MPL and Source Code

[Anthony DeRobertis]

Craig Southeren wrote:
> This means theoretically that the lifetime of a source release under the
> GPL is the same as a binary release. Once the binary is no longer
> distributed, then the source no longer has to be distributed either.
> As a user, the seems more than a little unreasonable, but if that's what
> the license says......
>
> The MPL requirement for 12 months seems quite reasonable, and I can't
> see that any packager (Debian included) would have a problem with
> meeting it.
>   
Well, first off, we have to set a boundary somewhere: While 1 year may 
seem reasonable, certainly 100 is not. Debian has chosen "for as long as 
the binary is being distributed" as our line between reasonable and 
unreasonable. There are several reasons that spring to mind:

   1. Distribution of source at least as long as distributing the binary
      is, I think we all can agree, in the best interest of free
      software (one of the priorities Debian pledges itself to in its
      Social Contract).
   2. Requiring distribution of source for longer than the binary does
      not allow me to stop distributing when I want; instead, it
      requires me to bear potentially high costs for X additional months.
          * Your web site is mentioned on Slashdot, suddenly you get a
            either a huge bandwidth bill or to turn your site off.
            You're just a student and can't afford the bill. But you
            have no choice; you must keep your site on for X months
            after you last distributed the binary.
   3. It is not possible to guarantee that you'll be able to distribute
      the source for X months after you stop distributing the binary
          * Your web hosting company's Internet connection breaks. You
            are suddenly in violation of the license.
          * You fall ill and thus are unable to pay your hosting bills.
            Once again, you're in violation (though a good lawyer could
            help you out of this one, I'm sure).
          * You lose your job. Once again, you're unable to pay your
            hosting bills. Now you're violating the license.
   4. Debian is already far too large. Many of our mirror ops have
      apparently been telling us we need to shrink our archive.
      FTP-masters (the people who run our FTP servers) are already
      splitting off a large section of the archive to help; certainly we
      don't want to make the archive even bigger!
          * It'd be difficult to track which programs require keeping
            source for X months after the binary. We'd have to track
            each different value of X individually as well. The end
            result would be that we'd wind up keeping all source for
            max(X₀, X₁, ...). This would substantially enlarge the archive.

These are just some quick thoughts. As you can see, there are some 
problems with requiring source to be kept longer than the binary. I 
think we're right drawing the line at "no longer than the binary."