Re: [gentoo-dev] CAcert certificate distribution license to third parties (i.e. distributors like gentoo)

[Richard Freeman <rich0@gentoo.org>]

On 12/15/2009 01:46 AM, Daniel Black wrote:
> I did email the debian maintainer too. no response yet. They have interactive
> builds though and I guess we do too now. Will be a royal pain if every
> CA/software did the same thing.
>

The last thing gentoo needs is interactive builds.  XFree86 was forked 
over something less annoying than that (advertising clause)...

I'd rather put a disclaimer in the handbook that when you install gentoo 
you bear the consequences of anything you do with it: if you're in a 
jurisdiction where software licenses are binding on those who use 
software then be sure to set ACCEPT_LICENSE accordingly, and all users 
should monitor the outputs of their builds for important notices.

On that note, perhaps the default make.conf should send ELOGs to 
root@localhost or something?  People can disable it if they don't like 
it, but I don't think we want our default to be that important notices 
are lost.

If legal experts feel that the only thing that will work would be an 
interactive build, then we should:

1.  Have the build by default terminate with an error that it requires 
some kind of acknowledgment.  Ideally have the package manager detect 
this condition at --pretend time.
2.  Have the user set this acknowledgment using an environment variable 
in make.conf (perhaps a setting for these purposes), or a local use 
flag, or some other one-time non-interactive mechanism.
3.  Have the build notice this and proceed normally (so the actual build 
and future upgrades are non-interactive).

4.  Ensure that this package is NOT required by anything in system, or 
installed by default by any major popular package (so maybe we have 
ca-certificates, and ca-certificates-annoying or something).

We definitely don't want the gentoo experience to be one of typing 
emerge world and then having to check back on it every three minutes to 
see what the latest prompt is.

I'm generally in favor of including CACert by default, but if they're 
going to shoot themselves in the foot over licensing then that is their 
loss.  I already have to install it manually for chromium (a real pita, 
btw).  I can't see the council voting to allow interactive builds for a 
certificate, and I really don't see why CACert is pushing this either...