Group: Software/FSDG distributions

Revision as of 11:04, 17 January 2023

Introduction

This page can track some differences between FSDG compliant distributions.

This could help see if FSDG distributions can collaborate more on some topics.

Documentation

Since some of the issues that FSDG distributions have to deal with are the same, it sometimes make sense to have common documentation. So it makes sense to track the license and software used for documentation and wikis in order to see how to improve collaboration and common resources.

Distribution	Documentation		Wiki
Distribution	Link	License	Link	License	Software
N/A			Libreplanet	GFDL 1.3+ and copyright assignment	Mediawiki
Dragora			No Wiki found
Dynebolics			No Wiki found
Guix	guix.gnu.org/en/manual guix.gnu.org/en/manual/devel	GFDL 1.3 (+?)	libreplanet.org/wiki/Group:Guix	GFDL 1.3+ and copyright assignment	Mediawiki
Hyperbola			wiki.hyperbola.info	CC BY-SA 4.0	Dokuwiki10
LibreCMC			librecmc.org/fossil	CC BY-SA 4.0	Fossil
Parabola			wiki.parabola.nu	CC BY-SA 4.0	Mediawiki
ProteanOS					Ikiwiki
PureOS
Replicant				CC BY-SA 3.0	Redmine, migration to Mediawiki planned.
Trisquel
Ututo

General policies

While FSDG compliant distributions need to follow the Free System Distribution Guidelines, they can also have additional policies that are more strict on other aspects.

Knowing that not only enables to choose the most adapted FSDG distribution to one's needs, but it is also important to keep in mind when trying to build cross-distribution collaboration.

For instance non-functional data licensed under the CC-BY-ND licenses is not allowed in Parabola but it might be allowed in other FSDG compliant distributions, so what might be a bug in Parabola is not necessarily a bug in other distributions.

Distribution	Free culture^[1]	Licensing strictness	Require package to be built from source	Reuse packages or binaries	Computer support
Dragora
Dynebolics
Guix	No^[2]	Seems to be strict^[3].	Yes	Only to build some compilers.	No restrictions
Hyperbola			Yes^[4]
LibreCMC
Parabola	Yes	Requires all the licenses of a package to be known. Doesn't require to have a mapping between files or files content and licenses.	Yes^[5]	Reuse some packages from various distributions: Arch Linux Arch Linux ARM Arch Linux 32	Restrictions exist only for official support for ARM computers: Requires a free software bootloader Requires documentation in the wiki Requires a package to ship the bootloader
ProteanOS
PureOS
Replicant	Unknown (no decision)	Weak^[6].	No^[7]		To support a device, Replicant requires: an isolated modem a replaceable battery to be able to install Replicant without nonfree software
Trisquel
Ututo

Reusability and compatibility with different legal jurisdictions

If for some reasons we want to reuse an FSDG distribution and also make sure that a given FSDG distribution is legally redistributable, we at least need to:

Look if the distribution we reuse has a DRM circumvention and software patents related policies compatible with the place where we want to redistribute it, or to avoid redistributing packages incompatible with the local legislation.
Make sure that there are no compiled software that contain combined work from license like the GPLv2 and the CDDL, that may be compatible at the source level, but result in a non-redistributable binaries.
Also look if our use matches the trademarks policies of the distribution.
Find how to ship the corresponding source code.

This can be useful in various situations:

For instance when people deploy or redistribute (part of) FSDG distributions in organization that want to avoid legal risk/
Or in context where people or organization are already targeted by some repression, to avoid extra legal risk.

In other cases some people resist unjust laws by not obeying them or by not collaborating to make it easy to respect them.

Also note that for software patents, there is no way to avoid them all, and knowing about specific patents increase the penalty in case of software patent infringement. Here the best way to fix that is to get various legislation modified to completely ban software patents, and use community defense^[8] in the meantime to lower the risks.

DRM circumvention and software patents related policies

This table tries to document if there is a policy with regard to DRM circumvention and software patents, and also looks in practice what packages are available. Note that some distributions might not have decided on a policy and many distributions also inherit packages from a parent distributions, so that also affect the available packages in practice.

	Distributions
	Dragora	Dynebolics	Guix	Hyperbola	LibreCMC	Parabola	ProteanOS	PureOS	Replicant	Trisquel	Ututo S
Libdvdcss			Yes	Yes		Yes				No, but has instructions to install it^[9].
Official policy									No restrictions^[10].

