KACcCbTy
52EK0y1dFpYu7PL17gu2K3U=
=NP2P
-----END PGP SIGNATURE-----
-- 
gentoo-dev@gentoo.org mailing list

Re: [gentoo-dev] Re: Re: Re: GPL and Source code providing

[Nick Devito]

It wouldn't be a hard task to accomplish (to put the sources on the
mirrors), since *most* of the source is already on the mirrors in some
form or another. We could make an option when downloading the livecd to
either download ones with the sources included, or without, and, include
links to download the tarballs used in making that release. And yes, it
would be very trivial compared to violating the GPL. That's just me...

~ nick 
On Tue, 2006-07-04 at 15:43 -0400, Patrick McLean wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> Marius Mauch wrote:
> > Patrick McLean schrieb:
> >> I have absolutely zero experience with catalyst, but couldn't it be made
> >> to create a source CD ISO when it is generating the binary one? Just
> >> make a cd with all the distfiles used in the ISO, and keep the source
> >> ISO with the binary one in /historical.
> > 
> > Creating an ISO isn't a problem (assuming you have the sources, which
> > for historical releases might be a problem), but it would require
> > another several hundred megabytes per release on the mirrors which isn't
> > exactly a trivial amount.
> > 
> No it's not a trivial amount, but it's also important that we comply
> with the licenses of the software that we distribute. I think that
> storing a gig or two extra on the mirrors (or more on the mirrors that
> archive /historical) is fairly trivial compared to violating the GPL.
> 
> If we violate the GPL in this case, we really won't be able to enforce
> it in the future if someone were to violate it in the case of our stuff.
> 
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.3 (GNU/Linux)
> Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
> 
> iD8DBQFEqsTnWt/XSf2CZdkRAk6FAJ9Sph9N43xafN/ihxUOREjKgJX8KACcCbTy
> 52EK0y1dFpYu7PL17gu2K3U=
> =NP2P
> -----END PGP SIGNATURE-----
-- 
gentoo-dev@gentoo.org mailing list

Re: [gentoo-dev] Re: Re: Re: GPL and Source code providing

[Francesco Riosa]

Nick Devito wrote:
> It wouldn't be a hard task to accomplish (to put the sources on the
> mirrors), since *most* of the source is already on the mirrors in some
> form or another. We could make an option when downloading the livecd to
> either download ones with the sources included, or without, and, include
> links to download the tarballs used in making that release. And yes, it
> would be very trivial compared to violating the GPL. That's just me...

Why should we put the sources on every mirrors at all?

Those sources packages will be much less downloaded, 4 sure put them
only in _one_ place over the internet will suffice.

<snip>

<snip>
>>>> Creating an ISO isn't a problem (assuming you have the sources, which
>>>> for historical releases might be a problem), but it would require
>>>> another several hundred megabytes per release on the mirrors which isn't
>>>> exactly a trivial amount.

<snip>

-- 
gentoo-dev@gentoo.org mailing list

Re: [gentoo-dev] Re: Re: Re: GPL and Source code providing

[Chris Gianelloni]

[-- Attachment #1: Type: text/plain, Size: 1533 bytes --]

On Tue, 2006-07-04 at 14:15 -0600, Nick Devito wrote:
> It wouldn't be a hard task to accomplish (to put the sources on the
> mirrors), since *most* of the source is already on the mirrors in some
> form or another. We could make an option when downloading the livecd to
> either download ones with the sources included, or without, and, include
> links to download the tarballs used in making that release. And yes, it
> would be very trivial compared to violating the GPL. That's just me...

*sigh*

Making a CD with all the sources on the same CD as the binaries would be
prohibitively restrictive.  We're not going to do it.  We're not even
going to try it.

I have this hair-brained idea.  How about instead of postulating, you
try speaking with the teams actually involved and see what they think?
I'm sure Release Engineering and Infrastructure know just a little bit
about the releases and our mirrors.  ;]

Anyway...

I'm now going to be working with our Infrastructure team to come up with
a solution.  Continued "discussion" on this issue without knowing any of
the actual back-end information is pretty pointless.  I'm going to be
working on a solution, so I am not going to bother reading any more of
this thread, nor responding to it.  There's simply no point in
discussing something where one has none of the important information and
yet still tries to make a decision.

-- 
Chris Gianelloni
Release Engineering - Strategic Lead
x86 Architecture Team
Games - Developer
Gentoo Linux

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

Re: [gentoo-dev] Re: Re: Re: GPL and Source code providing

[Chris Gianelloni]

[-- Attachment #1: Type: text/plain, Size: 1373 bytes --]

On Tue, 2006-07-04 at 15:43 -0400, Patrick McLean wrote:
> No it's not a trivial amount, but it's also important that we comply
> with the licenses of the software that we distribute. I think that
> storing a gig or two extra on the mirrors (or more on the mirrors that
> archive /historical) is fairly trivial compared to violating the GPL.

I always find arguments quite funny from people that don't know the
situation, at all.  It would be well more than a couple gigabytes of
data.  In fact, it would be prohibitively more data.

Quite simply, I'm going to work with Infrastructure and see what we can
come up with.  Most likely, we're going to have to quit
shipping /releases/historical entirely, since there *will* be source
code, specifically patches made by Gentoo developers, that will be lost
in the years since things like 1.2 were released.

Now, I can easily just wrap up all of the sources on our build box after
a release.  That will pull in everything for amd64/x86, anyway.  I'd
have to get everyone else to do the same, then we could archive that
somewhere, but it would only be valid from this release forward, meaning
we would have to pull everything except the upcoming release from the
mirrors when we did it.

-- 
Chris Gianelloni
Release Engineering - Strategic Lead
x86 Architecture Team
Games - Developer
Gentoo Linux

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

Re: [gentoo-dev] Re: Re: Re: GPL and Source code providing

[Kevin F. Quinn]

[-- Attachment #1: Type: text/plain, Size: 1747 bytes --]

On Tue, 04 Jul 2006 18:34:01 +0300
Marius Mauch <genone@gentoo.org> wrote:

> Patrick McLean schrieb:
> > I have absolutely zero experience with catalyst, but couldn't it be
> > made to create a source CD ISO when it is generating the binary
> > one? Just make a cd with all the distfiles used in the ISO, and
> > keep the source ISO with the binary one in /historical.
> 
> Creating an ISO isn't a problem (assuming you have the sources, which 
> for historical releases might be a problem), but it would require 
> another several hundred megabytes per release on the mirrors which
> isn't exactly a trivial amount.

That's not good enough.  We shouldn't do stuff that doesn't comply with
the relevant license, I'm sure most would agree.

Incidentally, the sources don't have to be on all the mirrors,
assuming that's a problem at all. We could supply just one source server
and rate-limit it; after all over the long term very few people will
actually need to retrieve source for older releases, and when releases
are new the sources are available much more easily via emerge and the
mirrors. Might be worth while making that clear to people downloading
the CDs.

An additional approach could be for releng to maintain a list of willing
volunteers around the world who would retain source CDs/DVDs for local
distribution (could limit access to the above-mentioned source-cd server
to these volunteers). Or if we want to be clever, setup a source-request
email alias which releng can farm out to nearby volunteers as
appropriate using email acknowledgement to ensure requests are serviced.

Point being, there are numerous ways we can comply, and no excuse for
not complying from now on.

