[gentoo-dev] Re: Proposal: ban mirror://gentoo/ from ebuilds

[Duncan]

Roy Bamford posted on Thu, 18 Aug 2011 17:41:15 +0100 as excerpted:

> On 2011.08.18 10:59, Anthony G. Basile wrote:
> [snip]
>
>> Understood that infra gets to complain, but that still doesn't tell me
>> what the deprecation policy is.  Keep all my large patchsets
>> indefinitely? Or remove them when an ebuild no longer needs them?  Or 1
>> year after an ebuild no longer needs them?
>>
> Just as long as we can provide the patch sets for a period of at least
> three years, in case someone asks.  Thats a GPL requirement.
>
> Thats not to say the files need to be online but Gentoo needs to be able
> to provide them on request.

That's a very good point and "legal matters, and potentially it matters a 
lot!", but AFAIK it's not exactly correct (and "legal matters, and 
potentially it matters a lot!").

I am not a lawyer, etc, but as I understand it...

1) Generally, the GPL source-provision rules *ONLY* apply if you're 
shipping binaries in the first place, not for sources-only, which fulfill 
the source-provision by definition.

Since in *MOST* cases, Gentoo is shipping source, not binaries, where 
that is the case, we don't need to worry about the GPL source provision 
rules.

However, we DO ship SOME binaries, both in the packages images and in the 
stages and live-images.  Here, we DO need to worry about the GPL's source-
provision rules.  The below point applies to this case.

2) For those shipping binaries, the GPLv2 (I'm not particularly familiar 
with the GPLv3 in this regard so can't say, for it) offers two 
independent ways to fill the source-provision requirements.

2a) The provider can make sources available at the same time/place and by 
the same method as the binaries.  There's some precise definitional 
detail to same time/place and method requirements designed to ensure that 
if a user finds the binaries, they at least should be aware of the 
availability of the sources, but the point is, AS LONG AS the sources are 
made available similarly, that fulfills the sources-provision 
requirement, NO THREE YEAR RULE APPLIES!

2b) If the provider chooses NOT to make sources available at the same 
time/place and by the same method, AN ALTERNATIVE is to be able to 
provide them on demand FOR THREE YEARS AFTER THE BINARY IS NO LONGER 
PROVIDED.  *THIS* is where the three-year rule comes in.  It ONLY applies 
if the binary provider chose not to go with the same time/place/method 
alternative.  An additional requirement here is that sources must be 
available to ALL (not just customers/those-who-originally-downloaded-the-
binaries) who make the request, but again, it only applies if the same 
time/place/method alternative wasn't chosen.

It's worth noting that this discussion has come up before on this list 
and is archived.  At that time, it was noted that Gentoo was still making 
available downloads of the 1.4 and earlier install media, "for historical 
interest", and that because we were still shipping them (and because they 
contained GPLv2 content), that obligated Gentoo to providing exact 
sources (including but not limited to the original tarballs, and all 
patches, plus scripts, etc, as necessary) until three years after Gentoo 
quit making them available.

IIRC, the (first) decision then, since providing those sources was going 
to be very difficult if anyone DID ask, was to take down those "for 
historical interest" images ASAP, so at least the clock would be ticking 
on that three-year requirement.

I know I didn't follow up to ensure it was done.  I hope someone did.  
FWIW, the legal responsibility would (AFAIK) fall on the foundation, so 
it would presumably be their job to ensure this was done, and from that 
point, that previous media were taken down in a timely manner so as not 
to get Gentoo in that situation once again.

The second decision then (again, IIRC, but it's in the archives if anyone 
feels the need to look it up), and I've seen it made elsewhere as well 
(Gentoo's not the first to conclude it's by *FAR* the least hassle), was 
to have and enforce a Gentoo policy that we ALWAYS complied with the same 
time/place/method option, so we never had to worry about the three-year-
clock on the by-request option at all.

Again, I believe it's the Foundation's responsibility here, so they're 
the ones that should be ensuring this is enforced.  FWIW, while I do have 
an interest in software freedom, thus my reasonably close following of 
the discussion at the time (and the degree to which I understand the 
distinction between the two sources-provision options in the first 
place), my personal legal butt isn't in the sling here, so I've felt no 
need to personally follow-up and ensure this policy is being followed.

Thus my point in the context of this thread.  As long as Gentoo is 
continuing to follow the policy decided then, that of always ensuring 
that sources are made available at the same time and place, and by the 
same method, as the binaries we are shipping, we've done our duty and 
shouldn't need to worry about digging up sources, at least to fulfill the 
LEGAL GPLv2 requirements, at all.

As for GPLv3, while as I said I've not researched it to the same degree, 
I /believe/ that the same ideas apply, except that if anything, they've 
stressed the same time/place/method option even more, since it far better 
fits the Internet world of today, at least relative to the somewhat 
quaint implications of physical media requested and sent by snail mail, 
that the by-request-for-three-years option sort of has.

-- 
Duncan - List replies preferred.   No HTML msgs.
"Every nonfree program has a lord, a master --
and if you use the program, he is your master."  Richard Stallman