License combination and compiled software

Distribution	Packages to avoid
Dragora
Dynebolics
Guix	Guix has 2 packages that needs to be avoided when redistributing various software or images made with Guix^[11]: zfs (Mix CDDL and GPLv2 in a combined work) zfs-auto-snapshot (depends on zfs) Note that Guix takes care of making sure that these packages are not pulled as dependencies by other packages, so it's very easy to avoid them (just not install them).
Hyperbola
LibreCMC
Parabola
ProteanOS
PureOS
Replicant
Trisquel
Ututo

References

↑ The FSDG has a section on non-functional data: "Data that isn't functional, that doesn't do a practical job, is more of an adornment to the system's software than a part of it. Thus, we don't insist on the free license criteria for non-functional data. It can be included in a free system distribution as long as its license gives you permission to copy and redistribute, both for commercial and non-commercial purposes. For example, some game engines released under the GNU GPL have accompanying game information—a fictional world map, game graphics, and so on—released under such a verbatim-distribution license. This kind of data can be part of a free system distribution, even though its license does not qualify as free, because it is non-functional.".
So Free culture means that the distribution has a policy to go beyond what the FSDG requires and requires all works to be licensed under a free license, even if they are non-functional data.
↑ According to an conversation on #guix on Liberachat the 05 January 2023, Guix sticks to the FSDG:
18:46 < GNUtoo> hi, I've a quick question: Does Guix require free licenses for non-functional works (like game data) or not? The FSDG allows licenses like cc-by-nd for that (but not the -nc ones).
18:46 < GNUtoo> The only thing I found on that is the following: https://guix.gnu.org/en/manual/devel/en/guix.html#Software-Freedom
18:46 < GNUtoo> but it's unclear if the question was considered or not
18:47 < nckx> We don't deliberately stray from the FSDG, in either direction, when it comes to licencing.
18:47 < nckx> (We might reject packages for other reasons out of its scope.)
18:48 < GNUtoo> ok, so I assume that cc-by-nd is ok for non-funcional data then, thanks a lot
↑ According to bug bug #51352, in the case of bundled dependencies, Guix seems to require a list of dependencies<->license. The ungoogled-chromium package definition seems to have such a list. Though long time ago, some people (bill-auger and Neox) told me that the license list was incomplete. So it probably needs someone independent to look into it to see if it's still the case today or not, as things also improved over time. Also note that packaging a cleaned up Chromium takes time, and Chromium also gives Google control of the web standards, so there might also be unrelated reasons why various distributions do not package chromium or code based on Chromium.
↑ https://wiki.hyperbola.info/doku.php?id=en:philosophy:chromium_flaws mentions that we (hyperbola) "require all software to be built from source"
↑ The documentation on Parabola blacklist format mention that blacklisting Arch Linux packages not built from source (by Arch Linux) need to be removed or replaced as the packages "must be compiled from source, as we are stricter about that than Arch is". Packages not build from source are package whose package definition download binaries and package the binaries.
↑ The license list is generated and available in the settings, but there are no package definitions, so it's not easy to check the licenses. People need to look in each git repository to see the precise license. Some repositories have licensing data in the form of empty files with license names. These are probably picked by the code that generates the license list.
↑ Even if binary packages are allowed, Replicant still needs to ship the complete and corresponding source code of binary packages as well, otherwise this would make the package nonfree and/or create license compliance issues for Replicant.
↑ Basically use crowdfunding for funding a legal defense when attacked, ask help from people for information on how to invalidate the patents, etc.
↑ https://trisquel.info/en/wiki/enable-dvd-playback
↑ Replicant didn't take any decision related to patents or DRM circumvention.
↑
There was a discussion on the Guix mailing list about including support for the ZFS linux module and/or depending on it for Gnome in the guix-devel mailing list. The conclusion of this discussion was that there was strong proof that compiled modules were not redistributable, and so Guix chose to avoid redistributing them. Guix also made sure that the ZFS linux module cound't be pulled on accidentally, for instance by installing gnome. However at the time people discussing weren't able to find strong enough proof of the fact that the source code itself was not redistributable, or any information that this source code was redistributable at all. The Software concervancy legal analysis that is pretty well detailed was enough to show that binary distribution was not permitted but it didn't analyze precisely the case of a source-only distribution. The FSF also has published some analysis of the situation that seems to imply that source-only distribution also violates the GPL:
- https://www.fsf.org/licensing/zfs-and-linux
- https://www.fsf.org/news/interpreting-enforcing-and-changing-the-gnu-gpl-as-applied-to-combining-linux-and-zfs
But there wasn't the level of details required to really convince Guix maintainers. A precise analysis of what parts of the GPL and CDDL conflicted (with the citations) and how they apply to source only distribution would probably have been sufficient but no one took the time to do this research and report on it.

[1] The FSDG has a section on non-functional data: "Data that isn't functional, that doesn't do a practical job, is more of an adornment to the system's software than a part of it. Thus, we don't insist on the free license criteria for non-functional data. It can be included in a free system distribution as long as its license gives you permission to copy and redistribute, both for commercial and non-commercial purposes. For example, some game engines released under the GNU GPL have accompanying game information—a fictional world map, game graphics, and so on—released under such a verbatim-distribution license. This kind of data can be part of a free system distribution, even though its license does not qualify as free, because it is non-functional.".
So Free culture means that the distribution has a policy to go beyond what the FSDG requires and requires all works to be licensed under a free license, even if they are non-functional data.

