On Sat, Feb 9, 2013 at 8:50 AM, Theodore Ts'o <tytso(a)mit.edu> wrote:
On Fri, Feb 08, 2013 at 09:15:32PM -0500, Richard Fontana wrote:
>
> I don't think requiring that user to use 'git clone' is
> problematic. (Is the concern that this specific user may not have the
> knowledge or software tools to do it?)
What if the sources are only available under a proprietary source code
management system which requires $$$ to obtain? i.e., like Perforce,
Bitkeeper, or <shudder> Clearcase? (Although I dont think Clearcase
has anonymous access, so maybe it would be prohibited on other
grounds.)
> > Also, one thing that concerns me is that people won't provide a copy of
> > the Corresponding Source. They might point people to check out the trunk
> > of the source, which could be a newer version that does not correspond
> > with the current binary that is running. So even if we can assume that a
> > link to a git repo is OK, I hope that very clear and simple instructions
> > for getting the *Corresponding Source* would be provided and not just
> > the latest source.
Well, technically they did provide a copy of the Corresponding Source.
They may just not have identified which revision out of the
potentially thousands of revisions in the repository _was_ the
Corresponding Source used to build said binary. (I guess the lawyerly
equivalent would be handing over seventeen truckloads of documents in
response to a discovery request, in paper form, with no index? :-)
As a data point on what is possible, Mozilla nightly builds have a
link somewhere (I can't find it right now though) to the exact hg
revision that was used to do the build. I think that's perfectly
reasonable as a requirement (though perhaps it should be in the
non-existent FAQ).
And as a general point, I agree with the notion that the correct
standard is "getting source can require the same number of hoops to be
jumped through that the binary required, but no more". Writing in
specific rules (e.g., identity verification, user traffic logging,
etc.) is a recipe for a license that is broken within 5-10 years (as
well as too wordy).
Luis (suggestion for a lurker who wants to contribute: search the
archives for "FAQ" and create a skeletal FAQ with relevant quotes from
the various email threads)