DMARC-Filter: OpenDMARC Filter v1.4.2 delorie.com 572Hj8fM426778
Authentication-Results: delorie.com; dmarc=pass (p=none dis=none) header.from=cygwin.com
Authentication-Results: delorie.com; spf=pass smtp.mailfrom=cygwin.com
DKIM-Filter: OpenDKIM Filter v2.11.0 delorie.com 572Hj8fM426778
Authentication-Results: delorie.com;
	dkim=pass (1024-bit key, unprotected) header.d=cygwin.com header.i=@cygwin.com header.a=rsa-sha256 header.s=default header.b=QENN1p6L
X-Recipient: archive-cygwin AT delorie DOT com
DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org 262FF3858419
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cygwin.com;
	s=default; t=1754136922;
	bh=zTzM78uOHYiByP4ZjABMMY+AwEJbBRSaNu5tyU7ifUE=;
	h=To:Subject:In-Reply-To:References:Date:List-Id:List-Unsubscribe:
	 List-Archive:List-Post:List-Help:List-Subscribe:From:Reply-To:
	 From;
	b=QENN1p6L3Bba3q5tmkJVJMFmauTlDSm2fTHM2b/F49MGCwlJWp8XiDFWtkHBQSPfK
	 9pzMSjIYbOeDx644etveey45klv41LT/o4b7j8noMxA4cAYrWMXxnr+3NfZ6Ecnkxp
	 E4yt7ICPzslOcvZCziG0OH7WVGUzZt2C3m7GBSxI=
X-Original-To: cygwin AT cygwin DOT com
Delivered-To: cygwin AT cygwin DOT com
DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org 402D63858407
ARC-Filter: OpenARC Filter v1.0.0 sourceware.org 402D63858407
ARC-Seal: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1754136897; cv=none;
 b=T+QzbewjDdbgHnIDjQuuEra6ush565wn/QvN+BPS307FE9svD/RCSOnvjrCkI4i5qBDvB5wb9+73hEgcmt9gxLfj04DcudcP16DmzGt2nGSXZRXF64NIQRW/teVprcu0FUcxQ/plHsGw/qAjxgifTfN/d5FrQBpe9p2pNhgEDv0=
ARC-Message-Signature: i=1; a=rsa-sha256; d=sourceware.org; s=key;
 t=1754136897; c=relaxed/simple;
 bh=LiGypc1uGO75oeaKrYl+ILsR1zukk9PDk6t3xaBaG5A=;
 h=DKIM-Signature:From:To:Subject:Date:Message-ID:MIME-Version;
 b=qeH/QYyQJhkxo7V1PzerIjiDq6pyN6obMQvwWpT+V5N85+ZVn85iu7Tzjo8f7swbzKeqwW6qiYvNIO/M0/sPjtlRkUg6mg6doxQtKb5yOxbQoQKj/oB7DDByNYAWw7gb6UO+aQ3h8VWRoJmqGlfCahj9XbYWnGcHj9ujPNDHUuM=
ARC-Authentication-Results: i=1; server2.sourceware.org
DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org 402D63858407
To: cygwin AT cygwin DOT com
Subject: Re: the Cygwin packaging system and the GPL
In-Reply-To: <4993324.vzjCzTo3RI@nimes> (Bruno Haible via Cygwin's message of
 "Sat, 02 Aug 2025 12:43:07 +0200")
References: <4993324 DOT vzjCzTo3RI AT nimes>
Date: Sat, 02 Aug 2025 14:14:48 +0200
Message-ID: <87wm7lkjif.fsf@Gerda.invalid>
User-Agent: Gnus/5.13 (Gnus v5.13)
MIME-Version: 1.0
X-purgate-type: clean
X-purgate: clean
X-purgate-size: 2807
X-purgate-ID: 155817::1754136891-5211CA57-412EFE4D/0/0
X-BeenThere: cygwin AT cygwin DOT com
X-Mailman-Version: 2.1.30
Precedence: list
List-Id: General Cygwin discussions and problem reports <cygwin.cygwin.com>
List-Unsubscribe: <https://cygwin.com/mailman/options/cygwin>,
 <mailto:cygwin-request AT cygwin DOT com?subject=unsubscribe>
List-Archive: <https://cygwin.com/pipermail/cygwin/>
List-Post: <mailto:cygwin AT cygwin DOT com>
List-Help: <mailto:cygwin-request AT cygwin DOT com?subject=help>
List-Subscribe: <https://cygwin.com/mailman/listinfo/cygwin>,
 <mailto:cygwin-request AT cygwin DOT com?subject=subscribe>
From: ASSI via Cygwin <cygwin AT cygwin DOT com>
Reply-To: ASSI <Stromeko AT nexgo DOT de>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: cygwin-bounces~archive-cygwin=delorie DOT com AT cygwin DOT com
Sender: "Cygwin" <cygwin-bounces~archive-cygwin=delorie DOT com AT cygwin DOT com>

Bruno Haible via Cygwin writes:
> So, the corresponding source code is sitting solely on the Cygwin
> maintainer's disk. If they experience a hard disk crash or if the directory
> with that corresponding source code gets lost through an accidental
> "rm -rf", the corresponding source cannot be distributed any more, ever.

The sources to any binary package for Cygwin (i.e. the actual files used
to build it) are in its source package.  You can install them with the
same setup.exe that you use to install the package (either right then
and there or at any later point) and they are always distributed to all
official mirrors along with the binary package, as required per GPL.  So
yes, Cygwin might have a low bus factor, but nothing will go missing
after release.

> This is a major shortcoming in the Cygwin packaging system. A packaging
> system that distributes more than 9000 packages [1], many of them under GPL
> or LGPL, should not make it so easy to distribute binaries while withholding
> the corresponding source code.

Again, this is just plain wrong along with the conclusions you draw from
your mistaken perception.

> In each https://cygwin.com/packages/summary/<package>-src.html page there is a
> per-version table of the list of source files.

That list of files is produced directly from the source package, which
(again) you can install directly alongside the binary package it belongs
to.

> I am suggesting that this
> reference gets replaced with a reference to a commit in the source code
> repository (under https://cygwin.com/cgit/cygwin-packages/), that contains
> the _actual_ source files, not only their names. And that a package maintainer
> *cannot* upload binaries for a version without having provided that commit.

Not all packages are having a git repo there.  Besides, that still
wouldn't make it the place to get the sources for the binary package
unless the infrastructure was in place to ensure that the package was
actually built from a checkout of that exact commit.  Which we're slowly
working to get to, but I wouldn't hold my breath for it to happen.

> Btw, as a user I am thankful for the packaging work that the Cygwin package
> maintainers do. And I understand that a mechanism that limits what they can do
> could be annoying to them. But I think that a mechanism that helps fulfilling
> the legal requirements of the GPL can only be beneficial to the Cygwin
> project.

This is already in place, as I said above.  The git package repo is an
optional venue, not the main, canonical or only one at the moment.


Regards,
Achim.
-- 
+<[Q+ Matrix-12 WAVE#46+305 Neuron microQkb Andromeda XTk Blofeld]>+

SD adaptation for Waldorf microQ V2.22R2:
http://Synth.Stromeko.net/Downloads.html#WaldorfSDada

-- 
Problem reports:      https://cygwin.com/problems.html
FAQ:                  https://cygwin.com/faq/
Documentation:        https://cygwin.com/docs.html
Unsubscribe info:     https://cygwin.com/ml/#unsubscribe-simple