Hi all, I'm not sure if this is the right place to address this issue; as far as I'm aware, there is no Arch mailing list or forum for legal matters. What I'd like to discuss is the (unnecessary?) legal risk that mirror operators are exposed to when they don't mirror source packages. I believe that most mirrors are violating article 6 of the GPLv3 (or article 3 of the GPLv2). My reasoning goes like this: - The Arch repositories contain some software that is released under the GPL (or GPL-like) license. - Anyone distributing GPL-licensed software in compiled form is obligated to distribute the source code as well, either alongside the compiled software or, when accompanied by a 'written offer', on request at a later date. (there are a few more ways under the GPLv3 but I don't think they apply) - Few mirrors provide source packages, and as far as I'm aware, there are no mirrors out there that accompany the compiled software with a written offer. - Ergo, most Arch mirrors are violating the GPL. Note that I am by no means a GPL expert. Maybe I'm making some false assumption or other error in my reasoning, in which case, please feel free to point that out. I noticed that the ArchWiki considers mirroring sources optional [1], making it seem like the author of that article encourages violating the GPL in order to save some bandwidth and a bit of disk space. That article also mentions that the size of the 'sources' component was about 50 GiB in March 2018. I can't imagine it being significantly larger by now. [1] https://wiki.archlinux.org/title/DeveloperWiki:NewMirrors#Mirror_size I've been looking for old discussions on this topic and only found a short mention in this forum thread: https://bbs.archlinux.org/viewtopic.php?pid=1778318#p1778318 I'd love to hear your thoughts on this. Imre