On Wed, 05 Mar 2014 22:54:46 +0000, Joseph wrote in message <[email protected]>:
> Hi Arnt, > > On 05/03/2014 12:17, Arnt Karlsen wrote: > > ..I disagree, once you have the _complete_ recipe, with correct > > compiler versions, settings, time stamps etc thrown in, you will > > be able to prove all your correct checksums etc in GPL compliance > > cases. _No_ need to back off here. > I'm interested to know whether we're talking theoretically or not; ..I'd like to get this sort of thing, practical, and established as _the_ way to prove GPL etc compliance. Jurors don't like to trust some sleazy expert witness dude on things they don't understand, "they want an _easy_ test they can do themselves." > have you yourself personally achieved GPL compliance in this way? Or > have you been able to compile, say, a linux kernel on one machine, > then setup another machine from scratch and produce a kernel with an > identical checksum? ..nope, I've been much to busy at Groklaw.net. (The closest thing would be my own wee bash stunts ahead of http://wiki.flightgear.org/Scripted_Compilation_on_Linux_Debian/Ubuntu but we don't do checksum listing here yet, various other things missing, e.g. building .deb etc packaging, but I did get the guys to add brlcad style nameing so fgfs can live together with e.g. boostv1.54.0-4+b1-fgfs-w-glsl-$(git-commit-du-jour) in the same path, using the distro packaging system to keep track of the experiments, but we don't use this brlcad style names here, we drop all builds in their own install trees.) ..but this script is a fine start. http://wiki.flightgear.org/Scripted_Compilation_on_Linux_Debian/Ubuntu > I'd tried to produce identical checksum binaries from various > compilers in the past; I've never succeeded in that, but on one > occasion, after applying an awful lot of preparation, and writing a > custom tool that excluded certain parts of the binary from > comparison, we did manage to produce "identical" binaries. > > I'm unsure how many companies would adopt such a strategy. ..companies needs a standard way to do these things. Nowadays, they come in 4 major categories, decent people doing the right things correctly, decent people getting caught doing the right things wrongly, doucebags getting caught doing the wrong things wrongly, and doucebags getting away with it doing the wrong things "correctly." "An _easy_ test jurors can do themselves", makes life easier for decent people, and harder for bad people, which is how most people wants justice done. > The GPL only requires them to provide source that matches the > binaries, it does not (by my reading) require them to provide proof > beyond doubt that the source and binaries match. ..then we disagree on our readings, but I do agree it's hard to require them to provide proof beyond doubt that the source and binaries match when we have no standard way to prove compliance, this also leaves jurors etc at the mercy of litigators hiring more or less sleazy expert witness telling stories on things the jurors and judges can't easily understand and verify. -- ..med vennlig hilsen = with Kind Regards from Arnt Karlsen ...with a number of polar bear hunters in his ancestry... Scenarios always come in sets of three: best case, worst case, and just in case.
