bug#21784: Old XZ tarballs

[Lasse Collin <lasse.collin@tukaani.org>]

On 2015-11-01 Ludovic Courtès wrote:
> Lasse Collin <lasse.collin@tukaani.org> skribis:
> 
> > On 2015-10-30 Ludovic Courtès wrote:
> 
> [...]
> 
> >> Guix does automatically mirror tarballs via its “substitute”
> >> mechanism. However, users can turn it off, in which case they end
> >> up downloading the tarball from the upstream URL specified in the
> >> package recipe.
> >
> > OK. :-) Why would users turn it off though?
> 
> The substitute mechanism is very generic; it’s not just about
> mirroring tarballs:
> 
>   http://www.gnu.org/software/guix/manual/html_node/Substitutes.html
> 
> Some people might prefer to build things locally rather than download
> pre-built items.

That makes sense, but I don't understand how it implies that the source
packages will then be downloaded from upstream servers. Since you are
distributing binary packages, I assume you are also distributing the
matching source packages due to many packages being under the GNU
(L)GPL. My understanding is that the GNU GPL requires that if you
distribute the binary, you must take care of making the source
code available too.

Anyway, I'm sorry for the hassle and for perhaps making a mountain out
of a molehill. Based on the number of xz-5.0.4.tar.gz downloads, Guix
users didn't create much traffic for me. You just happened to get
affected when I was trying to find out what distros where causing most
of the traffic.

-- 
Lasse Collin  |  IRC: Larhzu @ IRCnet & Freenode