[2] According to an conversation on #guix on Liberachat the 05 January 2023, Guix sticks to the FSDG:
18:46 < GNUtoo> hi, I've a quick question: Does Guix require free licenses for non-functional works (like game data) or not? The FSDG allows licenses like cc-by-nd for that (but not the -nc ones).
18:46 < GNUtoo> The only thing I found on that is the following: https://guix.gnu.org/en/manual/devel/en/guix.html#Software-Freedom
18:46 < GNUtoo> but it's unclear if the question was considered or not
18:47 < nckx> We don't deliberately stray from the FSDG, in either direction, when it comes to licencing.
18:47 < nckx> (We might reject packages for other reasons out of its scope.)
18:48 < GNUtoo> ok, so I assume that cc-by-nd is ok for non-funcional data then, thanks a lot

[3] According to bug bug #51352, in the case of bundled dependencies, Guix seems to require a list of dependencies<->license. The ungoogled-chromium package definition seems to have such a list. Though long time ago, some people (bill-auger and Neox) told me that the license list was incomplete. So it probably needs someone independent to look into it to see if it's still the case today or not, as things also improved over time. Also note that packaging a cleaned up Chromium takes time, and Chromium also gives Google control of the web standards, so there might also be unrelated reasons why various distributions do not package chromium or code based on Chromium.

[4] ttps://wiki.hyperbola.info/doku.php?id=en:philosophy:chromium_flaws mentions that we (hyperbola) "require all software to be built from source"

[5] The documentation on Parabola blacklist format mention that blacklisting Arch Linux packages not built from source (by Arch Linux) need to be removed or replaced as the packages "must be compiled from source, as we are stricter about that than Arch is". Packages not build from source are package whose package definition download binaries and package the binaries.

[6] The license list is generated and available in the settings, but there are no package definitions, so it's not easy to check the licenses. People need to look in each git repository to see the precise license. Some repositories have licensing data in the form of empty files with license names. These are probably picked by the code that generates the license list.

[7] Even if binary packages are allowed, Replicant still needs to ship the complete and corresponding source code of binary packages as well, otherwise this would make the package nonfree and/or create license compliance issues for Replicant.

[8] Basically use crowdfunding for funding a legal defense when attacked, ask help from people for information on how to invalidate the patents, etc.

[9] ttps://trisquel.info/en/wiki/enable-dvd-playback

[10] Replicant didn't take any decision related to patents or DRM circumvention.

[11] There was a discussion on the Guix mailing list about including support for the ZFS linux module and/or depending on it for Gnome in the guix-devel mailing list. The conclusion of this discussion was that there was strong proof that compiled modules were not redistributable, and so Guix chose to avoid redistributing them. Guix also made sure that the ZFS linux module cound't be pulled on accidentally, for instance by installing gnome. However at the time people discussing weren't able to find strong enough proof of the fact that the source code itself was not redistributable, or any information that this source code was redistributable at all. The Software concervancy legal analysis that is pretty well detailed was enough to show that binary distribution was not permitted but it didn't analyze precisely the case of a source-only distribution. The FSF also has published some analysis of the situation that seems to imply that source-only distribution also violates the GPL:

https://www.fsf.org/licensing/zfs-and-linux

https://www.fsf.org/news/interpreting-enforcing-and-changing-the-gnu-gpl-as-applied-to-combining-linux-and-zfs

But there wasn't the level of details required to really convince Guix maintainers. A precise analysis of what parts of the GPL and CDDL conflicted (with the citations) and how they apply to source only distribution would probably have been sufficient but no one took the time to do this research and report on it.

[12] ttps://www.fsf.org/licensing/zfs-and-linux

[13] ttps://www.fsf.org/news/interpreting-enforcing-and-changing-the-gnu-gpl-as-applied-to-combining-linux-and-zfs

[1]

[2]

[3]

[4]

[5]

[6]

[7]

[8]

[9]

[10]

[11]

@@ Line 147: / Line 147: @@
 :48 < GNUtoo> ok, so I assume that cc-by-nd is ok for non-funcional data then, thanks a lot</br>
   </ref>
-|
+| Seems to be strict<ref>According to bug [https://issues.guix.gnu.org/51352 bug #51352], in the case of bundled dependencies, Guix seems to require a list of dependencies<->license.
+The [https://packages.guix.gnu.org/packages/ungoogled-chromium ungoogled-chromium] package definition seems to have such a list. Though long time ago, some people (bill-auger and Neox) told me that the license list was incomplete. So it probably needs someone independent to look into it to see if it's still the case today or not, as things also improved over time. Also note that packaging a cleaned up Chromium takes time, and Chromium also gives Google control of the web standards, so there might also be unrelated reasons why various distributions do not package chromium or code based on Chromium.</ref>.
 | Yes
 | Only to build some compilers.

Navigation menu