Misc GPL Stuff

Auke was ruminating on how the GPL relates to a source distro (specifically, the one he runs, Lunar Linux). It raises some interesting questions. Is Lunar, as an entity, distributing binaries? Not in the literal sense: they just distribute sources, and some amount of patches, as well as a generic automated build system. All binaries are built on the user’s target machine (well, with the exception of the install CD, which I’ll get to in a minute). But does that “count” as anything more than source distribution? I would say no, but then, consider this (contrived) scenario (applicable to most source distros, not just Lunar):

Lunar user uses the Lunar package manager to install a piece of software named Foo. Say that when he does this, it’s version 1.0. Due to some quirks, the Lunar package manager has to patch the sources to get it to build properly (or perhaps to fix some icky bug, or whatever). So Lunar user happily uses Foo for a while, and decides he wants to give it to some friends. However, when he tries to find the sources to his binary (note that he’s required by the GPL to offer source in addition to the binary), he finds that Lunar has upgraded their version of Foo to 1.5, which is (for some reason) very different from 1.0.

So, where does he get the sources? And the patches applied by Lunar? What if the sources were modified by ‘sed’ scripts inlined into the build instructions, which are no longer available. Now, I suppose he could dig through Lunar’s Subversion repository, but is that kosher with the GPL?

I suppose it’s all moot, though: the GPL says that if you distribute binaries, you must make an offer to have the source available for three years. But what if you only distribute source? Does that change if you distribute source, plus patches? Do you have any future obligations at all?

Anyway, Auke also mentions this:

We only distribute binaries in lunar-linux through the ISO images (the installer cd). All the binaries on that image are created using the unmodified sources from the original websites. For the few packages that have patches, we use the patches from our own patch website URL. That’s according to the letter of the GPL and actually the *only* thing we’re required to provide.

I suggest you take a look at this FAQ entry. As an extension to that, regarding distributing only diffs from the original version with the binaries, see this one. So in other words, if you distribute binaries, you must also make available the full source used to create those binaries. The fact that it’s (currently) on the original author’s website is not enough.

And we wonder why most software development companies are so afraid of the GPL that they refuse to touch software “tainted” with it. Most of the people in our own community (including myself, on occasion) don’t even understand the license fully.