On Tue, 04 Mar 2014 12:07:04 -0500, Bradley wrote in message <[email protected]>:
> Finally, with regard to Ralph and Arnt's discussions of binary > checksum as way of CCS verification: > > I've do a *lot* of GPL compliance CCS verification; frankly, I've > surely done and/or overseen more of it than anyone else in history. > And, AFAICT, most GPL compliance training courses (like Linux > Foundation's) and would-be GPL enforcers completely ignore this most > important issue of GPL compliance: the source code must correspond to > the binaries distributed, and must include "scripts used to control > compilation and installation of the executable". And, if it doesn't, > then it's IMO missed the point of the GPL entirely and is thus a > serious and grave violation. (I often feel like one of just a few > people in the world who has even ever *read* GPLv2ยง3's penultimate > paragraph.) I'm thus grateful that folks on this list are discussing > this important issue. > > That said, rote verification of a sha256sum of the binary virtually > never works in CCS verification. I can't remember a single GPL > enforcement case where I got the same md5sum/sha1sum/sha256sum [0] for > the built binaries. However, I have determined GPL compliance in most > of those cases where the checksums didn't match. > > What Ralph hints at is indeed right: All the GPL experts that I know > believe that GPL requires the "scripts used to control compilation and > installation of the executable" to include details about what specific > compiler/linker should be used to build the software. However, > compilers are famous for doing things like including a timestamp in > the binary or a dozen other things that will yield a correct, > corresponding binary but one that doesn't share the exact same > checksum as the original binary. As such, if the checksums don't > match, the CCS may still be adequate, and further investigation is > needed to determine compliance. ..I disagree, once you have the _complete_ recipe, with correct compiler versions, settings, time stamps etc thrown in, you will be able to prove all your correct checksums etc in GPL compliance cases. _No_ need to back off here. ..but we should suggest a proper way to do this, so people like Mikrotek can properly document their checksums and the proper way to verify their checksums and GPL etc compliance. ..this probably means ditch all common assumtions and document _all_ variables, possibly even setting up virtual machines for the compile and checksum jobs and documenting exactly how to verify the checksums. ..we only need a simple and easy test, such as running "md5sum -c file-list" in court. Leave these long tall sweaty tSCOG-like stories on why-it-failed to the offenders. > [0] I've been doing GPL enforcement since md5sum was the preferred > checksum technique. :) -- ..med vennlig hilsen = with Kind Regards from Arnt Karlsen ...with a number of polar bear hunters in his ancestry... Scenarios always come in sets of three: best case, worst case, and just in case.
