Hi all,

I'm not sure if this is the right place to address this issue; as far
as I'm aware, there is no Arch mailing list or forum for legal matters.
What I'd like to discuss is the (unnecessary?) legal risk that mirror
operators are exposed to when they don't mirror source packages.

I believe that most mirrors are violating article 6 of the GPLv3 (or
article 3 of the GPLv2). My reasoning goes like this:

- The Arch repositories contain some software that is released under the
  GPL (or GPL-like) license.
- Anyone distributing GPL-licensed software in compiled form is
  obligated to distribute the source code as well, either alongside the
  compiled software or, when accompanied by a 'written offer', on
  request at a later date. (there are a few more ways under the GPLv3
  but I don't think they apply)
- Few mirrors provide source packages, and as far as I'm aware, there
  are no mirrors out there that accompany the compiled software with a
  written offer.
- Ergo, most Arch mirrors are violating the GPL.

Note that I am by no means a GPL expert. Maybe I'm making some false
assumption or other error in my reasoning, in which case, please feel
free to point that out.

I noticed that the ArchWiki considers mirroring sources optional [1],
making it seem like the author of that article encourages violating the
GPL in order to save some bandwidth and a bit of disk space. That
article also mentions that the size of the 'sources' component was
about 50 GiB in March 2018. I can't imagine it being significantly
larger by now.

[1]
https://wiki.archlinux.org/title/DeveloperWiki:NewMirrors#Mirror_size

I've been looking for old discussions on this topic and only found a
short mention in this forum thread:
https://bbs.archlinux.org/viewtopic.php?pid=1778318#p1778318

I'd love to hear your thoughts on this.

Imre