Re: patches question

[ng0 <ng0@we.make.ritual.n0.is>]

On 2016-06-24(02:09:39PM+0200), Ludovic Courtès wrote:
> Hello!
>
> ng0 <ng0@we.make.ritual.n0.is> skribis:
>
> > diff --git a/config/Makefile.in b/config/Makefile.in
> > --- a/config/Makefile.in
> > +++ b/config/Makefile.in
>
> I view this patch as upstream work that Guix should not carry.  To put
> it differently, it’s not Guix’s missing to maintain a fork of Firefox
> (or any other package).

I cleared up some code since I posted this. We do not have to include the
patch for the libraries (if this is what this was refering to).

> > (define-public firefox
> >   (package
> >     (name "firefox")
> >     (version "45.2.0esr")
>
> What is the goal here?
>
> Guix proper can provide IceCat (which modifies Firefox to comply with
> trademark rules, to comply with the GNU FSDG¹, and to enhance privacy),
> maybe Tor Browser (assuming it complies with the FSDG as well), but not
> stock Firefox (unless the trademark issue and FSDG violations are
> resolved.)

Writing a base for torbrowser, as icecat is too old for torbrowser
(different version of firefox) and I'd like to replicate torbrowser
in a way which is compatible to us.
If this requires to construct the browser based on what icecat does
but with guix package phase patching, I see no problem with this
other than potential legal issues which need to be clarified by other
people.

> Besides, I think it should be possible to (inherit icecat) rather than
> duplicate all the recipe.

True, but between 38.8 and 45.2.0 things change, patches can not be reused,
and the reason I gave above.

> Hope this clarifies things!
>
> Thanks,
> Ludo’.
>
> ¹ https://www.gnu.org/distros/free-system-distribution-guidelines.html
>

I am more willing to maintain another fork of firefox than to
wait for icecat to be recent enough to be usable as a base for
a torbrowser package.

Additionally I was about to get in contact with torproject and
ask about possible trademark/confusion issues on their side,
the unsent email:

Hello,

I'm currently in the process of packaging a modified firefox
for GNU Guix[1], for safety labeled "icepanda" for now.
My intention with this is to provide a base package for a
torbrowser which will be compatible for us as a GNU project.

The resulting torbrowser will be different from what
torproject ships in binaries:
- we need to remove certain addons of base firefox,
- replace as much included libraries with our system
  packaged libraries as possible,
- replace the mozilla store which recommends non-free
  software
   - there are two solutions here, the long term one
     I prefer is to import browser addons into our
     reproducible store
- rebrand the firefox to prevent trademark issues.

Once torbrowser can inherit this firefox brand and
is functional this way, we will inform users that
this is an unofficial build and that usage might be
dangerous depending on their threat level etc
(comparable to the pkg_postinstall() in [0]), a note
which has yet to be written.
The base (firefox) is obviously altered, but I can not
tell at this moment how much of torbrowser, if anything
at all, needs to be adjusted. My guess is that torbrowser
specific changes can technically be included without
problems, the practical part leads me to my question.

Potential usage issues I am interested in include if/how
much the default fingerprint of the webbrowser differs
from the binary you ship.

The question I now have is, are we allowed to use the name
torbrowser for the binary substitute we will distribute,
or is this a potential trademark / confusion issue (as
written in your FAQ) and we should pick a different name
like "onionpanda" (going with the current work in progress
name "icepanda")?

[0]: https://data.gpo.zugaina.org/torbrowser/www-client/torbrowser/torbrowser-45.2.0_p602.ebuild
[1]: https://www.gnu.org/s/guix

--
♥Ⓐ ng0
For non-prism friendly talk find me on
psyced.org / loupsycedyglgamf.onion