Re: [Savannah-hackers-public] Project evaluation for librebootreborn

[Ineiev]

Hello, Asher;

On Tue, Jun 08, 2021 at 07:38:27AM +0000, Asher Gordon wrote:
>
> It seems to me that it would be better to post my evaluation directly on
> the tracker, but HowToBecomeASavannahHacker¹ says I should send it here
> instead. Perhaps there is a reason for that.

You may be right; perhaps there is no crucial difference.

> I started using Savannah to host software about two years ago, which is
> when I first started publishing free software. My Savannah account name
> is AsDaGo. I'm sending in my evaluation of the librebootreborn project
> submission, which is task #15964.²
>
> This is my first project evaluation, so please bear with me through any
> mistakes I might make.
>
> The source tarball linked in the project submission seems to include a
> lot of third party sources which are automatically downloaded. It is my
> understanding that these won't be included in the source code
> repository, and shouldn't be evaluated under Savannah's requirements.

My understanding is different. since the package distributes these
files in its tarball, the maintainers are responsible for them.
for instance, it isn't OK for the tarball to include proprietary
software (and if files have no valid license notices, they are
technically proprietary).

The "Information for Maintainers of GNU Software" does introduce
the concept of an "external library" [0], but there is no such
distinction e.g. for the purpose of copyright and license notices [1][2].

[0] https://www.gnu.org/prep/maintain/html_node/External-Libraries.html
[1] https://www.gnu.org/prep/maintain/html_node/Copyright-Notices.html
[2] https://www.gnu.org/prep/maintain/html_node/License-Notices.html

> In this project, "Linux" appears only to refer to the kernel, or as
> "GNU+Linux" or "GNU/Linux" when referring to the entire operating
> system. lbmk/README.md contains the line

> Libreboot is a *Free Software* project, but can be considered Open Source.

> but then immediately follows up with

> [The GNU 
> website](https://www.gnu.org/philosophy/open-source-misses-the-point.en.html)
> teaches why you should call it Free Software instead; alternatively, you may
> call it libre software.

> so I believe this is a valid use of "Open Source" which promotes Free
> Software instead. lbwww/site/news/rms.md (and the various translations)
> also contain several instances of "Open Source", but again, always in a
> way that promotes Free Software.

I agree, such wordings look acceptable.

> As for the license notices, there are several files that don't contain
> them. However, most of these seem to be automatically generated (such as
> lbmk/resources/seabios/config/libgfxinit)

Ideally, generated files should also include the notices (or at least
a comment referring to their source files).

> or trivial (such as
> lbmk/projectname). Most of the *.md files in lbwww have no license
> notices, but probably should. (Not sure if the lbwww repository is going
> to be hosted on Savannah though.) None of the .gitignore files have
> license notices. bucts/.gitignore is trivial, but it's probably best to
> add a license notice to the others. (Again, not sure what repositories
> are going to end up being hosted on Savannah.) Finally, bucts/Makefile
> should probably have a license notice.

If these repositories will contain anything absent in the tarball,
they should be evaluated additionally, but generally, we just scan
the contents of the distribution tarball.

> Aside from the license notice issues, everything else looks good.

Thank you, this is a good start.

signature.asc
Description: PGP signature