[Fedora-livecd-list] SRPMS for installed RPMs?

[Douglas McClendon]

Douglas McClendon wrote:
> Matt Domsch wrote:
>> I want to be sure, for license compliance, that all the binary bits on
>> the final LiveCD have corresponding source code available.
>>
>> One of the "features" I'd like to see something in the stack of
>> livecd-tools produce is a CD/DVD/whatever of the SRPMS that match the
>> RPMs that go into the LiveCD.  Smooge and I have both done this
>> ourselves, with varying degrees of ease, essentially querying all the
>> installed RPMs on the LiveCD after-the-fact and generating the list,
>> then grabbing the files etc.  All very manual.  I expect there's a
>> better way, and I'm even open to helping code it, but am looking for
>> direction from you - those who know the tools best...
> 
> A more 'during the fact' approach would be to do an rpm -qa at the end 
> of your %post.  Then maybe still in the %post, iterate over that list 
> with rpm -qi, looking at the src rpm entry.
> 
> I notice yum has disabled by default source repos.  I can't immediately 
> see how to use them, but perhaps you could then further take the list 
> above, and still in the %post do something to query the source repos via 
> yum, perhaps temporarily downloading the src rpm, generating sha1sum, 
> such that the resulting livecd includes a list of sha1sums for every src 
> rpm.  Then it would be easy enough to after the fact, extract that list 
> from the livecd, and pull a collection of the src rpms.
> 
> Just some thoughts...  Perhaps somebody can tell me why the source repos 
> are there in the default yum config, and what can actually be done with 
> them via yum.

Ok, so I found yum-utils.  So you could iterate over your list of src 
rpms above, with yumdownloader --source, and yum-builddep to really make 
sure that you get all the source needed to rebuild the livecd.

Of course the true end-all, would be to then create an alternate version 
of your livecd, which included all of those things (and presumably some 
list of binary rpms needed for bootstrapping), as well as livecd-tools, 
in a /rebuild directory, such that this alternate live-bluray was 
completely capable of self-hosted-recompilation/production from included 
source (preferably from a simple script/program executable from the 
booted live-bluray, that requires no user interaction if it can find a 
suitably large tmpdir, and also no root privileges, if my aforementioned 
qrr program exists and is fully integrated)

That seems to me to be the most elegant way to distribute a gpl 
distribution :)

-dmc