On 3/24/07, Mike McGrath <mmcgrath@xxxxxxxxxx> wrote:
My question is, who knows the finer details of what the GPL requires us to keep?
My quickie analysis follows. This is not legal advice, IANAL[1], and I'm certainly not an expert on the GPL. To top it off, the GPL is unfortunately vague on this point. But I think the analysis is likely fundamentally sound. I believe non-commercial mirrors are not required to keep source. They need only "accompany [the Program] with the information [they] received as to the offer to distribute corresponding source code." (Sec. 3(c)). To allow mirrors to take advantage of Sec. 3(c), Fedora would need to provide to the mirrors a 'written offer ... to give any third party ... a complete machine-readable copy of the corresponding source code.' (Sec. 3(b)) This offer would need to be good for three years from the date of distribution- presumably from the date of the last, rather than the first, distribution, though the language is vague on that point. As to what constitutes a 'written' offer... I believe that an email/web page would suffice to fulfill the spirit of the requirement. The text could read something like 'In keeping with the requirements of the GPL v2 Sec. 3(b), the Fedora Project offers a copy of the corresponding source code to any third party who downloads these binaries. This corresponding source code is available from the master source server at __________.' You'd give this text to the mirrors to put in any directories with binaries in them, and perhaps (to be safe) put it in a text file on the top level of every ISO as well. The more places you put the offer, the better off you likely are ;) *****Note that the term 'written' may have magical/mystical legal meanings in a license context. I strongly recommend asking a real lawyer about that.***** So, to summarize what I think to be the correct situation for minimum storage requirements in keeping with GPL v2: (1) the master server hosted by the party which created the new binaries from the modified source (i.e., Fedora) must publicly host a 'written' offer to freely distribute source code to anyone who asks, good for three years after the date of the *last* distribution of the binaries. (2) the master server must maintain a copy of that same source code for three years after the date of the last distribution of the binaries. (3) assuming that mirrors are non-commercial and do not modify the binaries, mirrors don't need to keep source, as long as they prominently host a copy of the official 'written' offer mentioned in (1). Two further notes: (1) Are you sure GPL is the only license with applicable source code redistribution requirements? GPL may allow mirrors to not mirror source, but other licenses may not be so forgiving. I have no idea what breadth of licenses are in Fedora. (2) Assuming the language in the latest draft stays roughly the same, these instructions should be valid for GPL v3 as well. The requirements there are slightly different, but overlap enough that they should not pose a problem. (As a bonus, v3 clarifies 'written' in the network mirror context to mean "clear directions next to the object code saying where to find the Corresponding Source." I think following that language would be a good guideline for fulfilling the v2 requirements, though again IANAL and written may have special magicolegalist[2] meanings.) HTH, sorry it is a little rambling- Luis [1] I need a blog post explaining this in more detail. [2] Yes, I just made that up. And I love it. _______________________________________________ fedora-advisory-board mailing list fedora-advisory-board@xxxxxxxxxx http://www.redhat.com/mailman/listinfo/fedora-advisory-board
