Re: [GNU-linux-libre] Violations of GPL in GuixSD packaging design

[Ludovic Courtès]

Joshua Gay <address@hidden> skribis:

> Despite his tone coming across as somewhat aggressive and combative at
> times, I am going to, as Wikipedians say, "assume good faith", and that
> Jean Louis is simply trying to help remove any doubt people might have
> that GuixSD is properly complying with licenses. From everything I have
> seen, it seems to me like Guix SDis in compliance. But, depending on how
> you go about downloading things it might be less obvoius to some people.
> As such, it might make sense to see if GuixSD might make some
> imrpovements to help make things chrystal clear to those who might have
> an inkling of doubt.
>
> Here are some of my thoughts to specific points raised.

Thanks for your feedback!

>> Thank you much. I could now unpack the sources. And I could verify that
>> patched wicd sources are on the GuixSD substitute distribution website.
>
> I believe that all resources (binaries, sources, and documentation) are
> all on the same Web site, however, that things are spread out across
> differet parts of that site  (www.gnu.org, hydra.gnu.org, etc), correct?

On a default installation, the ‘guix’ sub-commands download everything
from hydra.gnu.org (including source), unless --no-substitutes is
passed.

I guess an important difference from a distro like Debian is that, while
probably most users get binaries and source from hydra.gnu.org, users
can ignore it (--no-substitutes) or choose a different server
(--substitute-urls).  But in any case, they are still using the very
same Guix.

This makes it more difficult to reason about “distribution”, because
distribution is orthogonal.

Again, Guix is essentially a Gentoo-like source distro, and what it
distributes above all is recipes, not binaries.  Tricky!

>> I don't agree quite that packages shall be built in such manner
>> that one is forced to use guix archive -x solution. Because I am not
>> sure if guix packaging fits into the definition of "medium customarily
>> used for software interchange".
>
> A medium customarily used for software interchange does not refer to the
> format of the files, it refers to the physical medium, e.g., compact disks.

I’d like to note that the ‘guix archive -x’ trick I gave is really for
someone willing to tinker with the underlying format and protocol.

As a user, the way to obtain a package’s source is:

   guix build --source PACKAGE

>> - the wicd scripts have been patched. One shall observe the GPL2, where
>>   it says in section 2, " You must cause the modified files to carry
>>   prominent notices stating that you changed the files and the date of
>>   any change." - however on the modified file (as test), named:
>>   wicd-curses.py -- there is no such prominent notice. The file is from
>>   1970, I doubt there is any reference to date either. I have looked
>>   into patches to verify it. The date of the patch is not the date of
>>   the modification, if such modification is done programmatically on
>>   Hydra servers.
>
> I think that they may be comply with this requirement already with how
> they distribute the modified source via git but it might be that there
> could be a different way of doing it.

On second thought, it’s not entirely clear to me what it takes to comply
with this clause.  Should our patch add a “Modified by John Smith on
2016-04-09” line to this wicd-curses.py file?  This is not something we
do currently.

>> - the other matter has to be observed that the License itself was not
>>   delivered with the substitutes (object or executable form) of the
>>   packages I have tried, and I have already searched for License in some
>>   of them, such as in aria2, wicd, pulseaudio...
>
> I believe that the license is in the source and the source is being
> provided from the same place (gnu.org) as the binary (which is also
> hosted on gnu.org), but, it could be that doing this in a way that makes
> it easier for downstream recipients to pass along binaries might be
> sensible.

Unlike several distros, we do not copy ‘COPYING’ and similar files in
the share/doc directory of binaries.  We do provide licensing
information as part of the recipes, though, and this information is
accessible using the ‘guix’ command (and of course the license is in the
source, as you note.)

WDYT?  Are there ways this could be improved?

Thank you!

Ludo’.