Hi Sam

On Fri, 2011-05-27 at 09:24 -0400, Sam Hartman wrote:
> Ultimately, though, unless Josh steps in here, I'm going to need to make
>  this decision and I'm going to choose to be legally conservative.
> 
> 
> In addition, besides possible GPL obligations, I want to be able to
> reproduce the build environment for old versions.  One easy way to do
> this is to have build sources and binaries for what is released.
> 
> That is the approach I will take.

Apologies for not being on top of this discussion. I've spoken to
Alberto (who is a Gtk+ maintainer) and he advises:

1. the GPL only applies at link-time, so we don't need to distribute the
GCC sources. The C library used by the mingw compiler is MSVCRT.DLL
which is part of Windows.

2. Gtk+ is LGPL, and we are simply redistributing binaries provided by
them in the .msi. In the days before internet we would need to provide
the source code , but these days a simple link to the Gtk+ website will
do. I have not seen any Windows Gtk+ application that has redistributed
the source on their own website instead of just linking back to the Gtk+
website.

In terms of reproducing the build environment, this is constructed by
jhbuild, so simply saving the versions of the 'bootstrap-msys' and
'windows-stable' modulesets will allow you to rebuild every component
above the level of mingw and MSYS.

We could adapt jhbuild to manage the source code for the dependencies if
that is necessary, but based on the precedent of existing Windows Gtk+
applications and the advice of the Gtk+ team, I would say that isn't
required.

Sam