[arch-dev-public] GPL Compliance: A beginning

[Aaron Griffin]

On Fri, May 23, 2008 at 12:16 PM, Paul Mattal <paul at mattal.com> wrote:
> Pierre Schmitz wrote:
>>
>> Am Freitag, 23. Mai 2008 18:22:34 schrieb Aaron Griffin:
>>>
>>> Our non-GPL licensed packages are
>>> fairly small compared to the GPL ones
>>
>> I just did some queries against the db:
>>
>> packages under GPL:
>>        count           5789
>>        sum(isize)      33.88 GB
>>        sum(csize)      14.23 GB
>>
>> packages with other licenses
>>        count           1873
>>        sum(isize)      9.82 GB
>>        sum(csize)      4.14 GB
>>
>> packages without licenses
>>        count           1578
>>        sum(isize)      4.86 GB
>>        sum(csize)      1.80 GB
>>
>> Those data include both arches and all repos (core, extra, testing,
>> unstable, community)
>>
>> The sum of csize might be a hint about how much space the src-packages
>> might need.
>>
>
> Remember that GPL3 has new language, which appears at least at first glance
> to allow you to provide a link to a third party hosting the source. Our
> PKGBUILDs constitute quite "clear directions" as to where to find the sourc.
> So I think you only have to mirror for GPL2  holdouts.
>
> From section 6d of GPLv3:
>
> Convey the object code by offering access from a designated place (gratis or
> for a charge), and offer equivalent access to the Corresponding Source in
> the same way through the same place at no further charge. You need not
> require recipients to copy the Corresponding Source along with the object
> code. If the place to copy the object code is a network server, the
> Corresponding Source may be on a different server (operated by you or a
> third party) that supports equivalent copying facilities, provided you
> maintain clear directions next to the object code saying where to find the
> Corresponding Source. Regardless of what server hosts the Corresponding
> Source, you remain obligated to ensure that it is available for as long as
> needed to satisfy these requirements.
>
> Regardless, mirroring source for all packages seems good. It's easy, and I
> don't see a reason not to do it. I just wanted to point out that it seems
> GPL3+ has a less stringent source hosting obligation which it seems clear we
> already meet.

Agreed. The GPL3 has a clause to the effect of "places like
sourceforge are way more trustworthy a server than
someotherlinux.org", so yeah they "got it".