-- 
Kevin F. Quinn

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

Re: [gentoo-dev] Re: Re: Re: GPL and Source code providing

[Chris Gianelloni]

[-- Attachment #1: Type: text/plain, Size: 1105 bytes --]

On Tue, 2006-07-04 at 22:31 +0200, Kevin F. Quinn wrote:
> Incidentally, the sources don't have to be on all the mirrors,
> assuming that's a problem at all. We could supply just one source server
> and rate-limit it; after all over the long term very few people will
> actually need to retrieve source for older releases, and when releases
> are new the sources are available much more easily via emerge and the
> mirrors. Might be worth while making that clear to people downloading
> the CDs.

The sources don't have to be on *any* mirrors.

We can simply burn them all to a DVD and put an offer on the CD on how
to get the sources, then distribute it for the cost of the DVD/shipping.
Another idea would be to put the CD/DVD/whatever on the store, with 0
mark-up.  That would mean we would be distributing it, at cost, upon
request.  There's nothing in the GPL that says that we have to increase
the disk space *or* the bandwidth usage of *any* machines to comply.

-- 
Chris Gianelloni
Release Engineering - Strategic Lead
x86 Architecture Team
Games - Developer
Gentoo Linux

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

Re: [gentoo-dev] Re: Re: Re: GPL and Source code providing

[Enrico Weigelt]

* Chris Gianelloni <wolf31o2@gentoo.org> schrieb:

> We can simply burn them all to a DVD and put an offer on the CD on how
> to get the sources, then distribute it for the cost of the DVD/shipping.
> Another idea would be to put the CD/DVD/whatever on the store, with 0
> mark-up.  That would mean we would be distributing it, at cost, upon
> request.  There's nothing in the GPL that says that we have to increase
> the disk space *or* the bandwidth usage of *any* machines to comply.

ACK. I'm wondering why this argument comes so late - I was just 
about writing the same as I've seen your mail :)

It would be enough, regularily burning not yet archived tarballs 
on an CD and collecting them in some box where they can be catched
if someone requests it. This should be done by several people, so
in case of disk errors, fire, dead, etc we always have some archive.

Since it's not an gentoo-specific task (all distros shipping binary
packages have this problem), I would suggest doing this within the
csdb-project I annonced lately (http://sourcefarm.metux.de/)


cu
-- 
---------------------------------------------------------------------
 Enrico Weigelt    ==   metux IT service

  phone:     +49 36207 519931         www:       http://www.metux.de/
  fax:       +49 36207 519932         email:     contact@metux.de
  cellphone: +49 174 7066481
---------------------------------------------------------------------
 -- DSL ab 0 Euro. -- statische IP -- UUCP -- Hosting -- Webshops --
---------------------------------------------------------------------
-- 
gentoo-dev@gentoo.org mailing list

Re: [gentoo-dev] Re: Re: Re: GPL and Source code providing

[Chris Gianelloni]

[-- Attachment #1: Type: text/plain, Size: 935 bytes --]

On Wed, 2006-07-05 at 15:59 +0200, Enrico Weigelt wrote:
> It would be enough, regularily burning not yet archived tarballs 
> on an CD and collecting them in some box where they can be catched
> if someone requests it. This should be done by several people, so
> in case of disk errors, fire, dead, etc we always have some archive.

There's absolutely no need for this.  We only provide binaries in the
form of our releases, meaning we *only* need keep sources for those
releases.  Everything else can disappear as soon as it leaves the tree.

> Since it's not an gentoo-specific task (all distros shipping binary
> packages have this problem), I would suggest doing this within the
> csdb-project I annonced lately (http://sourcefarm.metux.de/)

Again, there's absolutely no point in us doing this.

-- 
Chris Gianelloni
Release Engineering - Strategic Lead
x86 Architecture Team
Games - Developer
Gentoo Linux

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

Re: [gentoo-dev] Re: Re: Re: GPL and Source code providing

[Chris Gianelloni]

[-- Attachment #1: Type: text/plain, Size: 982 bytes --]

On Tue, 2006-07-04 at 18:34 +0300, Marius Mauch wrote:
> Patrick McLean schrieb:
> > I have absolutely zero experience with catalyst, but couldn't it be made
> > to create a source CD ISO when it is generating the binary one? Just
> > make a cd with all the distfiles used in the ISO, and keep the source
> > ISO with the binary one in /historical.
> 
> Creating an ISO isn't a problem (assuming you have the sources, which 
> for historical releases might be a problem), but it would require 
> another several hundred megabytes per release on the mirrors which isn't 
> exactly a trivial amount.

No, it would almost double the space used by the release.  Current
releases use about 12-14G of space.  Doubling that would mean reducing
the amount of stuff we're allowed to distribute dramatically,
essentially crippling our release capabilities.

-- 
Chris Gianelloni
Release Engineering - Strategic Lead
x86 Architecture Team
Games - Developer
Gentoo Linux

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

Re: [gentoo-dev] Re: Re: Re: GPL and Source code providing

[Brian Harring]

[-- Attachment #1: Type: text/plain, Size: 1698 bytes --]

On Wed, Jul 05, 2006 at 09:00:29AM -0400, Chris Gianelloni wrote:
> On Tue, 2006-07-04 at 18:34 +0300, Marius Mauch wrote:
> > Patrick McLean schrieb:
> > > I have absolutely zero experience with catalyst, but couldn't it be made
> > > to create a source CD ISO when it is generating the binary one? Just
> > > make a cd with all the distfiles used in the ISO, and keep the source
> > > ISO with the binary one in /historical.
> > 
> > Creating an ISO isn't a problem (assuming you have the sources, which 
> > for historical releases might be a problem), but it would require 
> > another several hundred megabytes per release on the mirrors which isn't 
> > exactly a trivial amount.
> 
> No, it would almost double the space used by the release.  Current
> releases use about 12-14G of space.  Doubling that would mean reducing
> the amount of stuff we're allowed to distribute dramatically,
> essentially crippling our release capabilities.

Stupid question, but the master mirroring setup actually holds onto 
files after it moves them off of the gentoo mirror tier- purgatory 
dir.

Why not just make that dir accessible via web/torrent/whatever on 
a seperate server?  Abusing osprey for it is a bit much (mainly infra 
has asked to wipe files from the purgatory dir in the past, which is a 
no go), so seperate probably is wise.

Further filtering of the files to those under gpl (pulled from pkg 
metadata) is doable, just would need to mangle mirror-dist a bit to 
maintain long term info about who owned what (instead of it's current 
"out of sight, out of the db" approach).

Just a thought- machinery is mostly there, might as well abuse it.
~harring

[-- Attachment #2: Type: application/pgp-signature, Size: 189 bytes --]

Re: [gentoo-dev] Re: Re: Re: GPL and Source code providing

[Lance Albertson]

[-- Attachment #1: Type: text/plain, Size: 3112 bytes --]

Brian Harring wrote:
> On Wed, Jul 05, 2006 at 09:00:29AM -0400, Chris Gianelloni wrote:
>> On Tue, 2006-07-04 at 18:34 +0300, Marius Mauch wrote:
>>> Patrick McLean schrieb:
>>>> I have absolutely zero experience with catalyst, but couldn't it be made
>>>> to create a source CD ISO when it is generating the binary one? Just
>>>> make a cd with all the distfiles used in the ISO, and keep the source
>>>> ISO with the binary one in /historical.
>>> Creating an ISO isn't a problem (assuming you have the sources, which 
>>> for historical releases might be a problem), but it would require 
>>> another several hundred megabytes per release on the mirrors which isn't 
>>> exactly a trivial amount.
>> No, it would almost double the space used by the release.  Current
>> releases use about 12-14G of space.  Doubling that would mean reducing
>> the amount of stuff we're allowed to distribute dramatically,
>> essentially crippling our release capabilities.
> 
> Stupid question, but the master mirroring setup actually holds onto 
> files after it moves them off of the gentoo mirror tier- purgatory 
> dir.
> 
> Why not just make that dir accessible via web/torrent/whatever on 
> a seperate server?  Abusing osprey for it is a bit much (mainly infra 
> has asked to wipe files from the purgatory dir in the past, which is a 
> no go), so seperate probably is wise.

