Gentoo Archives: gentoo-dev

From: Richard Freeman <rich0@g.o>
To: gentoo-dev@l.g.o
Subject: Re: [gentoo-dev] CAcert certificate distribution license to third parties (i.e. distributors like gentoo)
Date: Tue, 15 Dec 2009 14:18:38
Message-Id: 4B277ECA.3000608@gentoo.org
In Reply to: Re: [gentoo-dev] CAcert certificate distribution license to third parties (i.e. distributors like gentoo) by Daniel Black
1 On 12/15/2009 01:46 AM, Daniel Black wrote:
2 > I did email the debian maintainer too. no response yet. They have interactive
3 > builds though and I guess we do too now. Will be a royal pain if every
4 > CA/software did the same thing.
5 >
6
7 The last thing gentoo needs is interactive builds. XFree86 was forked
8 over something less annoying than that (advertising clause)...
9
10 I'd rather put a disclaimer in the handbook that when you install gentoo
11 you bear the consequences of anything you do with it: if you're in a
12 jurisdiction where software licenses are binding on those who use
13 software then be sure to set ACCEPT_LICENSE accordingly, and all users
14 should monitor the outputs of their builds for important notices.
15
16 On that note, perhaps the default make.conf should send ELOGs to
17 root@localhost or something? People can disable it if they don't like
18 it, but I don't think we want our default to be that important notices
19 are lost.
20
21 If legal experts feel that the only thing that will work would be an
22 interactive build, then we should:
23
24 1. Have the build by default terminate with an error that it requires
25 some kind of acknowledgment. Ideally have the package manager detect
26 this condition at --pretend time.
27 2. Have the user set this acknowledgment using an environment variable
28 in make.conf (perhaps a setting for these purposes), or a local use
29 flag, or some other one-time non-interactive mechanism.
30 3. Have the build notice this and proceed normally (so the actual build
31 and future upgrades are non-interactive).
32
33 4. Ensure that this package is NOT required by anything in system, or
34 installed by default by any major popular package (so maybe we have
35 ca-certificates, and ca-certificates-annoying or something).
36
37 We definitely don't want the gentoo experience to be one of typing
38 emerge world and then having to check back on it every three minutes to
39 see what the latest prompt is.
40
41 I'm generally in favor of including CACert by default, but if they're
42 going to shoot themselves in the foot over licensing then that is their
43 loss. I already have to install it manually for chromium (a real pita,
44 btw). I can't see the council voting to allow interactive builds for a
45 certificate, and I really don't see why CACert is pushing this either...

Replies