MPL and Source Code

[Craig Southeren]

On Tue, 04 Apr 2006 23:13:32 -0400
Anthony DeRobertis <anthony at derobert.net> wrote:

> Craig Southeren wrote:
> > This means theoretically that the lifetime of a source release under the
> > GPL is the same as a binary release. Once the binary is no longer
> > distributed, then the source no longer has to be distributed either.
> > As a user, the seems more than a little unreasonable, but if that's what
> > the license says......
> >
> > The MPL requirement for 12 months seems quite reasonable, and I can't
> > see that any packager (Debian included) would have a problem with
> > meeting it.
> >   
> Well, first off, we have to set a boundary somewhere: While 1 year may 
> seem reasonable, certainly 100 is not. Debian has chosen "for as long as 
> the binary is being distributed" as our line between reasonable and 
> unreasonable. There are several reasons that spring to mind:

Not sure where the 100 years came from - I certainly never proposed it! :)

The MPL states 12 months, and the GPL had three years (for certain
methods of distribution) but I don't know of any license that required
100 years. I agree that any such period of time would be unfairly
onerous.
 
>    1. Distribution of source at least as long as distributing the binary
>       is, I think we all can agree, in the best interest of free
>       software (one of the priorities Debian pledges itself to in its
>       Social Contract).
>    2. Requiring distribution of source for longer than the binary does
>       not allow me to stop distributing when I want; instead, it
>       requires me to bear potentially high costs for X additional months.
>           * Your web site is mentioned on Slashdot, suddenly you get a
>             either a huge bandwidth bill or to turn your site off.
>             You're just a student and can't afford the bill. But you
>             have no choice; you must keep your site on for X months
>             after you last distributed the binary.
>    3. It is not possible to guarantee that you'll be able to distribute
>       the source for X months after you stop distributing the binary
>           * Your web hosting company's Internet connection breaks. You
>             are suddenly in violation of the license.
>           * You fall ill and thus are unable to pay your hosting bills.
>             Once again, you're in violation (though a good lawyer could
>             help you out of this one, I'm sure).
>           * You lose your job. Once again, you're unable to pay your
>             hosting bills. Now you're violating the license.
>    4. Debian is already far too large. Many of our mirror ops have
>       apparently been telling us we need to shrink our archive.
>       FTP-masters (the people who run our FTP servers) are already
>       splitting off a large section of the archive to help; certainly we
>       don't want to make the archive even bigger!
>           * It'd be difficult to track which programs require keeping
>             source for X months after the binary. We'd have to track
>             each different value of X individually as well. The end
>             result would be that we'd wind up keeping all source for
>             max(X0, X1, ...). This would substantially enlarge the archive.
> 
> These are just some quick thoughts. As you can see, there are some 
> problems with requiring source to be kept longer than the binary. I 
> think we're right drawing the line at "no longer than the binary."

These are all fair and reasonable arguments, and as someone who pays for
a web hosting site for an Open Source project out of my own pocket, I
can certainly appreciate that there are costs associated with
distribution

My point is simply that having the source available for only as long as
the executable is available seems to me (as a consumer) to be pretty
severe. This has been discussed before in this thread, so I'll not
rehash my thoughts on this matter.

But lets bring this back to the point I tried to make initially.

I don't see that the MPL (or the GPL) requires that there are
pre-packaged source packages available that correspond one-to-one basis
for executable packages.

As such, I think that the Debian CVS/SVN server meets the definition of
electronic distribution for the terms of the MPL - provided that there
are appropriate tags/revision markers available for each identified
release, AND provided the revision control system is publically
available, AND provided the revision control system contains all of the
sources, AND provided historical revision information is not purged
within 12 months of a release.

Is there is any reason why any of these requirements would not be met?

Is there any disagreement as to whether this would apply?

   Craig

-----------------------------------------------------------------------
 Craig Southeren          Post Increment – VoIP Consulting and Software
 craigs at postincrement.com.au                   www.postincrement.com.au

 Phone:  +61 243654666      ICQ: #86852844
 Fax:    +61 243673140      MSN: craig_southeren at hotmail.com
 Mobile: +61 417231046      

 "It takes a man to suffer ignorance and smile.
  Be yourself, no matter what they say."   Sting