No way in hell are we running such a service on the master mirror. I
don't see why we need to have a public system setup as long as we can
provide the source when asked. As far as a I know, the GPL doesn't
dicate that we have to provide the sources in an internet media form.
They just need to be available when requested. Perhaps we can have a
document that explains a process for getting said sources. I don't see
the point of creating a torrent/whatever system just for the rare
instances that people want the older source. Way too much overhead for
something I don't see being used much.

If it gets to be used more, then we can possibly think about making a
system, but I don't think it warrants it right off. We haven't gotten a
request for old sources (from my memory) ever.

> Further filtering of the files to those under gpl (pulled from pkg 
> metadata) is doable, just would need to mangle mirror-dist a bit to 
> maintain long term info about who owned what (instead of it's current 
> "out of sight, out of the db" approach).
> 
> Just a thought- machinery is mostly there, might as well abuse it.

A lot of the stuff that's currently in the purgatory area also includes
sources for stuff we didn't make (upstream sources, etc). If you can
separate those files from Gentoo specific files, then it would be much
easier to manag (from an admin point of view). Its not practical to
assume we have an infinite amount of space.

-- 
Lance Albertson <ramereth@gentoo.org>
Gentoo Infrastructure | Operations Manager

---
GPG Public Key:  <http://www.ramereth.net/lance.asc>
Key fingerprint: 0423 92F3 544A 1282 5AB1  4D07 416F A15D 27F4 B742

ramereth/irc.freenode.net


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 186 bytes --]

Re: [gentoo-dev] Re: Re: Re: GPL and Source code providing

[Brian Harring]

[-- Attachment #1: Type: text/plain, Size: 3830 bytes --]

On Wed, Jul 05, 2006 at 08:38:42AM -0500, Lance Albertson wrote:
> Brian Harring wrote:
> > On Wed, Jul 05, 2006 at 09:00:29AM -0400, Chris Gianelloni wrote:
> >> On Tue, 2006-07-04 at 18:34 +0300, Marius Mauch wrote:
> >>> Patrick McLean schrieb:
> >>>> I have absolutely zero experience with catalyst, but couldn't it be made
> >>>> to create a source CD ISO when it is generating the binary one? Just
> >>>> make a cd with all the distfiles used in the ISO, and keep the source
> >>>> ISO with the binary one in /historical.
> >>> Creating an ISO isn't a problem (assuming you have the sources, which 
> >>> for historical releases might be a problem), but it would require 
> >>> another several hundred megabytes per release on the mirrors which isn't 
> >>> exactly a trivial amount.
> >> No, it would almost double the space used by the release.  Current
> >> releases use about 12-14G of space.  Doubling that would mean reducing
> >> the amount of stuff we're allowed to distribute dramatically,
> >> essentially crippling our release capabilities.
> > 
> > Stupid question, but the master mirroring setup actually holds onto 
> > files after it moves them off of the gentoo mirror tier- purgatory 
> > dir.
> > 
> > Why not just make that dir accessible via web/torrent/whatever on 
> > a seperate server?  Abusing osprey for it is a bit much (mainly infra 
> > has asked to wipe files from the purgatory dir in the past, which is a 
> > no go), so seperate probably is wise.
> 
> No way in hell are we running such a service on the master mirror.

If you read what I said, I explicitly said do *not* run it on the 
tier/master mirror.



> I
> don't see why we need to have a public system setup as long as we can
> provide the source when asked. As far as a I know, the GPL doesn't
> dicate that we have to provide the sources in an internet media form.
> They just need to be available when requested. Perhaps we can have a
> document that explains a process for getting said sources. I don't see
> the point of creating a torrent/whatever system just for the rare
> instances that people want the older source. Way too much overhead for
> something I don't see being used much.

Files are going to have to be held onto somewhere long term- which is 
easier, flipping on lighttpd for the storage dir, or having to dick 
around with making requests of infra (waiting for them to respond), 
and requiring infra to do more work?

Upshot of my suggestion, folk have access to the purgatory dir so they 
can go digging through old files from the mirror tier as needed.

Two birds, one stone.


> > Further filtering of the files to those under gpl (pulled from pkg 
> > metadata) is doable, just would need to mangle mirror-dist a bit to 
> > maintain long term info about who owned what (instead of it's current 
> > "out of sight, out of the db" approach).
> > 
> > Just a thought- machinery is mostly there, might as well abuse it.
> 
> A lot of the stuff that's currently in the purgatory area also includes
> sources for stuff we didn't make (upstream sources, etc). If you can
> separate those files from Gentoo specific files, then it would be much
> easier to manag (from an admin point of view). Its not practical to
> assume we have an infinite amount of space.

As I said, mirror-dist would require modification- something that is a 
few hours worth of work, rather then harassing releng to hack up 
catalyst to build a src image... then harassing infra for a location 
they can upload it to, and harassing infra to push those files into an 
archival location.

End result, infra has to maintain archives.  My proposal, all infra 
has to do is flip on lighttpd somewhere, and I (or zac) do the 
mirror-dist modifications.

~harring

[-- Attachment #2: Type: application/pgp-signature, Size: 189 bytes --]

Re: [gentoo-dev] Re: Re: Re: GPL and Source code providing

[Lance Albertson]

[-- Attachment #1: Type: text/plain, Size: 4051 bytes --]

Brian Harring wrote:

>> don't see why we need to have a public system setup as long as we can
>> provide the source when asked. As far as a I know, the GPL doesn't
>> dicate that we have to provide the sources in an internet media form.
>> They just need to be available when requested. Perhaps we can have a
>> document that explains a process for getting said sources. I don't see
>> the point of creating a torrent/whatever system just for the rare
>> instances that people want the older source. Way too much overhead for
>> something I don't see being used much.
> 
> Files are going to have to be held onto somewhere long term- which is 
> easier, flipping on lighttpd for the storage dir, or having to dick 
> around with making requests of infra (waiting for them to respond), 
> and requiring infra to do more work?

Maintaining a service requires more work than just keeping it running.
You have to make sure all the components involved with the service are
running properly, all the security aspects are covered, proper DoS
control is in place, etc. Yes, from your point of view its easy, but
there's a little more involved than just putting something up.

It doesn't have to be infra that takes care of getting those files. We
could get access to a few folks if we need to but, but as stated before,
I haven't seen any request for such things ever since I've been here.

> Upshot of my suggestion, folk have access to the purgatory dir so they 
> can go digging through old files from the mirror tier as needed.

I have seen zero requests in the time I've been in Gentoo for this. I
fail to see where you think there's a sudden demand for this. I have no
problem getting these files to people. I have a problem with putting
resources into something that doesn't need that kind of resource
allocated to it based on current demand. I don't see the problem with
dealing such things on a case-by-case basis. If demand increases, then
we can change it. Since I see no demand now, this doesn't affect our
workload at all.

