Re: Next Steps For the Software Heritage Problem

[Dale Mellor <guix-devel-0brg6a@rdmp.org>]

On Tue, 2024-06-18 at 07:19 -0700, Ian Eure wrote:
> Hi MSavoritias,
> 
> Thank you for the email.
> 
> I’m going to lay out this situation as clearly as I can, in the 
> hope that others will better understand, and hopefully treat it 
> with the seriousness it deserves.
> 
> 1. Guix requests SWH to archive some source code.  This is fine.

  No, it's not.  I use Guix as a tool to develop my own projects, private and
personal for reasons I'm keeping to myself.  As part of that I write package
definitions for them, and use the Guix machinery to build and test.  I *cannot*
have Guix just giving my code away to anybody, that is just fundamentally wrong.

  We need to ask what is Guix?  A free operating system, a framework for
developing free operating systems, or a more generic tool for software
development and deployment?  If the latter it *cannot* do nefarious things
without explicit consent.

  I think at least there should be a /restricted/ license type available to
package definitions, and the system absolutely should not give source code away
from packages which use this (of course, they won't get into the official
distribution, but that's fine).

  More broadly, I think they should just stop inter-operating with SH.  Just
walk away.

Dale