Corresponding sources for GStreamer SDK?

[Benjamin Gilbert]

On 01/09/2015 03:41 AM, Sebastian Dröge wrote:
> You can find the exact download location of the source tarballs or GIT
> repositories used inside cerbero. See cerbero/recipes/*.recipe
>
> That's what is used during the build to get the exact sources used for
> the binaries.

Some of the recipes appear to be bound to a branch of an upstream Git 
repo, rather than to a tag or commit.  For example, if I check out the 
Cerbero 1.4.4 tag, I see this in gst-plugins-base-1.0.recipe:

class Recipe(recipe.Recipe):
     name = 'gst-plugins-base-1.0'
     version = '1.4'
     commit = 'origin/1.4'

Doesn't this mean that gst-plugins-base will be built from the tip of 
the 1.4 branch, rather than specifically from version 1.4.4?  If so, 
then without knowing which commits had been pushed to that repo at the 
moment a build was run, I cannot determine the exact source code 
corresponding to that build.

> Please let me know if I forgot to tag any releases and I'll try to fix
> that. For all the last releases there should be a tag.

1.0.7 and 1.4.5 are missing.  I had thought 1.4.2 was also missing, but 
apparently there wasn't a 1.4.2 binary release either.

>> However, that seems overly indirect, and surely every SDK user
>> isn't going to that much trouble. How are other SDK users ensuring
>> they fulfill their license obligations?
>
> You have to provide the sources on demand of your users,

That's not quite what the license says.  Section 6c of the LGPLv2.1 does 
allow distribution of binaries along with a written offer for source 
code.  However, section 6 only applies to a work which has been 
statically linked with an LGPL library, and *not* to standalone binaries 
of the libraries themselves.  Those are covered by LGPL section 4, which 
requires the sources to be distributed alongside the binaries.  (See the 
quote in my last mail.)  So, I can provide a written offer for source 
when distributing my app, but the GStreamer project can't do that for 
the SDK.

> and IMHO pointing them to the download locations as above is enough
> from our side.

The FSF says no:

http://www.gnu.org/licenses/old-licenses/gpl-2.0-faq.html#SourceAndBinaryOnDifferentSites

>> Could Cerbero be modified to produce a giant tarball of all the upstream
>> sources used in the build (and the build scripts, i.e. Cerbero itself),
>> which could then be uploaded alongside the binaries?
>
> Yes, but we don't have infinite storage space available and the binaries
> are already super huge.

I do understand the practical difficulties.  However, the project has 
specific obligations under the LGPL, and those obligations are not being 
met right now.

--Benjamin Gilbert