>> A lot of the stuff that's currently in the purgatory area also includes
>> sources for stuff we didn't make (upstream sources, etc). If you can
>> separate those files from Gentoo specific files, then it would be much
>> easier to manag (from an admin point of view). Its not practical to
>> assume we have an infinite amount of space.
> 
> As I said, mirror-dist would require modification- something that is a 
> few hours worth of work, rather then harassing releng to hack up 
> catalyst to build a src image... then harassing infra for a location 
> they can upload it to, and harassing infra to push those files into an 
> archival location.

I have no problem if we archive them somewhere. I have SAN space at one
our locations which I've started using for archival/backup purposes.
However, I wasn't intending on this machine to become a publically
accessible machine, so I would have to change things around which I
don't want to do unless its needed. I don't see the demand to warrant
such a service.

> End result, infra has to maintain archives.  My proposal, all infra 
> has to do is flip on lighttpd somewhere, and I (or zac) do the 
> mirror-dist modifications.

As stated above, not as simple as it sounds. Looks easy on paper, but
there's more involved in the backend that just flipping on an httpd. I'm
already archiving the master mirror files (including purgatory stuff)
twice a week so that aspect is already done. But as I said earlier, I
don't want this machine to become a publically accessible machine. That
wasn't my intention when I set it up. I do have some options at this
location if we need to make the files more public, but I don't see the
demand to warrant that.

-- 
Lance Albertson <ramereth@gentoo.org>
Gentoo Infrastructure | Operations Manager

---
GPG Public Key:  <http://www.ramereth.net/lance.asc>
Key fingerprint: 0423 92F3 544A 1282 5AB1  4D07 416F A15D 27F4 B742

ramereth/irc.freenode.net


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 186 bytes --]

Re: [gentoo-dev] Re: Re: Re: GPL and Source code providing

[Brian Harring]

[-- Attachment #1: Type: text/plain, Size: 4827 bytes --]

On Wed, Jul 05, 2006 at 10:04:08AM -0500, Lance Albertson wrote:
> Brian Harring wrote:
> 
> >> don't see why we need to have a public system setup as long as we can
> >> provide the source when asked. As far as a I know, the GPL doesn't
> >> dicate that we have to provide the sources in an internet media form.
> >> They just need to be available when requested. Perhaps we can have a
> >> document that explains a process for getting said sources. I don't see
> >> the point of creating a torrent/whatever system just for the rare
> >> instances that people want the older source. Way too much overhead for
> >> something I don't see being used much.
> > 
> > Files are going to have to be held onto somewhere long term- which is 
> > easier, flipping on lighttpd for the storage dir, or having to dick 
> > around with making requests of infra (waiting for them to respond), 
> > and requiring infra to do more work?
> 
> Maintaining a service requires more work than just keeping it running.
> You have to make sure all the components involved with the service are
> running properly, all the security aspects are covered, proper DoS
> control is in place, etc. Yes, from your point of view its easy, but
> there's a little more involved than just putting something up.

Not the only sysadmin around ;) I know bringing up new services can 
increase maintainence efforts, and potential for risk.

That said, y'all _should_ have a fairly vanilla base configuration 
across all servers (base kernel config, firewalling, grsec config, 
etc).  Further, y'all were running lighttpd last I knew- so y'all 
should be tracking it for securities concerns already... and this 
particular setup is pretty damn simple (no dynamic, straight 
dir_index).

So... it's not a herculean task, not something like trying to 
maintain a secured wiki.


> > Upshot of my suggestion, folk have access to the purgatory dir so they 
> > can go digging through old files from the mirror tier as needed.
> 
> I have seen zero requests in the time I've been in Gentoo for this.

Talk to web crew, stuart in particular.  Beyond them (their 
complaints/issues predate my time of managing the mirror image), folks 
_do_ screw up and needed to raid files from the mirror (lost patches 
in particular), requests I used to take care of.

Every few months is a rough rate going by memory at 8:30am.  Not huge, 
but as said, if need to provide access to gpl'd sources for bin (not 
just releng cds btw, people are forgetting we have precompiled pkgs in 
the tree also), it _is_ a potential route for handling that 
requirement while killing off another bit of manual work.


> I, fail to see where you think there's a sudden demand for this.
> I have no
> problem getting these files to people. I have a problem with putting
> resources into something that doesn't need that kind of resource
> allocated to it based on current demand. I don't see the problem with
> dealing such things on a case-by-case basis. If demand increases, then
> we can change it. Since I see no demand now, this doesn't affect our
> workload at all.

<snip>

> I have no problem if we archive them somewhere. I have SAN space at one
> our locations which I've started using for archival/backup purposes.
> However, I wasn't intending on this machine to become a publically
> accessible machine, so I would have to change things around which I
> don't want to do unless its needed. I don't see the demand to warrant
> such a service.

Am I stating there is a 'sudden demand'?  I don't see throngs of folks 
screaming for a fallback tier (am seeing people screaming for 
patches.g.o, which is inline with this), thing is y'all have to 
archive this stuff and I'm pointing out a way to make it not suck and 
provide some extra functionality with minimal cost.


> > End result, infra has to maintain archives.  My proposal, all infra 
> > has to do is flip on lighttpd somewhere, and I (or zac) do the 
> > mirror-dist modifications.
> 
> As stated above, not as simple as it sounds. Looks easy on paper, but
> there's more involved in the backend that just flipping on an httpd. I'm
> already archiving the master mirror files (including purgatory stuff)
> twice a week so that aspect is already done. But as I said earlier, I
> don't want this machine to become a publically accessible machine. That
> wasn't my intention when I set it up. I do have some options at this
> location if we need to make the files more public, but I don't see the
> demand to warrant that.

Suggest others are given time to weigh in on this rather then 
restating that you don't think there is demand for it.

Nobody yays it, hey, folks have spoken and y'all go with the same 
non public backup.
~harring

[-- Attachment #2: Type: application/pgp-signature, Size: 189 bytes --]

Re: [gentoo-dev] Re: Re: Re: GPL and Source code providing

[Lance Albertson]

[-- Attachment #1: Type: text/plain, Size: 2669 bytes --]

Brian Harring wrote:

> That said, y'all _should_ have a fairly vanilla base configuration 
> across all servers (base kernel config, firewalling, grsec config, 
> etc).  Further, y'all were running lighttpd last I knew- so y'all 
> should be tracking it for securities concerns already... and this 
> particular setup is pretty damn simple (no dynamic, straight 
> dir_index).

Nope, been talked about for the patches stuff (which is related to
this). but never have been actually implemented.

> Talk to web crew, stuart in particular.  Beyond them (their 
> complaints/issues predate my time of managing the mirror image), folks 
> _do_ screw up and needed to raid files from the mirror (lost patches 
> in particular), requests I used to take care of.
> 
> Every few months is a rough rate going by memory at 8:30am.  Not huge, 
> but as said, if need to provide access to gpl'd sources for bin (not 
> just releng cds btw, people are forgetting we have precompiled pkgs in 
> the tree also), it _is_ a potential route for handling that 
> requirement while killing off another bit of manual work.

If its that rare, it doesn't need to be a public service. We can easily
deal with those on a case by case basis. Of course, we'd need to
document this so that people know how to get it in case they want it.

> Am I stating there is a 'sudden demand'?  I don't see throngs of folks 
> screaming for a fallback tier (am seeing people screaming for 
> patches.g.o, which is inline with this), thing is y'all have to 
> archive this stuff and I'm pointing out a way to make it not suck and 
> provide some extra functionality with minimal cost.

