Re: Distributing Debian derivative
* David Given <dg@cowlark.com> [100322 13:56]:
> I'd like to distribute a Debian root file system with my (open source)
> projects. What are my legal obligations when doing so?
>
> What I want to distribute is a tarball of a basic debootstrapped root
> file system. This isn't a format that Debian itself distributes, so I
> can't just point my users at a Debian mirror; so I'd like to include my
> own copy for user convenience. I don't (at present) want to modify it.
>
> I've looked for suitable documentation but have failed to find any. What
> should I be reading?
If you have not stripped /usr/share/doc from your debootstrap it should
contain all the licenses needed in form of /usr/share/doc/*/copyright
files. Those licenses list conditions under which you can make copies,
distribute them (and some other things like modification).
Usually the most strict is GPLv2, which requests to either
a) Accompany it with the complete corresponding machine-readable source
code, which must be distributed under the terms of Sections 1 and 2
above on a medium customarily used for software interchange; or,
b) Accompany it with a written offer, valid for at least three years, to
give any third party, for a charge no more than your cost of physically
performing source distribution, a complete machine-readable copy of the
corresponding source code, to be distributed under the terms of Sections
1 and 2 above on a medium customarily used for software interchange; or,
or
c) Accompany it with the information you received as to the offer to
distribute corresponding source code. (This alternative is allowed only
for noncommercial distribution and only if you received the program in
object code or executable form with such an offer, in accord with
Subsection b above.)
As Debian does not give you any written offer but the source alongside
the binaries, c) is not an option. Easiest is a) (though for b) you only
need to archive the source you would be giving away with each copy as in
a) and keep it in case someone wants the offer).
So you have to get the "complete corresponding machine-readable source
code" (at least for possible GPLv2 parts, for BSD stuff or GPLv3 you
will need less). GPLv2 says 'The "Corresponding Source" for a work in
object code form means all the source code needed to generate, install,
and (for an executable work) run the object code and to modify the work,
including scripts to control those activities. However, [some exceptions]'.
The easiest (calculating only the preparations), is just
accompanying your tarball with all the source DVDs Debian has for the
distribution of your choice (or a mirror of all the sources if you use
an unreleased distribution). That is quite too much but you are on the
safe site.
If you want some more minimal, you can calculate a more minimal set via:
Look at the packages installed (look in /var/lib/dpkg/status), assemble
a list of source packages. Collect all their build-dependencies (plus
everything build-essential) and assemble a list of source packages they
are from. Iterate looking at the build-dependencies until nothing
changes anymore[1]. Now put all the source packages together and accompany
your product with that (Alternatively make sure you never loose those
and give out written offers to give those source packages to everyone
asking for those). That would suffice if everything in there would
GPLv2. I guess except perhaps some advertise-clauses of some old BSD
like licenses that should be the hardest part.
Hochachtungsvoll,
Bernhard R. Link
Reply to: