[task #16596] Submission of simphone

[Ineiev]

Follow-up Comment #7, task #16596 (group administration):


> Due to the sensitive nature of any product deeply connected to encryption and
> the reaction of officials worldwide towards it, we have no interest in seeing
> our names mentioned and ask you to respect our privacy.

You needn't explain why you want to be pseudonymous; but if you do, you
shouldn't blame cryptography, that will smell like snake oil.  Contributors to
packages like GnuPG post their signed certificates of origin right on public
mailing lists of those packages.

> We are committed to
> maintaining Simphone as we have already done in the last four years, and of
> course if we get contributions from third parties that we want to accept, we
> are going to have to ask them to sign these legal statements that you
> require.

In fact, I don't think we require to really sign anything.  What we want is
clearly stating copyright status of the entire package.

>> You shouldn't assume that the user can easily access any particular web
>> page.
>> You may assume is that the user has the complete tarball, and it should
>> contain anything needed to understand the licensing terms of the files
>> included.
>
> This is exactly the reason why we added creative-commons.txt to the tarball.
> But adding our own notice inside the text file may be misinterpreted as
> modifying the license text. Are you sure it's necessary? The text file does
> contain a notice (near the end) saying "The text of the Creative Commons
> public licenses is dedicated to the public domain..." and then goes on to say
> something about "unauthorized modifications" to the text.

"...dedicated to the public domain under the CC0 Public Domain Dedication."

I stand corrected.  Then it's a copy of CC0 that is missing from your tarball.

>>>>> and build/config-win32.
>>>>
>>
>> I don't think I understand the technical side.  The point of the configure
>> script is to gather information about user's system and preferences, so it
>> should run on user's computer and generate those files; they are not
>> supposed
>> to be distributed to user.
>
> This is exactly what happens on unix-like systems. On windows, mingw as
> provided by Qt does not include /bin/sh, so configure scripts cannot run
> without access to other software. We want to make it easy for users to
> produce
> the same binaries we compile and distribute for all target systems. Binary
> reproduction is important for security reasons as a much better way of
> ensuring integrity, rather than a signature that identifies the origin but
> still leaves the content of the binary unknown. Cross-compilation is not
> implemented yet, so what we offer for the windows version is a batch file
> that
> compiles the source code on the native system, using only Qt/mingw.
> Fortunately, the configuration is fixed (for a fixed version of mingw),

But the binary reproduction and possibly even building is broken when mingw
version changes.  I'm not sure if you care about the reproducibility
specifically on that platform.  From Savannah policies perspective, that might
qualify as a feature unsupported on free systems.  I don't think it works, but
if a goal is set, it may be achieved some day.

> Qt source code is not part of our tarball at all. To compile Simphone and
> produce a binary, a user needs both our tarball and the Qt source code (or
> alternatively, the Simphone shar installer).
...
> You can verify the above results by inspecting our shar installer, which
> includes only source code that we really use. Any Qt source files that are
> not
> part of the installer, are also not part of compiled Simphone binaries
> (regardless of whether one used the shar installer or the tarball to generate
> them) on free operating systems.

Thank you!

>> Indeed; these files are under LGPLv2.1+ and GPLv2+; I assumed *-only when
>> you
>> said, 'GPL2' and 'LGPL 2.1'.
>
> So am I to understand that we can also keep the code in udev/ (autoconf
> script
> etc.) in addition to the really needed code in udev/libudev/?

Yes, of course.



    _______________________________________________________

Reply to this item at:

  <https://savannah.gnu.org/task/?16596>

_______________________________________________
Message sent via Savannah
https://savannah.gnu.org/

signature.asc
Description: PGP signature