Yes, patches.g.o (or whatever it will be called) will fix a lot of these
issues. So there's no need to go into circles for that part of it. I'm
mainly talking about the archived stuff that is old and won't be
included on the patches.g.o right off. I don't see the need to have a
public service for those old ones unless the demand is there.

> Suggest others are given time to weigh in on this rather then 
> restating that you don't think there is demand for it.
> 
> Nobody yays it, hey, folks have spoken and y'all go with the same 
> non public backup.

I agree. I'm not shutting it down, I'm just stating that I don't see the
demand for creating a service for it. Unless I'm proven wrong, I will
keep my stance on this.

-- 
Lance Albertson <ramereth@gentoo.org>
Gentoo Infrastructure | Operations Manager

---
GPG Public Key:  <http://www.ramereth.net/lance.asc>
Key fingerprint: 0423 92F3 544A 1282 5AB1  4D07 416F A15D 27F4 B742

ramereth/irc.freenode.net


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 186 bytes --]

Re: [gentoo-dev] Re: Re: Re: GPL and Source code providing

[Chris Gianelloni]

[-- Attachment #1: Type: text/plain, Size: 1078 bytes --]

On Wed, 2006-07-05 at 08:51 -0700, Brian Harring wrote:
> Every few months is a rough rate going by memory at 8:30am.  Not huge, 
> but as said, if need to provide access to gpl'd sources for bin (not 
> just releng cds btw, people are forgetting we have precompiled pkgs in 
> the tree also), it _is_ a potential route for handling that 
> requirement while killing off another bit of manual work.

How many of those -bin packages are GPL?  I'm sure there's a few, but I
can't think of a single one.

Also, we don't have pre-compiled packages in the tree.  We have ebuilds
that pull down pre-compiled packages.  That's easily fixable with a
RESTRICT=mirror for the few that are GPL and binary.

...and then I decided to actually look at the one package that I thought
about, and it's mplayer-bin, though we do provide those sources, since
it is just the mplayer ebuild compiled, and we have the sources for the
source-based ebuild already.

-- 
Chris Gianelloni
Release Engineering - Strategic Lead
x86 Architecture Team
Games - Developer
Gentoo Linux

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

[gentoo-dev] Re: Re: Re: Re: GPL and Source code providing

[Duncan]

Chris Gianelloni <wolf31o2@gentoo.org> posted
1152131291.21775.77.camel@cgianelloni.nuvox.net, excerpted below, on  Wed,
05 Jul 2006 16:28:10 -0400:

> On Wed, 2006-07-05 at 08:51 -0700, Brian Harring wrote:
>> Every few months is a rough rate going by memory at 8:30am.  Not huge,
>> but as said, if need to provide access to gpl'd sources for bin (not
>> just releng cds btw, people are forgetting we have precompiled pkgs in
>> the tree also), it _is_ a potential route for handling that requirement
>> while killing off another bit of manual work.
> 
> How many of those -bin packages are GPL?  I'm sure there's a few, but I
> can't think of a single one.
> 
> Also, we don't have pre-compiled packages in the tree.  We have ebuilds
> that pull down pre-compiled packages.  That's easily fixable with a
> RESTRICT=mirror for the few that are GPL and binary.
> 
> ...and then I decided to actually look at the one package that I thought
> about, and it's mplayer-bin, though we do provide those sources, since it
> is just the mplayer ebuild compiled, and we have the sources for the
> source-based ebuild already.

The thing is, for precompiled tree stuff, if it's GPL, we already have
sources, and the sources version and bin version should come and go from
the tree more or less together.  As long as it's "more" (or should I say
"most" =8^) , having them both in the tree together pretty much directly
satisfies condition 3a -- which doesn't require holding onto them for
three years after the binary ceases to be distributed, unlike 3b,
on-request.

BTW, that's the potential down side to the CD/DVD of sources on request
idea, too.  That means sources must be available for three years /after/
the binaries are no longer distributed.  If sources are made available
with the binaries, they can cease to be made available with them.  If
sources are only available on request, they must be made available on
request for three years.  Do we want that three-year obligation and is it
worth that to make it on-request vs having them available at the same
time?  I don't know, but it needs to be considered.

An example tree package would be grub-static.  A number of the
emul-linux-x86-* packages are also GPL, including at least baselibs,
qtlibs, compat, sdl.

Also, the amd64 project distributed was it binary gcc or glibc or both at
least for some of their historic profile changes, to help with the
multilib conversion.  Now, being historic those may be a lost cause, but
something similar may happen in the future.  glibc is  lgpl not gpl but
does the lgpl have similar conditions.  In any event, gcc does as it's
dual licensed, but according to the ebuilds we are distributing it under
both licenses, so the gpl conditions would apply.  Whether other dual
bitness archs have done similar or whether this applies to only amd64, I
don't know.



-- 
Duncan - List replies preferred.   No HTML msgs.
"Every nonfree program has a lord, a master --
and if you use the program, he is your master."  Richard Stallman

-- 
gentoo-dev@gentoo.org mailing list

Re: [gentoo-dev] Re: Re: Re: Re: GPL and Source code providing

[Chris Gianelloni]

[-- Attachment #1: Type: text/plain, Size: 545 bytes --]

On Wed, 2006-07-05 at 23:01 +0000, Duncan wrote:
> request for three years.  Do we want that three-year obligation and is it
> worth that to make it on-request vs having them available at the same
> time?  I don't know, but it needs to be considered.

Not really.  There is 0 overhead to *leaving* a source DVD set on the
store indefinitely.  It is only the creation that requires work.  Once
it is there, it's there.

-- 
Chris Gianelloni
Release Engineering - Strategic Lead
x86 Architecture Team
Games - Developer
Gentoo Linux

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

Re: [gentoo-dev] Re: Re: Re: Re: GPL and Source code providing

[Michael Cummings]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Chris Gianelloni wrote:
> Not really.  There is 0 overhead to *leaving* a source DVD set on the
> store indefinitely.  It is only the creation that requires work.  Once
> it is there, it's there.
> 

Probably too off the wall and simpleton for the "problem" - but what if
the install docs included something like:

"
To obtain the sources for your new install, please use:

emerge -fDN world

to download all of the sources used to build your stage3  install.
"

(the presumption being after the unrolling of stage3, they would have to
get the sources anyway to proceed forward, so this would fill the
initial gap...or am I missing something more critical?)


- --

- -----o()o----------------------------------------------
Michael Cummings   |    #gentoo-dev, #gentoo-perl
Gentoo Perl Dev    |    on irc.freenode.net
Gentoo/SPARC
Gentoo/AMD64
GPG: 0543 6FA3 5F82 3A76 3BF7  8323 AB5C ED4E 9E7F 4E2E
- -----o()o----------------------------------------------
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.3 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFErWEuq1ztTp5/Ti4RApD4AJwJWWjjsC+VFQu6Ymb0AB73OjSt4gCfR0Cn
H4AczL0jjHozbgGlnJf9Ljo=
=CS7S
-----END PGP SIGNATURE-----
-- 
gentoo-dev@gentoo.org mailing list

Re: [gentoo-dev] Re: Re: Re: Re: GPL and Source code providing

[Chris Gianelloni]

[-- Attachment #1: Type: text/plain, Size: 1329 bytes --]

On Thu, 2006-07-06 at 15:14 -0400, Michael Cummings wrote:
> Probably too off the wall and simpleton for the "problem" - but what if
> the install docs included something like:
> 
> "
> To obtain the sources for your new install, please use:
> 
> emerge -fDN world
> 
> to download all of the sources used to build your stage3  install.
> "
> 
> (the presumption being after the unrolling of stage3, they would have to
> get the sources anyway to proceed forward, so this would fill the
> initial gap...or am I missing something more critical?)

