On Sat, Feb 9, 2013 at 8:50 AM, Theodore Ts'o tytso@mit.edu wrote:
On Fri, Feb 08, 2013 at 09:15:32PM -0500, Richard Fontana wrote:
I don't think requiring that user to use 'git clone' is problematic. (Is the concern that this specific user may not have the knowledge or software tools to do it?)
What if the sources are only available under a proprietary source code management system which requires $$$ to obtain? i.e., like Perforce, Bitkeeper, or <shudder> Clearcase? (Although I dont think Clearcase has anonymous access, so maybe it would be prohibited on other grounds.)
Also, one thing that concerns me is that people won't provide a copy of the Corresponding Source. They might point people to check out the trunk of the source, which could be a newer version that does not correspond with the current binary that is running. So even if we can assume that a link to a git repo is OK, I hope that very clear and simple instructions for getting the *Corresponding Source* would be provided and not just the latest source.
Well, technically they did provide a copy of the Corresponding Source. They may just not have identified which revision out of the potentially thousands of revisions in the repository _was_ the Corresponding Source used to build said binary. (I guess the lawyerly equivalent would be handing over seventeen truckloads of documents in response to a discovery request, in paper form, with no index? :-)
As a data point on what is possible, Mozilla nightly builds have a link somewhere (I can't find it right now though) to the exact hg revision that was used to do the build. I think that's perfectly reasonable as a requirement (though perhaps it should be in the non-existent FAQ).
And as a general point, I agree with the notion that the correct standard is "getting source can require the same number of hoops to be jumped through that the binary required, but no more". Writing in specific rules (e.g., identity verification, user traffic logging, etc.) is a recipe for a license that is broken within 5-10 years (as well as too wordy).
Luis (suggestion for a lurker who wants to contribute: search the archives for "FAQ" and create a skeletal FAQ with relevant quotes from the various email threads)