On Mon, Apr 28, 2003 at 06:48:36AM +0200, Klaus Knopper wrote: > On Sun, Apr 27, 2003 at 08:59:45PM -0700, Sean 'Shaleh' Perry wrote: > > > > > > For those who would prefer paragraph a), please consider the fact that > > > a CD that consists 3/4 of only source code may not be a very popular > > > thing for the majority of potential users, and also CD-magazines and > > > FTP mirrors try to avoid stuff that is not likely to EVER being used > > > or downloaded. > > Perhaps another solution would be a canonical list of the pieces used and > > their original source? Someone could feed this to wget and have it do the > > work of grabbing things from all over the net. > This is probably already off-topic, but the "general list" is simply > created by dpkg -l and can just be generated at any time from a running > Knoppix system, or be downloaded from the mirrors (packages.txt). Then, > you can just download all sources (for the packages in the "free" section) > with apt-get source packagename (packagename from the list). For the > Knoppix-specific packages that are NOT in the Debian mirrors yet (some > are), you can use the download location at knopper.net, or send me an > email reminder if the sources there are not up-to-date (which is known > to happen occasionally). However, because Debian does NOT distribute GPL binaries under the terms of 3b, you do not have a written offer from Debian that you can use to comply with 3c. Only when you are distributing under 3c is it permitted to point to someone else's archive for the source; if you are distributing under 3a or 3b (and it's not clear to me which you believe is the case), it is your responsibility to make sources available. Under 3b, the requirement is that you include a written statement (a file on the CD should be ok) telling people how they can get the source from you. It sounds like this may be your intention; however, it seems this written offer is not displayed very prominently, because I can't find it on the Knoppix CD that I have here. :) I do see a comment in the index page which says "You may find the sources for the installed Debian packages on the various Debian mirrors." I don't believe this satisfies your obligation to provide the source. It tries to push the load off onto the Debian archive network, which seems an easy solution, but consider: if some disaster befalls Debian within the next three years, or if Debian manages to do two new releases in that time[1], these source packages will not be where you are telling people to get them, and you could be liable. Under 3a, the requirement is that you make the source available at the time of distribution. It is generally agreed that, if the binaries are made available on-line, making the source available from the same place fulfills this requirement (this is what Debian does). Pointing to someone else's site for the sources suffers from the same problems from above, and pointing to someone else's site doesn't satisfy 3a when you're distributing the binaries on CD. -- Steve Langasek postmodern programmer [1] Hey, it could happen. ;)
Attachment:
pgpdfAH0mdaz3.pgp
Description: PGP signature