Well, it would need to be -efDN, but that doesn't take into account what
happens when someone uses a tarball from 2 releases ago that is still on
our mirrors, but the packages haven't been in the tree (and therefore
not on our mirrors) for months.  For the most part, it would work,
provided upstream kept copies of their older sources, but there would
still be source lost, like patches in ${FILESDIR}.  This only works so
long as we have everything either in the tree or on our infrastructure.

A burned DVD, however, will always have the old stuff there, no matter
what happens in the tree.

It really is the simplest method for us.

-- 
Chris Gianelloni
Release Engineering - Strategic Lead
x86 Architecture Team
Games - Developer
Gentoo Linux

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

Re: [gentoo-dev] Re: Re: Re: GPL and Source code providing

[Chris Gianelloni]

[-- Attachment #1: Type: text/plain, Size: 1534 bytes --]

On Wed, 2006-07-05 at 09:00 -0400, Chris Gianelloni wrote:
> On Tue, 2006-07-04 at 18:34 +0300, Marius Mauch wrote:
> > Patrick McLean schrieb:
> > > I have absolutely zero experience with catalyst, but couldn't it be made
> > > to create a source CD ISO when it is generating the binary one? Just
> > > make a cd with all the distfiles used in the ISO, and keep the source
> > > ISO with the binary one in /historical.
> > 
> > Creating an ISO isn't a problem (assuming you have the sources, which 
> > for historical releases might be a problem), but it would require 
> > another several hundred megabytes per release on the mirrors which isn't 
> > exactly a trivial amount.
> 
> No, it would almost double the space used by the release.  Current
> releases use about 12-14G of space.  Doubling that would mean reducing
> the amount of stuff we're allowed to distribute dramatically,
> essentially crippling our release capabilities.

Actually, I've gone back and estimated this based on what information I
have from the release, and I came up with something more like 8G for
2006.0, though we already have some things that are "lost" from that
release.

Anyway, I really am starting to like the DVD available via the store
idea more and more, as it only means Release Engineering needs to do a
little extra work, and it requires no extra work for our mirrors or
Infrastructure team.

-- 
Chris Gianelloni
Release Engineering - Strategic Lead
x86 Architecture Team
Games - Developer
Gentoo Linux

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

Re: [gentoo-dev] Re: Re: Re: GPL and Source code providing

[Patrick McLean]

Chris Gianelloni wrote:
> 
> Anyway, I really am starting to like the DVD available via the store
> idea more and more, as it only means Release Engineering needs to do a
> little extra work, and it requires no extra work for our mirrors or
> Infrastructure team.
> 

The source DVD sounds like a great idea to me, no need to keep anything
around on mirrors, and we fulfill all the requirements of the GPL.

-- 
gentoo-dev@gentoo.org mailing list

[gentoo-dev] Re: Re: Re: Re: GPL and Source code providing

[Duncan]

Patrick McLean <chutzpah@gentoo.org> posted 44ABD109.2020200@gentoo.org,
excerpted below, on  Wed, 05 Jul 2006 10:47:37 -0400:

> The source DVD sounds like a great idea to me, no need to keep anything
> around on mirrors, and we fulfill all the requirements of the GPL.

+1

-- 
Duncan - List replies preferred.   No HTML msgs.
"Every nonfree program has a lord, a master --
and if you use the program, he is your master."  Richard Stallman

-- 
gentoo-dev@gentoo.org mailing list

Re: [gentoo-dev] Re: Re: Re: GPL and Source code providing

[Curtis Napier]

[-- Attachment #1: Type: text/plain, Size: 855 bytes --]

Chris Gianelloni wrote:
> On Wed, 2006-07-05 at 09:00 -0400, Chris Gianelloni wrote:

[snip]

> 
> Anyway, I really am starting to like the DVD available via the store
> idea more and more, as it only means Release Engineering needs to do a
> little extra work, and it requires no extra work for our mirrors or
> Infrastructure team.
> 

I like this idea as well, especially since it means less work. You
mentioned in a previous mail charging only what it cost us to make. If
it's decided to go with this idea I think we should mark it up a little,
even if it's only a dollar or two. People actually don't mind paying a
little if it's going to go towards helping Gentoo. We get tons of
threads asking about donating in the forums so this would be a good way
to help with that (even if the DVD isn't purchased very often).

--Curtis


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 191 bytes --]

Re: [gentoo-dev] Re: Re: Re: GPL and Source code providing

[Jakub Moc]

[-- Attachment #1: Type: text/plain, Size: 1139 bytes --]

Curtis Napier wrote:
> If it's decided to go with this idea I think we should mark it up a little,
> even if it's only a dollar or two. People actually don't mind paying a
> little if it's going to go towards helping Gentoo. We get tons of
> threads asking about donating in the forums so this would be a good way
> to help with that (even if the DVD isn't purchased very often).
> 
> --Curtis
> 

You can't do that according to GPL-2, see esp. the >>> <<< part:


3.  b) Accompany it with a written offer, valid for at least three
    years, to give any third party, for a charge >>> no more than your
    cost of physically performing source distribution <<<, a complete
    machine-readable copy of the corresponding source code, to be
    distributed under the terms of Sections 1 and 2 above on a medium
    customarily used for software interchange; or,


-- 
Best regards,

 Jakub Moc
 mailto:jakub@gentoo.org
 GPG signature:
 http://subkeys.pgp.net:11371/pks/lookup?op=get&search=0xCEBA3D9E
 Primary key fingerprint: D2D7 933C 9BA1 C95B 2C95  B30F 8717 D5FD CEBA 3D9E

 ... still no signature   ;)


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

Re: [gentoo-dev] Re: Re: Re: GPL and Source code providing

[Mike Doty]

Jakub Moc wrote:
[snip]

> 3.  b) Accompany it with a written offer, valid for at least three
>     years, to give any third party, for a charge >>> no more than your
>     cost of physically performing source distribution <<<, a complete
>     machine-readable copy of the corresponding source code, to be
>     distributed under the terms of Sections 1 and 2 above on a medium
>     customarily used for software interchange; or,
> 
> 

so make it $N or more.;  problem solved.
-- 
gentoo-dev@gentoo.org mailing list

Re: [gentoo-dev] Re: Re: Re: GPL and Source code providing

[Joshua Jackson]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Jakub Moc wrote:
> Curtis Napier wrote:
>> If it's decided to go with this idea I think we should mark it up
>> a little, even if it's only a dollar or two. People actually
>> don't mind paying a little if it's going to go towards helping
>> Gentoo. We get tons of threads asking about donating in the
>> forums so this would be a good way to help with that (even if the
>> DVD isn't purchased very often).
>>
>> --Curtis
>>
>
> You can't do that according to GPL-2, see esp. the >>> <<< part:
>
>
> 3.  b) Accompany it with a written offer, valid for at least three
> years, to give any third party, for a charge >>> no more than your
> cost of physically performing source distribution <<<, a complete
> machine-readable copy of the corresponding source code, to be
> distributed under the terms of Sections 1 and 2 above on a medium
> customarily used for software interchange; or,
>
>
manpower cost? *nudge* however it'd be good to keep it low low low..
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.3 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFEq/fbSENan+PfizARAtFuAJ9GjWOU/kZ4QsgFkx//RGIuctfo3ACfXY9v
rU2VwLX8uRQyc+hWN0i8N28=
=Zwc2
-----END PGP SIGNATURE-----

