[arch-dev-public] GPL Compliance: A beginning
aaronmgriffin at gmail.com
Fri May 23 13:28:26 EDT 2008
On Fri, May 23, 2008 at 12:16 PM, Paul Mattal <paul at mattal.com> wrote:
> Pierre Schmitz wrote:
>> Am Freitag, 23. Mai 2008 18:22:34 schrieb Aaron Griffin:
>>> Our non-GPL licensed packages are
>>> fairly small compared to the GPL ones
>> I just did some queries against the db:
>> packages under GPL:
>> count 5789
>> sum(isize) 33.88 GB
>> sum(csize) 14.23 GB
>> packages with other licenses
>> count 1873
>> sum(isize) 9.82 GB
>> sum(csize) 4.14 GB
>> packages without licenses
>> count 1578
>> sum(isize) 4.86 GB
>> sum(csize) 1.80 GB
>> Those data include both arches and all repos (core, extra, testing,
>> unstable, community)
>> The sum of csize might be a hint about how much space the src-packages
>> might need.
> Remember that GPL3 has new language, which appears at least at first glance
> to allow you to provide a link to a third party hosting the source. Our
> PKGBUILDs constitute quite "clear directions" as to where to find the sourc.
> So I think you only have to mirror for GPL2 holdouts.
> From section 6d of GPLv3:
> Convey the object code by offering access from a designated place (gratis or
> for a charge), and offer equivalent access to the Corresponding Source in
> the same way through the same place at no further charge. You need not
> require recipients to copy the Corresponding Source along with the object
> code. If the place to copy the object code is a network server, the
> Corresponding Source may be on a different server (operated by you or a
> third party) that supports equivalent copying facilities, provided you
> maintain clear directions next to the object code saying where to find the
> Corresponding Source. Regardless of what server hosts the Corresponding
> Source, you remain obligated to ensure that it is available for as long as
> needed to satisfy these requirements.
> Regardless, mirroring source for all packages seems good. It's easy, and I
> don't see a reason not to do it. I just wanted to point out that it seems
> GPL3+ has a less stringent source hosting obligation which it seems clear we
> already meet.
Agreed. The GPL3 has a clause to the effect of "places like
sourceforge are way more trustworthy a server than
someotherlinux.org", so yeah they "got it".
More information about the arch-dev-public