Roy Bamford posted on Thu, 18 Aug 2011 17:41:15 +0100 as excerpted: > On 2011.08.18 10:59, Anthony G. Basile wrote: > [snip] > >> Understood that infra gets to complain, but that still doesn't tell me >> what the deprecation policy is. Keep all my large patchsets >> indefinitely? Or remove them when an ebuild no longer needs them? Or 1 >> year after an ebuild no longer needs them? >> > Just as long as we can provide the patch sets for a period of at least > three years, in case someone asks. Thats a GPL requirement. > > Thats not to say the files need to be online but Gentoo needs to be able > to provide them on request.
That's a very good point and "legal matters, and potentially it matters a lot!", but AFAIK it's not exactly correct (and "legal matters, and potentially it matters a lot!"). I am not a lawyer, etc, but as I understand it... 1) Generally, the GPL source-provision rules *ONLY* apply if you're shipping binaries in the first place, not for sources-only, which fulfill the source-provision by definition. Since in *MOST* cases, Gentoo is shipping source, not binaries, where that is the case, we don't need to worry about the GPL source provision rules. However, we DO ship SOME binaries, both in the packages images and in the stages and live-images. Here, we DO need to worry about the GPL's source- provision rules. The below point applies to this case. 2) For those shipping binaries, the GPLv2 (I'm not particularly familiar with the GPLv3 in this regard so can't say, for it) offers two independent ways to fill the source-provision requirements. 2a) The provider can make sources available at the same time/place and by the same method as the binaries. There's some precise definitional detail to same time/place and method requirements designed to ensure that if a user finds the binaries, they at least should be aware of the availability of the sources, but the point is, AS LONG AS the sources are made available similarly, that fulfills the sources-provision requirement, NO THREE YEAR RULE APPLIES! 2b) If the provider chooses NOT to make sources available at the same time/place and by the same method, AN ALTERNATIVE is to be able to provide them on demand FOR THREE YEARS AFTER THE BINARY IS NO LONGER PROVIDED. *THIS* is where the three-year rule comes in. It ONLY applies if the binary provider chose not to go with the same time/place/method alternative. An additional requirement here is that sources must be available to ALL (not just customers/those-who-originally-downloaded-the- binaries) who make the request, but again, it only applies if the same time/place/method alternative wasn't chosen. It's worth noting that this discussion has come up before on this list and is archived. At that time, it was noted that Gentoo was still making available downloads of the 1.4 and earlier install media, "for historical interest", and that because we were still shipping them (and because they contained GPLv2 content), that obligated Gentoo to providing exact sources (including but not limited to the original tarballs, and all patches, plus scripts, etc, as necessary) until three years after Gentoo quit making them available. IIRC, the (first) decision then, since providing those sources was going to be very difficult if anyone DID ask, was to take down those "for historical interest" images ASAP, so at least the clock would be ticking on that three-year requirement. I know I didn't follow up to ensure it was done. I hope someone did. FWIW, the legal responsibility would (AFAIK) fall on the foundation, so it would presumably be their job to ensure this was done, and from that point, that previous media were taken down in a timely manner so as not to get Gentoo in that situation once again. The second decision then (again, IIRC, but it's in the archives if anyone feels the need to look it up), and I've seen it made elsewhere as well (Gentoo's not the first to conclude it's by *FAR* the least hassle), was to have and enforce a Gentoo policy that we ALWAYS complied with the same time/place/method option, so we never had to worry about the three-year- clock on the by-request option at all. Again, I believe it's the Foundation's responsibility here, so they're the ones that should be ensuring this is enforced. FWIW, while I do have an interest in software freedom, thus my reasonably close following of the discussion at the time (and the degree to which I understand the distinction between the two sources-provision options in the first place), my personal legal butt isn't in the sling here, so I've felt no need to personally follow-up and ensure this policy is being followed. Thus my point in the context of this thread. As long as Gentoo is continuing to follow the policy decided then, that of always ensuring that sources are made available at the same time and place, and by the same method, as the binaries we are shipping, we've done our duty and shouldn't need to worry about digging up sources, at least to fulfill the LEGAL GPLv2 requirements, at all. As for GPLv3, while as I said I've not researched it to the same degree, I /believe/ that the same ideas apply, except that if anything, they've stressed the same time/place/method option even more, since it far better fits the Internet world of today, at least relative to the somewhat quaint implications of physical media requested and sent by snail mail, that the by-request-for-three-years option sort of has. -- Duncan - List replies preferred. No HTML msgs. "Every nonfree program has a lord, a master -- and if you use the program, he is your master." Richard Stallman
