If we're going to distribute MSIs for the Windows UI, we need to figure
out how we're meeting obligations of included licenses.
The most obvious such concern is the GPL; I think GPL2 and GPL3
obligations are approximately the same here.
IN particular, we need to distribute the sources to any GPL binary we
distribute, as well as the recursive sources to build dependencies.
That means, if we link against a GPL or LGPL library we need to
distribute the sources to that library as well as all its build and
run-time dependencies. So, for example we'd need to distribute sources
to the exact version of the GCC compiler used, to the exact versions of
all the dependencies, etc. There are some exceptions for Microsoft
system tools; the exceptions are different for GPL2 and GPL3, but I
don't think the corner cases should affect us.
This raises two questions:
1) How do we do this?
2) How do we audit that we're doing it? How do we guarantee that if we
update the compiler we're using for builds, we also update the sources
to that compiler?
I'm very interested in Codethink's input here as I've never managed this
for a Windows project. For Linux projects there are fairly good
tools. For example the Live DVD creation software has good tools for
also collecting the sources used in the process.
|