From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Thompson, David" Subject: Re: Guix and FSDG Date: Fri, 22 Nov 2019 12:03:36 -0500 Message-ID: References: <91c877cfe5d19d192b53da2c7cd2a741c30a37f7.camel@disroot.org> Mime-Version: 1.0 Content-Type: text/plain; charset="UTF-8" Return-path: Received: from eggs.gnu.org ([2001:470:142:3::10]:56261) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1iYCLi-0004mH-Lu for guix-devel@gnu.org; Fri, 22 Nov 2019 12:04:08 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1iYCLf-0002Cn-GM for guix-devel@gnu.org; Fri, 22 Nov 2019 12:04:02 -0500 Received: from mail-vk1-xa2b.google.com ([2607:f8b0:4864:20::a2b]:38028) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_128_CBC_SHA1:16) (Exim 4.71) (envelope-from ) id 1iYCLX-00029v-8w for guix-devel@gnu.org; Fri, 22 Nov 2019 12:03:51 -0500 Received: by mail-vk1-xa2b.google.com with SMTP id m128so204010vkb.5 for ; Fri, 22 Nov 2019 09:03:47 -0800 (PST) In-Reply-To: <91c877cfe5d19d192b53da2c7cd2a741c30a37f7.camel@disroot.org> List-Id: "Development of GNU Guix and the GNU System distribution." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org Sender: "Guix-devel" To: Raghav Gururajan Cc: guix-devel Hi, just a quick note to begin: Please do not cross-post to multiple mailing lists because it tends to cause confusion for everyone reading those lists. I have included only guix-devel in the CC list for this reply. On Wed, Nov 20, 2019 at 5:02 AM Raghav Gururajan wrote: > > (b) Facilitation of non-free information/code/program/software: > As per FSDG, free system should neither steer users nor refer to third- > party repositories, to obtain information/code/program/software that > can contain non-free parts. Let's consider the same two main things > provided by Guix, that are, (i) Package Definitions (Scheme Code) and > (ii) Subsitiutes (Pre-Built Binary). If we take substitutes,they are > pre-built binaries, built on the guix build farm, where the source is > obtained, de-blobbed (if required) and compiled. Since guix provides > substitutes only for free software/programs, there is no facilitation > of non-free information/code/program/software here. If we take the > package definitions, that is were issue rises. When no substitutes are > available or when the program/software is chosen to be built, guix on > the user's system does this: downloads source directly from upstream > (along with non-free parts if it contains), then strips out non-free > parts (if any), then builds and installs binaries. So these package > definitions, contains information/lines-of-code, that steer users or > refer to third-party repositories, to obtain > information/code/program/software that can contain non-free parts. > Therefore, Guix DOES violate FSDG in this aspect. I believe this is incorrect and I will explain why. This exact circumstance was brought up in the early days of the Guix project when FSDG compliance was a big topic of discussion because Ludovic and RMS were making sure that Guix conformed to it. It is true that Guix will download source archives for packages that *may* contain files with a nonfree license. However, Guix has a special mechanism developed specifically to deal with this issue. In Guix, the data type is used to store information about a package's source code. In this data structure there is a field called "snippet" which may contain a custom procedure written by the person that wrote the package. The role of the snippet procedure is to *remove* any files in the source archive that are not freely licensed. The result is a new source archive that contains only freely licensed files. The most important part of this process is that the original source archive is *never* accessible to the Guix user via any Guix tools. The original archive is discarded and does not end up in the canonical location for Guix data: /gnu/store. Thus, running `guix build --source problematic-package` will only ever return the cleaned archive, never the original with nonfree files. Therefore, Guix has taken sufficient technical measures to avoid steering its user towards nonfree software and thus Guix is compliant with the FSDG. Hope this helps, - Dave