Bruno Haible via Cygwin writes: > So, the corresponding source code is sitting solely on the Cygwin > maintainer's disk. If they experience a hard disk crash or if the directory > with that corresponding source code gets lost through an accidental > "rm -rf", the corresponding source cannot be distributed any more, ever.
The sources to any binary package for Cygwin (i.e. the actual files used to build it) are in its source package. You can install them with the same setup.exe that you use to install the package (either right then and there or at any later point) and they are always distributed to all official mirrors along with the binary package, as required per GPL. So yes, Cygwin might have a low bus factor, but nothing will go missing after release. > This is a major shortcoming in the Cygwin packaging system. A packaging > system that distributes more than 9000 packages [1], many of them under GPL > or LGPL, should not make it so easy to distribute binaries while withholding > the corresponding source code. Again, this is just plain wrong along with the conclusions you draw from your mistaken perception. > In each https://cygwin.com/packages/summary/<package>-src.html page there is a > per-version table of the list of source files. That list of files is produced directly from the source package, which (again) you can install directly alongside the binary package it belongs to. > I am suggesting that this > reference gets replaced with a reference to a commit in the source code > repository (under https://cygwin.com/cgit/cygwin-packages/), that contains > the _actual_ source files, not only their names. And that a package maintainer > *cannot* upload binaries for a version without having provided that commit. Not all packages are having a git repo there. Besides, that still wouldn't make it the place to get the sources for the binary package unless the infrastructure was in place to ensure that the package was actually built from a checkout of that exact commit. Which we're slowly working to get to, but I wouldn't hold my breath for it to happen. > Btw, as a user I am thankful for the packaging work that the Cygwin package > maintainers do. And I understand that a mechanism that limits what they can do > could be annoying to them. But I think that a mechanism that helps fulfilling > the legal requirements of the GPL can only be beneficial to the Cygwin > project. This is already in place, as I said above. The git package repo is an optional venue, not the main, canonical or only one at the moment. Regards, Achim. -- +<[Q+ Matrix-12 WAVE#46+305 Neuron microQkb Andromeda XTk Blofeld]>+ SD adaptation for Waldorf microQ V2.22R2: http://Synth.Stromeko.net/Downloads.html#WaldorfSDada -- Problem reports: https://cygwin.com/problems.html FAQ: https://cygwin.com/faq/ Documentation: https://cygwin.com/docs.html Unsubscribe info: https://cygwin.com/ml/#unsubscribe-simple