-- 
gentoo-dev@gentoo.org mailing list

Re: [gentoo-dev] Re: Re: Re: GPL and Source code providing

[Chris Gianelloni]

[-- Attachment #1: Type: text/plain, Size: 1467 bytes --]

On Wed, 2006-07-05 at 13:04 -0400, Curtis Napier wrote:
> Chris Gianelloni wrote:
> > On Wed, 2006-07-05 at 09:00 -0400, Chris Gianelloni wrote:
> 
> [snip]
> 
> > 
> > Anyway, I really am starting to like the DVD available via the store
> > idea more and more, as it only means Release Engineering needs to do a
> > little extra work, and it requires no extra work for our mirrors or
> > Infrastructure team.
> > 
> 
> I like this idea as well, especially since it means less work. You
> mentioned in a previous mail charging only what it cost us to make. If
> it's decided to go with this idea I think we should mark it up a little,
> even if it's only a dollar or two. People actually don't mind paying a
> little if it's going to go towards helping Gentoo. We get tons of
> threads asking about donating in the forums so this would be a good way
> to help with that (even if the DVD isn't purchased very often).

No, if they want to contribute, they can buy the release stuff.  The
reason for not marking up the source DVD would be the GPL pretty much
says that you can charge a reasonable amount for the work required
(media/shipping) to get them the sources.  That amount would be the base
price from Cafepress.

Also, as much as those "threads" claim people are willing to pay, actual
store sales beg to differ.

-- 
Chris Gianelloni
Release Engineering - Strategic Lead
x86 Architecture Team
Games - Developer
Gentoo Linux

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

Re: [gentoo-dev] Re: Re: Re: GPL and Source code providing

[Nick Devito]

It would *probably* be easier to take the /usr/portage/distfiles
directory and pop that on a CD, or, have the option of putting those
files in a directory on the livecd. It shouldn't be too hard to do,
however, it would take up more space on the CD. 
On Tue, 2006-07-04 at 11:59 -0400, Patrick McLean wrote:
> Chris Gianelloni wrote:
> > On Sat, 2006-07-01 at 11:12 +0000, Duncan wrote:
> >>> For example, if we hand out CDs at conventions etc, we would have to
> >>> also hand out source CDs.
> > 
> >> As my reply there, however, Gentoo does still have it better than most, in
> >> that the LiveCDs contain relatively few binaries, and they tend to be
> >> relatively core packages to which sources should still be available even
> >> for historic releases, should we wish to continue distributing the
> >> historical LiveCDs. The packages CDs OTOH...
> > 
> > Umm... The LiveCD has almost 700 packages on it.  Perhaps you mean the
> > InstallCD?
> > 
> 
> I have absolutely zero experience with catalyst, but couldn't it be made
> to create a source CD ISO when it is generating the binary one? Just
> make a cd with all the distfiles used in the ISO, and keep the source
> ISO with the binary one in /historical.
-- 
gentoo-dev@gentoo.org mailing list

Re: [gentoo-dev] Re: Re: Re: GPL and Source code providing

[Chris Gianelloni]

[-- Attachment #1: Type: text/plain, Size: 1170 bytes --]

On Tue, 2006-07-04 at 11:59 -0400, Patrick McLean wrote:
> Chris Gianelloni wrote:
> > On Sat, 2006-07-01 at 11:12 +0000, Duncan wrote:
> >>> For example, if we hand out CDs at conventions etc, we would have to
> >>> also hand out source CDs.
> > 
> >> As my reply there, however, Gentoo does still have it better than most, in
> >> that the LiveCDs contain relatively few binaries, and they tend to be
> >> relatively core packages to which sources should still be available even
> >> for historic releases, should we wish to continue distributing the
> >> historical LiveCDs. The packages CDs OTOH...
> > 
> > Umm... The LiveCD has almost 700 packages on it.  Perhaps you mean the
> > InstallCD?
> > 
> 
> I have absolutely zero experience with catalyst, but couldn't it be made
> to create a source CD ISO when it is generating the binary one? Just
> make a cd with all the distfiles used in the ISO, and keep the source
> ISO with the binary one in /historical.

Sure it could.  Feel free to submit a patch to make it do so.

-- 
Chris Gianelloni
Release Engineering - Strategic Lead
x86 Architecture Team
Games - Developer
Gentoo Linux

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

Re: [gentoo-dev] Re: Re: Re: GPL and Source code providing

[Enrico Weigelt]

* Duncan <1i5t5.duncan@cox.net> schrieb:

Hi,


> As my reply there, however, Gentoo does still have it better than most, in
> that the LiveCDs contain relatively few binaries, and they tend to be
> relatively core packages to which sources should still be available even
> for historic releases, should we wish to continue distributing the
> historical LiveCDs. The packages CDs OTOH...

As you probably noticed, I'm running an source database, which contains
URLs of all any package already indexed, and I'm going to add regular
tests for dead urls. For some packages, I'm working on by myself, I've
got mirrors.

If you like to get an (historical) mirror of some packages / releases,
please join our project, and we'll set it up.


cu
-- 
---------------------------------------------------------------------
 Enrico Weigelt    ==   metux IT service

  phone:     +49 36207 519931         www:       http://www.metux.de/
  fax:       +49 36207 519932         email:     contact@metux.de
  cellphone: +49 174 7066481
---------------------------------------------------------------------
-- 
gentoo-dev@gentoo.org mailing list

[gentoo-dev] Re: Re: GPL and Source code providing

[Duncan]

Mivz <mivz@alpha.spugium.net> posted 44A2A093.8060205@alpha.spugium.net,
excerpted below, on  Wed, 28 Jun 2006 17:30:27 +0200:

> Wiktor Wandachowicz wrote:
>> I mean, if someone is able to create its own web page and put a binary
>> download(s) of its work, then how hard is it to comply with the GPL
>> license and just put some more links to the source code?
>> It's like the (old?/new?) Decalogue: "You shall not steal".
>> 
> 
> But if your modification is on top of the Gentoo system and your build
> your own Live cd, like Kororaa, do you have to provide all the sources
> of all the program's on the live cd?

IANAL but from what I've read (and my read of the GPL v2 anyway), the
simplest way to think of it is that if you distribute binaries, you must
be able to provide source for them.  If you aren't providing the binaries,
you don't have to worry about source.

That means with a LiveCD, presumably including at least a significant
handful of binaries, you'll have to provide source for at least those
binaries, not just what you may have modified.  (This is in agreement with
the FSF and what Ciaran says below, tho it conflicts with Chris G's
statement on the subject.)  The reason you have to provide source for
other than your own work is so that the end-user is guaranteed his four
freedoms rights to use, examine, modify, and distribute the programs you
provided, even if /your/ upstream goes away.  IOW, you wouldn't be
released from the responsibility of providing sources just because Gentoo
disappeared, so to ensure that you can do so, you must make your own
arrangements to provide the sources for any GPLed binaries you distributed.

The section of the GPL (v2) that deals with this section 3 (section 6 of
the GPL v3 draft, which is similar but specifies in a bit more detail the
responsibilities of downstream redistributors).  There are three clauses,
any of which will fulfill your obligations as a distributor under the GPL:

<quote>

    a) Accompany it with the complete corresponding machine-readable
    source code, which must be distributed under the terms of Sections
    1 and 2 above on a medium customarily used for software interchange; or,

    b) Accompany it with a written offer, valid for at least three
    years, to give any third party, for a charge no more than your
    cost of physically performing source distribution, a complete
    machine-readable copy of the corresponding source code, to be
    distributed under the terms of Sections 1 and 2 above on a medium
    customarily used for software interchange; or,

    c) Accompany it with the information you received as to the offer
    to distribute corresponding source code.  (This alternative is
    allowed only for noncommercial distribution and only if you
    received the program in object code or executable form with such
    an offer, in accord with Subsection b above.)

</quote>

A couple things to note about those clauses:

1) Clause B's 3-year minimum doesn't apply to clause A.  Many downstream
distributors prefer it for this reason -- their obligation to provide
source for any particular version disappears when they quit distributing
the binaries created from it, no having to keep it around for three more
years.

2) Clause C depends on your upstream using clause B.  Since most major
distributions now use clause A, and are thus not subject to the three-year
minimum, it's quite possible their sources will no longer be available
for the period you are redistributing.  (This is certainly true for
Gentoo, AFAIK, where the source mirrors aren't likely to be carrying the
sources much past the point when the ebuild is no longer in the Gentoo
tree.  Also note that to provide proper sources for a Gentoo based binary,
you'd have to provide any Gentoo patches as well, so simply relying on the
sources mirrors won't suffice!)

That said, it's not really the big deal that it's being made out to be,
for a couple reasons:

1)  The BIG reason -- The GPL is based and draws its authority from
copyright law.  End users have no way to enforce their demands for source,
no matter /what/ the GPL says -- ONLY the holders of the copyrights on the
original programs do.  If all you do is make a couple copies for your
friends and relatives (Grandma), and they don't care about sources, no
problem!  Even if you distribute publicly, unless a copyright holder
demands that  you honor the GPL, there isn't much anyone else can do. 
It's the copyright holder's program, not the end user's program.

Do note however that in many cases, the kernel being a huge example, there
may be many copyright holders, any of which can demand action.

The reason the current story is making news is that apparently, the Mepis
author has a history of not being very forthcoming with sources where the
GPL requires they be available, and more importantly, the FSF, owner of
the copyrights of much of the core GNU/Linux software (anything with GNU
in the name, AFAIK, so the GNU Coreutils and GCC aka GNU Compiler
Collection, among others, plus glibc, the g for GNU, without which
virtually anything Linux would work, altho it's LGPL not GPL), is the one
making the request, and they very much DO have the legal authority to
demand the guy comply with the GPL on the stuff of theirs he distributes.

2) Keeping straight with the GPL isn't actually that bad anyway.  That's
ESPECIALLY the case with Gentoo based binaries, since they are normally
built from sources all the way out at the user machine, so you, being that
user, already HAVE those sources -- all you have to do is manage them. 
Where a user of a binary-based distribution would have to specifically go
to the trouble of collecting the sources for stuff they don't modify, as a
separate task from collecting the binaries, Gentoo users will normally
already have those sources close at hand.

Even discounting clause C above (which again isn't of much use unless
your upstream uses clause B, Gentoo doesn't, nor do most major
distributions), it's still relatively easy to supply sources in compliance
with the GPL.  The biggest choice you have to make is whether you want to
supply only those who ask, therefore far fewer, but have to do it for
three full years (clause B) or whether that three years is a worse problem
than just making sure you have both available at the same time and in a
similar way (clause A).

For clause A, if you are already supplying the binaries (a LiveCD say),
just supply a way to get the sources at the same time if desired.  Online,
this means putting a link to the sources right next to the link to the
LiveCD ISO or other binaries.  At a conference, it can be having your
laptop with the sources with you, and a sign instructing those who want
sources to ask, you'll be happy to burn a CD for them right there, for a
couple bucks or whatever.  (The physical cost.  For a couple bucks I doubt
many will quibble, but while I've seen several say labor can be included,
I'm not sure on that, so best to check before you try it.)  The important
thing to note here is that because you are offering the two at the same
time, clause A, the 3-year minimum of clause B doesn't apply so you don't
have to worry about sources as soon as you quit offering the binaries.

For clause B, many people simply tarball their sources at the same time
they create their binaries, then file them away in case they get a
request.  The LiveCD should then include a README or the like with your
email and/or snail-mail address, and instructions to contact you for the
sources, which you will be happy to provide upon request and submission of
the fee if you decide to charge one.  If you charge even a small fee (say
$5), covering your physical costs including postage and media (again, I'm
not sure if reasonable labor is allowed, I think it is but don't know),
that will discourage most, while fulfilling the GPL for those that do have
a want/need for the sources.  Note that use of a VCS, which many
distributing anything modified will be using already, should make managing
a request for sources for a 2-year-11-month-29-day old release almost as
easy as managing a request for current sources.  As you are allowed to
charge a fee based on what it costs you, and with a fee discouraging those
who don't have a good need for it, it shouldn't be a big problem, provided
only that you've properly managed the sources at the time of the release
in the first place, which is only good practice anyway, the better to
trace and solve bugs and the like.  With clause B, complying with the  GPL
requires that you honor source requests for three years, but with an
appropriate fee and proper release time source management, it won't be
overwhelming.

Now, tying up a couple loose ends...

One solution that has been suggested for small distributors is that they
team up for providing sources.  There's nothing saying you can't
subcontract out your responsibility to provide sources, and it's a
reasonable solution.  In fact, that seems it could be a bit of a business
opportunity, providing that service.  Distributors could be charged a
small annual fee for service maintenance, plus bandwidth charges, similar
to how web or other server hosting solutions work.

As mentioned, the GPL v3 draft is similar but somewhat different in the
details.  AFAIK, it now allows a fee up to 10 times the physical cost of
provision of the source, rather than the strictly at-cost requirement of
v2.  If labor is included, that could easily reach $1000, which would
certainly discourage the trivial requests.  OTOH, the draft GPLv3 is
somewhat stricter on the responsibilities of downstream redistributors,
requiring them to provide sources independent of upstream where they may
have gotten away with a simple pointer to the upstream sources previously.
Apparently, there have been a couple cases where sources ceased to be
available at all after upstream ceased to provide them and downstream had
no copies, thus both the stricter wording in GPLv3 and the more active
enforcement by the FSF of the existing GPLv2 where it has copyright
standing to do so, as in the current case in the headlines, Mepis. 
However, the 10-times-cost allowance in GPLv3 should more than offset the
additional responsibilities, allowing one to make it worth their while to
provide those sources.

Finally, don't forget that the GPL isn't the only license out there. 
As the differences between the GPLv2 and (draft) GPLv3 illustrate,
complying with one license doesn't mean you've complied with all of them,
in terms of fulfilling your legal obligations as one who has chosen to
distribute the copyrighted works of another, FLOSS (Free/Libra and Open
Source Software) or not.  It's really a big responsibility to be
distributing the works of another; significantly more so if you are
distributing the works of many, under a number of different licenses, as
is the case with any distribution or LiveCD Linux, even a small one.

-- 
Duncan - List replies preferred.   No HTML msgs.
"Every nonfree program has a lord, a master --
and if you use the program, he is your master."  Richard Stallman

-- 
gentoo-dev@gentoo.org mailing list