Re: [GNU-linux-libre] review of uruk

[Denis 'GNUtoo' Carikli]

On Fri, 24 Mar 2023 18:25:46 -0700
alimiracle <alimiracle@riseup.net> wrote:

>  > After a quick glance of the Uruk website, technologies such as   
> Docker, SourceForge, GitHub and CloudIDE invites to take a closer
> look: cloude ide is not part of uruk distro
> its part of uruk project
> and docker is free
> but if the  ide and docker image must removed we will remove it
Personally I don't see the issue with the docker image if what's inside
that image is FSDG compliant.

> As you know Pure is a free distribution as the FSF says
> We used it because we thought Pure was completely free
> Honestly, I'm starting to doubt pure's credibility
> What do you advise us to do, do we remove and replace the browser or
> is there another more practical solution
I started to look how to contribute to PureOS, but all I found is a
policy that requires to upstream changes in Debian whenever possible.

Beside that, it seems possible to contribute to PureOS to fix FSDG
compliance issues, but I'm unsure of the way to do that.

In Trisquel for instance, I've tested the process for real, and
some of the freedom issues I've reported were not fixed because of the
lack of time, but as soon as I sent patches to fix these issues, the
patches were discussed and integrated relatively rapidly.

So at least in the cases I found, at the time, patches were the
way that worked best.

So for PureOS we probably need to find a way to get these fixed in some
ways, and maybe if someone sends patches in addition of the bug
reports, maybe getting things fixed would work. Or maybe there is
another process for that?

> far be it from me to only complain about a problem, without
> offering to help solve it - over the previous thread, i did not
> see anyone step forward and volunteer to review uruk
> 
> it would be hypocritical for the work-group to also be idle, in
> this time when the FSF is under-staffed
I think we also need to find a way that works for us (people
interested in reviewing distros).

Reviewing a full distro can be very time consuming. And the amount of
changes uruk does is pretty small, so that would be a great opportunity
to find ways that work and reuse them afterward on bigger distros.

Uruk is indirectly based on Debian and I don't know well enough Debian
tools, so I'm unsure what parts of the review can be automatized.

For instance there is a document[1] that has a checklist on what to
check with things like that:
[ ] Programs commonly known to have freedom issues are liberated or
    excluded
[ ] No non-free firmware or binary blobs
[ ] All software under a free license with source code provided 
[ ] Documentation under a free license
[ ] Other "Information for practical use" under a free license
[ ] All "non-functional" data must be freely distributable

As I understand all that require to check packages, so we could link
each package to a software in the free software directory. And it would
also be a good opportunity to add some of the Uruk specific software
there. 

I've started to do that in some not-yet automated way[2].

But then I'm unsure how to know what changed between an original
package and the modification by Uruk. Do you know how to do that?

I'm also unsure how to check an installer ISO: Do you know where to
find infos about rebuilding the installer images?

I've also no idea how to check if the packages binaries correspond to
the source code, though I could probably find how to do that.

What I'm interested in here would be to use this occasion to at least
start understanding what tools and/or process that could work to
automatize the check of Debian based distributions, and that would work
too without without much trust (that could be useful with companies
that are more difficult to trust because the requirement of not going
bankrupt or profit requirements could in some case take precedence on
FSDG compliance).

> the work-group has clearly lost a good deal of momentum in the
> past years; so the most pertinent topic to discuss at this time,
> is: could we accomplish this now? - are there any volunteers?
Here the issue is that I fear that no one will commit to do the full
review, but small parts were already reviewed by different people, so
if we find a way to bring more people in to collaborate and split all
that in smaller parts, it might be doable to have it fully reviewed.

I've started to look a bit into it[2], but I'm unsure if it's the right
approach (like does it reviews the right things?) and I've questions on
how to automatize all that.

My main concern here is to find a process that can easily be checked
later on by someone else. For instance if an FSF employee or
volunteer could check the work fast, then we'd have more probability of
having that done: my hypothesis is that if it's fast enough to check a
distribution, it has a good probability to be added to the list.

What bill-auger wrote seems to confirm this hypothesis:
> we would also be remiss if we did not recognize that freenix and
> liberty-bsd were ready and awaiting their "brief final review"
> _before_ hyperbola applied for consideration; yet hyperbola was
> fully evaluated by the community and endorsed by the FSF within
> a few months, ahead of the others which are still waiting 5
> years later - i dont know what that implies, but there is no
> reasonable explanation known, which would account for such a
> stark inversion of priority
Here the fact that Hyperbola comes before liberty-bsd is compatible
with that hypothesis because maybe Hyperbola was way faster to check.

If it was a fork of Parabola and that Parabola was already FSDG
compliant, there was probably not much to check.

Hyperbola is also way easier to understand than a BSD distribution that
works differently than the GNU/Linux distributions people are used to.

References:
-----------
[1]https://libreplanet.org/wiki/Template:FSDG_Checklist
[2]https://libreplanet.org/wiki/Incoming_distros/uruk

Denis.

pgpel1yNypE6K.pgp
Description: OpenPGP digital signature