From mboxrd@z Thu Jan 1 00:00:00 1970 From: Marius Bakke Subject: bug#34565: ungoogled-chromium contains Widevine DRM Date: Wed, 20 Feb 2019 15:37:15 +0100 Message-ID: <87wolumspw.fsf@fastmail.com> References: <1550547897.31222.1.camel@jxself.org> <20190219070601.GA8273@jasmine.lan> <1550582906.5431.7.camel@jxself.org> <20190219144342.GA2688@jasmine.lan> <1550623152.12316.5.camel@jxself.org> <1550625137.14138.3.camel@jxself.org> Mime-Version: 1.0 Content-Type: multipart/signed; boundary="=-=-="; micalg=pgp-sha512; protocol="application/pgp-signature" Return-path: Received: from eggs.gnu.org ([209.51.188.92]:43868) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1gwTn1-0002YN-Mt for bug-guix@gnu.org; Wed, 20 Feb 2019 10:28:06 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1gwTmu-0000Rz-Av for bug-guix@gnu.org; Wed, 20 Feb 2019 10:28:00 -0500 Received: from debbugs.gnu.org ([209.51.188.43]:57550) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_128_CBC_SHA1:16) (Exim 4.71) (envelope-from ) id 1gwTmp-0000PP-E2 for bug-guix@gnu.org; Wed, 20 Feb 2019 10:27:54 -0500 Received: from Debian-debbugs by debbugs.gnu.org with local (Exim 4.84_2) (envelope-from ) id 1gwT0c-00012I-Hc for bug-guix@gnu.org; Wed, 20 Feb 2019 09:38:02 -0500 Sender: "Debbugs-submit" Resent-Message-ID: In-Reply-To: <1550625137.14138.3.camel@jxself.org> List-Id: Bug reports for GNU Guix List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: bug-guix-bounces+gcggb-bug-guix=m.gmane.org@gnu.org Sender: "bug-Guix" To: Jason Self , 34565@debbugs.gnu.org --=-=-= Content-Type: text/plain Jason Self writes: > A different but related matter is the build process itself. I > understand this is not exactly related to the DRM matter but it does > seem similiar. I can open another bug over this if needed. I have > recently submitted upstream's Chromium 73.0.3683.45 into my FOSSology > instance for analysis. Actually, less than a third of the total files > were classified as "BSD-like". In total it found 162 unique licenses. > Of course, automated licenses analysis is never perfect and I have not > fully vetted any particular results but it does help to at least > indicate that which is very clearly free software and that which needs > further investigation. To avoid duplicate work, it would be useful if you ran this analysis on the tarball produced by `guix build --source ungoogled-chromium`. > Even in the short time I was reviewing it I found a number of freedom > problems. I don't mean that to be an exhaustive list of everything, > merely an indicator of a symptom: > > * unrar (license denies freedom 0) UnRAR is not present in the Guix source. > * third_party/blink has some images under CC-BY-NC-SA-2.0 I cannot find these images: grepping for CC-BY-NC-SA or 'Creative Commons' did not aid. Did you record the absolute paths to these files? > * Google Toolbar is in there, with a non-free EULA My grep-fu is really failing me today. Where is this located? > Taking this and considering Guix's build process: The method of > building seems to involve downloading Chromium, then runnning > ungoogled-chromium over it, and then building. I'm not sure if any > other packages have their freedom problems fixed in this way but this, > just like build flags, should not be sufficient. Freedom problems > should not be hidden/removed after the fact by asking the user to run a > clean-up program after downloading the source, even if that has been > automated by the package manager. What is sent to the end user to > compile should itself be 100% free software and FSDG compliant from the > beginning. If not it still amounts to distributing non-free software to > the user when they want to, for example, do guix build -S chromium. As Leo says, `guix build --source` should never return nonfree software as a matter of policy. Ungoogled-Chromium is no different: running `guix build --source ungoogled-chromium` will run the pruning scripts and generate a sanitized tarball, or (more likely) transparently download an already-processed source from the build farm. --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQEzBAEBCgAdFiEEu7At3yzq9qgNHeZDoqBt8qM6VPoFAlxtZhsACgkQoqBt8qM6 VPqsOgf/SymCu2BiYdx8tadD4zwI1gkUYVznrflJYFeHTQuF6cx7vmMxL0HPyPTM gEQEm8q3EXdvHOpY/j5eW/KwSv5O5/ICwaHk36zvA3AVQTgzpXfvQNjjtxRT5rIq eSzVDEGtbsX1X+mZCeXsIv1qoJzAaOT0E9kV8qONEcYvdUh084GAGKyku+2kO452 yW+2iyKGbljWWwevx3IcDpP5Vuy8IctY224sXIH6p5LrEibEX2Cw/3PWohjse1j2 GOrVPAD39oggU4hIoHbXKYMYX/fDAHZlfFLW2mjS5cjEzOV9IZpld1rHS1w0W5i+ PEp+/7Vq8B/SvX/AxXV1zRLKljw60g== =AyoI -----END PGP SIGNATURE----- --=-=-=--