A small public repo of compiled AUR packages reminded me of something.
What's the official policy for providing source code for GPL'd binary packages in [community]? I know there was a long discussion about this with some phraknagging eventually leading to a source "repository" for core and maybe extra. Although it would most likely never happen it is possible for someone to show up after nearly 3 years and request a previous package's source code.
I suppose that previously the devs could argue that [community] was "not official" and relegate all obligations to the packagers (although only tentatively). Now that [community] is integrated more tightly with [core] and [extra] it seems that this is something at least worth a discussion.
How are sources for [core] and [extra] handled? How is the user actually informed of their availability? Are those source archives mirrored or only hosted on the main server? Is this all irrelevant due to some misunderstanding of the GPL's clauses? How much storage space would it take to hose source files for all current packages that require them (e.g. GPL'd binary apps)?
Xyne
On Sun, Aug 23, 2009 at 8:34 PM, Xynexyne@archlinux.ca wrote:
A small public repo of compiled AUR packages reminded me of something.
What's the official policy for providing source code for GPL'd binary packages in [community]? I know there was a long discussion about this with some phraknagging eventually leading to a source "repository" for core and maybe extra. Although it would most likely never happen it is possible for someone to show up after nearly 3 years and request a previous package's source code.
I suppose that previously the devs could argue that [community] was "not official" and relegate all obligations to the packagers (although only tentatively). Now that [community] is integrated more tightly with [core] and [extra] it seems that this is something at least worth a discussion.
We will definitely create sourceballs for (L)GPL2 community packages. We were waiting for the svn switch for the community repo because the sourceball script is using svn to get package information. The community repo support was added in the dbscripts git. We just need to update the dbscripts on the server. Meanwhile, TU should check that their package have the license specified.
How are sources for [core] and [extra] handled? How is the user actually informed of their availability? Are those source archives mirrored or only hosted on the main server? Is this all irrelevant due to some misunderstanding of the GPL's clauses? How much storage space would it take to hose source files for all current packages that require them (e.g. GPL'd binary apps)?
We host sourceballs of the (L)GPL2 (and custom license that requires it) packages that are currently in the core/extra/testing repo. Users can get them here: ftp://ftp.archlinux.org/sources/ I believe mirrors can sync them at their option so your mirror might have them as well. IIRC, technically they should also host the sources but we are not enforcing it. When a package is updated, the old source is removed and replaced by the newer one. They currently take 20GB of disk space. That will probably increase of several GB once we do it for the community repo. I hope I answered all your questions.
Eric
On Sun, Aug 23, 2009 at 9:15 PM, Eric Bélangersnowmaniscool@gmail.com wrote:
On Sun, Aug 23, 2009 at 8:34 PM, Xynexyne@archlinux.ca wrote:
A small public repo of compiled AUR packages reminded me of something.
What's the official policy for providing source code for GPL'd binary packages in [community]? I know there was a long discussion about this with some phraknagging eventually leading to a source "repository" for core and maybe extra. Although it would most likely never happen it is possible for someone to show up after nearly 3 years and request a previous package's source code.
I suppose that previously the devs could argue that [community] was "not official" and relegate all obligations to the packagers (although only tentatively). Now that [community] is integrated more tightly with [core] and [extra] it seems that this is something at least worth a discussion.
We will definitely create sourceballs for (L)GPL2 community packages. We were waiting for the svn switch for the community repo because the sourceball script is using svn to get package information. The community repo support was added in the dbscripts git. We just need to update the dbscripts on the server. Meanwhile, TU should check that their package have the license specified.
I forgot some useful links.
Current community packages with missing licenses : http://wiki.archlinux.org/index.php/User:Snowman/License_Rebuild_TODO
As some of this stuff haven't been rebuilt in a while, other things that might need to be fixed: http://wiki.archlinux.org/index.php/User:Snowman/License_Rebuild_Checklist
On Mon, 24 Aug 2009 01:44:58 -0400 Eric Bélanger snowmaniscool@gmail.com wrote:
On Sun, Aug 23, 2009 at 9:15 PM, Eric Bélangersnowmaniscool@gmail.com wrote:
On Sun, Aug 23, 2009 at 8:34 PM, Xynexyne@archlinux.ca wrote:
A small public repo of compiled AUR packages reminded me of something.
What's the official policy for providing source code for GPL'd binary packages in [community]? I know there was a long discussion about this with some phraknagging eventually leading to a source "repository" for core and maybe extra. Although it would most likely never happen it is possible for someone to show up after nearly 3 years and request a previous package's source code.
I suppose that previously the devs could argue that [community] was "not official" and relegate all obligations to the packagers (although only tentatively). Now that [community] is integrated more tightly with [core] and [extra] it seems that this is something at least worth a discussion.
We will definitely create sourceballs for (L)GPL2 community packages. We were waiting for the svn switch for the community repo because the sourceball script is using svn to get package information. The community repo support was added in the dbscripts git. We just need to update the dbscripts on the server. Meanwhile, TU should check that their package have the license specified.
I forgot some useful links.
Current community packages with missing licenses : http://wiki.archlinux.org/index.php/User:Snowman/License_Rebuild_TODO
As some of this stuff haven't been rebuilt in a while, other things that might need to be fixed: http://wiki.archlinux.org/index.php/User:Snowman/License_Rebuild_Checklist
Thanks for the reply.
aur-general@lists.archlinux.org