Corresponding sources for GStreamer SDK?

[Benjamin Gilbert]

On 01/08/2015 03:27 AM, Sebastian Dröge wrote:
> On Mi, 2015-01-07 at 21:47 -0500, Benjamin Gilbert wrote:
>> Is the complete corresponding source code for the GStreamer SDK packaged
>> for download somewhere?  <http://gstreamer.freedesktop.org/data/pkg/>
>> only seems to contain binaries, and I can't seem to find any reference
>> to the corresponding sources.
>
> See here: http://gstreamer.freedesktop.org/modules/
> e.g. http://cgit.freedesktop.org/gstreamer/gstreamer/
>
> The binaries are built with the cerbero build system, which is available
> from here: http://cgit.freedesktop.org/gstreamer/cerbero/

Thanks for your response, but what I'm looking for is the exact source 
code used to build the SDK binaries.  In addition to GStreamer itself, 
the SDK includes LGPL code from various other projects, including glib, 
pango, and libgcrypt.  Section 4 of the LGPLv2.1 says:

> You may copy and distribute the Library (or a portion or derivative
> of  it, under Section 2) in object code or executable form under the terms
> of Sections 1 and 2 above provided that you accompany it with the
> complete corresponding machine-readable source code, which must be
> distributed under the terms of Sections 1 and 2 above on a medium
> customarily used for software interchange.
>
> If distribution of object code is made by offering access to copy
> from a designated place, then offering equivalent access to copy the
> source code from the same place satisfies the requirement to
> distribute the source code [...]

I was therefore expecting to find source tarballs for those libraries 
somewhere on g.fd.o.  Absent those, I can't see how the official SDK 
releases are complying with the LGPL.

My own goal is to comply with my license obligations for an Android app 
I'm developing using the GStreamer SDK.  My app is GPLv2, so I'm 
required to distribute sources for every library I ship, even the 
permissively-licensed ones.  I can probably get the sources and patches 
from Cerbero if I can identify the Cerbero commit corresponding to an 
SDK release (non-trivial, since some releases were not tagged). However, 
that seems overly indirect, and surely every SDK user isn't going to 
that much trouble.  How are other SDK users ensuring they fulfill their 
license obligations?

Could Cerbero be modified to produce a giant tarball of all the upstream 
sources used in the build (and the build scripts, i.e. Cerbero itself), 
which could then be uploaded alongside the binaries?

--Benjamin Gilbert