I'm going to try to ramp down my involvement in this subthread about
the philosophical question of whether and when the git history is a
necessary part of "the source code". Just one more message...
Gerardo Ballabio writes ("Re: What is the source code (was: [RFC] General
Resolution to deploy tag2upload)"):
> Il giorno mer 19 giu 2024 alle ore 19:03 Ian Jackson
> <ijack...@chiark.greenend.org.uk> ha scritto:
> > [the rest of your message]
>
> Overall, you make some very valid points. But if the concept that "the
> history is the source" were really upheld and taken to its
> consequences, it might disrupt the whole free software ecosystem.
I agree that there are implications for the way we share software.
(I prefer to think of this from an ethical and ideological point of
view, rather than a legal one.)
> Because, then, every upstream of a GPL project who develops on a
> private VCS (or without using a VCS) and only releases tarballs would
> be violating the GPL, and nobody could distribute binary packages
> because they couldn't provide the "complete corresponding source
> code".
I think a downstream who is using git, and distributing binaries,
should indeed publish their git history. (In the cases where git is
the source, but I think this is common.)
I don't know if it'sa still true, but a high-profile Linux distro were
in the habit of providing their Linux kernel sources to their users
only as an upstream source tarball plus a single giant diff - but,
internally they're using git. Keeping the git to themselves in this
situation seems like a fairly blatant trick to stop people from
exercising their (moral and legal) rights.
> And since Debian currently distributes only the current version in its
> source packages, Debian would be in violation too.
For these packages, I don't view the source packages as discharging
our (moral and legal) obligations, indeed. We *do* sort-of discharge
those obligations because typically the maintainer publishes the git
history on salsa, somewhere, in some form or other.
If you're a Debian expert, salsa is often where you get the source
code to a program if you want to seriously work on it. (It seems to
me that this is another strong signal that we *do*, in practice,
consider the salsa git repos to be the preferred form for
modification.)
> And tag2upload isn't a step towards fixing that, because (as I
> understand, correct me if I'm wrong) it too builds packages that only
> contain the current version.
Yes, tag2upload doesn't make source packages significantly better at
discharging our (moral and legal) obligations. It may have integrity
and convenience benefits, and fix a few anomalies, but it doesn't
improve the actual source packages very much.
But tag2upload *does* arrange the publication of the git history, in a
standardised and official and machine-useable place - the dgit-repos
git server.
So I think it does address this problem.
> Furthermore, there's another issue regarding the freeness of the
> package: if the source must include the history, then you aren't
> actually completely free to modify the source, because you can't
> delete the history.
I'm not sure if you mean a barrier that is practical, or legal/moral.
You certainly can rewrite the history. Whether you *should* is
another matter. (Sometimes you might be legally *required* to, as has
been discussed in elsewhere in this megathread.) I think this is
related to, for example the GPL's clause requiring notice of
modification (5(a)). Those notices are a bit like an invariant
section, too. I don't see the problem here that you do.
Ian.
--
Ian Jackson <ijack...@chiark.greenend.org.uk> These opinions are my own.
Pronouns: they/he. If I emailed you from @fyvzl.net or @evade.org.uk,
that is a private address which bypasses my fierce spamfilter.
