Distributing Fedora packages under GPLv2 3(b)

[Matt Domsch]

On Fri, Oct 05, 2007 at 10:19:11PM -0400, Jesse Keating wrote:
> On Fri, 5 Oct 2007 20:06:52 -0500
> Matt Domsch <Matt_Domsch at dell.com> wrote:
> 
> > (GPLv2 is somewhat unclear if the 3 years is from the first
> > distribution, or the last...)  The koji archive with lots of
> > incremental builds would be many times the size of the SCCM storage
> > needs.
> 
> This is what has made me reluctant to venture toward using 3b.  The
> uncertainty of when that 3 years starts, added to that the people
> making use of 3c, do we the 3b folks have to keep things around for 3
> years after a 3c person makes a release?  Does the 3year clock start at
> the first distribution of an update or does it start with each respin
> that includes the update but still hosted by Fedora?
> 
> I'd like some serious clarification on these items, and I fear that the
> FSF isn't going to be all that helpful in continuing the use of GPLv2.
> What does v3 have to say on the matter?

GPLv3 says:

--- snip ---

6. Conveying Non-Source Forms.

You may convey a covered work in object code form under the terms of
sections 4 and 5, provided that you also convey the machine-readable
Corresponding Source under the terms of this License, in one of these
ways:

    * a) Convey the object code in, or embodied in, a physical product
      (including a physical distribution medium), accompanied by the
      Corresponding Source fixed on a durable physical medium
      customarily used for software interchange.
    * b) Convey the object code in, or embodied in, a physical product
      (including a physical distribution medium), accompanied by a
      written offer, valid for at least three years and valid for as
      long as you offer spare parts or customer support for that
      product model, to give anyone who possesses the object code
      either (1) a copy of the Corresponding Source for all the
      software in the product that is covered by this License, on a
      durable physical medium customarily used for software
      interchange, for a price no more than your reasonable cost of
      physically performing this conveying of source, or (2) access to
      copy the Corresponding Source from a network server at no
      charge.
    * c) Convey individual copies of the object code with a copy of
      the written offer to provide the Corresponding Source. This
      alternative is allowed only occasionally and noncommercially,
      and only if you received the object code with such an offer, in
      accord with subsection 6b.
    * d) Convey the object code by offering access from a designated
      place (gratis or for a charge), and offer equivalent access to
      the Corresponding Source in the same way through the same place
      at no further charge. You need not require recipients to copy
      the Corresponding Source along with the object code. If the
      place to copy the object code is a network server, the
      Corresponding Source may be on a different server (operated by
      you or a third party) that supports equivalent copying
      facilities, provided you maintain clear directions next to the
      object code saying where to find the Corresponding
      Source. Regardless of what server hosts the Corresponding
      Source, you remain obligated to ensure that it is available for
      as long as needed to satisfy these requirements.
    * e) Convey the object code using peer-to-peer transmission,
      provided you inform other peers where the object code and
      Corresponding Source of the work are being offered to the
      general public at no charge under subsection 6d.

(snip anti-Tivoization and format stuff that follows)

--- snip ---

In the past with GPLv2, the FSF stance has been that you must make
sources available in a similar manner to how you make the binaries
available.  e.g. if you only posted binaries on the net and never on a
CD, you could post source only on the net.  But as soon as you
produced a CD to hand someone, you would also be obligated to provide
them source on CD upon request.  With v3, you can put binaries on CD,
and put source on the net, and be fine.

The "three years" part isn't really clarified in v3 either.  A
pessimistic read would be "three years from the last distribution",
which would be forever if you don't know when the last distribution
was.  I can't believe this is what they intend, but IANAL, and
definitely IANAFSFL.

http://gpl-violations.org/faq/sourcecode-faq.html
uses the words "last distributed"...

  Please note that if you chose GPL Option 3b (rather than 3a), then
  the obligation only lasts for three years. This means that you do
  not have to provide source code for any executable code that was
  last distributed more than three years ago.


When this was brought up on debian-legal in 2002:
http://lists.debian.org/debian-legal/2002/09/msg00098.html
David Turner, self-proclaimed Free Software License Guru with a
gnu.org address, responded
http://lists.debian.org/debian-legal/2002/09/msg00102.html
in essence last distribution by the originator; if downstream parties
rely on 3c for their redistribution, parties downstream of *them* may
be out of luck of enough time has passed.



At least with CVS or our SCM of choice, 4+ years storage is
significantly less than 4+ years of koji builds.

-- 
Matt Domsch
Linux Technology Strategist, Dell Office of the CTO
linux.dell.com & www.dell.com/linux