[copyleft-next] Network access to Corresponding Source

Luis Villa luis at tieguy.org
Thu Feb 14 16:46:32 UTC 2013


On Sat, Feb 9, 2013 at 8:50 AM, Theodore Ts'o <tytso at mit.edu> wrote:
> On Fri, Feb 08, 2013 at 09:15:32PM -0500, Richard Fontana wrote:
>>
>> I don't think requiring that user to use 'git clone' is
>> problematic. (Is the concern that this specific user may not have the
>> knowledge or software tools to do it?)
>
> What if the sources are only available under a proprietary source code
> management system which requires $$$ to obtain?  i.e., like Perforce,
> Bitkeeper, or <shudder> Clearcase?  (Although I dont think Clearcase
> has anonymous access, so maybe it would be prohibited on other
> grounds.)
>
>> > Also, one thing that concerns me is that people won't provide a copy of
>> > the Corresponding Source. They might point people to check out the trunk
>> > of the source, which could be a newer version that does not correspond
>> > with the current binary that is running. So even if we can assume that a
>> > link to a git repo is OK, I hope that very clear and simple instructions
>> > for getting the *Corresponding Source* would be provided and not just
>> > the latest source.
>
> Well, technically they did provide a copy of the Corresponding Source.
> They may just not have identified which revision out of the
> potentially thousands of revisions in the repository _was_ the
> Corresponding Source used to build said binary.  (I guess the lawyerly
> equivalent would be handing over seventeen truckloads of documents in
> response to a discovery request, in paper form, with no index?  :-)

As a data point on what is possible, Mozilla nightly builds have a
link somewhere (I can't find it right now though) to the exact hg
revision that was used to do the build. I think that's perfectly
reasonable as a requirement (though perhaps it should be in the
non-existent FAQ).

And as a general point, I agree with the notion that the correct
standard is "getting source can require the same number of hoops to be
jumped through that the binary required, but no more". Writing in
specific rules (e.g., identity verification, user traffic logging,
etc.) is a recipe for a license that is broken within 5-10 years (as
well as too wordy).

Luis (suggestion for a lurker who wants to contribute: search the
archives for "FAQ" and create a skeletal FAQ with relevant quotes from
the various email threads)


More information about the copyleft-next mailing list