Proposal: Revision of policy surrounding 3rd party and non-free software

[Josh Boyer]

On Wed, Jan 22, 2014 at 5:04 PM, Bill Nottingham <notting at redhat.com> wrote:
> Josh Boyer (jwboyer at fedoraproject.org) said:
>> > Pedantic but (maybe) important distinction: the idea would be to prepopulate
>> > (in some way or another) the software installer application with _specific_
>> > 3rd party repositories (in the mockup, Adobe, Dropbox, Google, Nvidia, and
>> > Steam) -- akin more to having the default Fedora bookmarks include the
>> > download pages at those companies than to a Google search. Or am I
>> > misunderstanding?
>>
>> The bookmark analogy seems fair to me, yes.  However, it might be
>> feasible to include these "bookmarks" without having them displayed by
>> default and instead requiring a user to toggle a checkbox or such to
>> enable them.
>
> I'd rather not include any metadata or links to particular repositories in
> Fedora itself:
>
> - packaging is a really crappy way to have to update a software
>   source list if we were to get some new third party source
> - it's also a really crappy way to *disable* a source from being
>   shown to users if we for some reason need to do so, and do so quickly
>   (waves at spot)
>
> This is regardless of whether the third-party repo contains free or non-free
> software - the same issues apply to both cases.
>
> Once we take that step, Adam's suggestion honestly makes the most sense to
> me - a web service exists that third parties can register their repositories
> with. They'd register what format they're providing software in/for (yum
> repos, apt repos, etc.), what OSes/releases they're targeting (Fedora, RHEL,
> Ubuntu, Debian, Arch, whatever), and some metadata (keywords, icons, etc.).
>
> You then have a workflow in Fedora that looks something like:
>
> Software -> About (or Preferences)
>
>    [ ] Enable third party software
>       |
>     <user checks box>
>       |
>  /!\ WARNING: Fedora does not and cannot support software from third parties;
>      such software can cause your system to misbehave or crash.
>      Use at your own risk. For more information, see:
>         http://fedoraproject.org/wiki/eat-your-brane
>                                                 [ Cancel ]  [ OK ]
>       |
>     <hit OK>
>       |
>     ... this then queries the service for appropriate repos to pull appdata
> from.
>
> You then have them showing up in a mechanism similar to the wireframe,
> although I'd suggest two changes:
> - In search results and browsing, have a separate category for 'Software for
>   $NAME' or 'Vendor Software'
> - Not a huge fan of the listing of all available third party sources dialog.
>   (Esp. if it's not "all available", and therefore requires us to prune.)

FWIW, I think this seems pretty sane overall.

> Then, we just need to
>
> 1) get other distros involved
> 2) work with them to define & set up the service
> 3) work with the vendors on how to package stuff for it properly

The sticking point here will be who hosts the service.  If Fedora is
hosting a service for vendors of non-free software to list their
products, I don't really see how it's different semantically than
including links to repositories they host themselves.  Yes, it solves
the technical problem of packaging being bad for this, but it doesn't
solve the broader "promotion of non-free software" issue that is what
really people seem to be objecting to.

(Frankly, even if Fedora doesn't host the service and we still point
to it, the semantics are the same in my mind.)

josh