Re: Attention anyone uploading binaries to ftp.gnome.org/pub/binaries - understand the GPL

[Colin Walters <walters verbum org>]

On Thu, 2011-09-22 at 10:17 -0400, Colin Walters wrote:

> You need to list the corresponding source code for *every one* of these
> libraries.  Otherwise we have no idea - it's whatever version of gtk+
> etc. happened to be installed on your workstation.

It'd also be fine probably if gtk-osx had SOURCES file for each release,
and then you could just copy&paste it into your SOURCES file, or name it
SOURCES-gtk-osx and just reference it; I'm sort of making up the format
of this file on the fly, so =)

(Should the SOURCES file be machine readable and executable, i.e. should
it be a jhbuild moduleset?  Maybe.  I'm not sure if we'll ever run
Windows or OS X VMs on the GNOME servers, so the immediate value would
be low.  But if 5 years later we discover a trojan in one of the
binaries or something and decide we should be building from source on a
well-known secure host, we can manually fix up the files.  One thing at
a time...)