Arnt Karlsen wrote: > ..it's not going to, until _after_ we have those easy simple test standards > in place for the courts and their jurors. Only once that happens, we can > start demand it in e.g. GPLv2.2+ and GPLv3.1+.
Your response indicates to me that you've probably never been involved heavily in a GPL violation lawsuit, at least in a jurisdiction that centers its legal system around an adversarial process. But I'm telling you based on extensive in-court experience that forcing the issue in this direction (perfect production of binaries) is not going to help us in the short or medium term. As a very long term solution, something like Ed's idea of requiring some way to verify what sources made what binary is useful, but a "rote perfect checksum" won't get us there because it's too technically difficult to get perfect such that it makes a viable compliance litmus test. Frankly, even if a litmus test that we *thought* worked in all cases existed, I'd be loathe to advocate for its inclusion officially in GPL. The moment a litmus test was written into GPL, violators, who are typically very wealthy companies, would seek and likely find a way to meet the litmus test but fail on all other areas of compliance. I really do encourage you to study the Conservancy v. Best Buy et al case. Seeing how the process actually works in practice will probably make it clear that this avenue isn't useful. However, as I said, I really appreciate your zeal about this and you clearly care deeply like I do about this. I'd love your help as a volunteer on doing CCS checks with violators if you have the time. Get in touch with me if you're interested. That's where we could use the help today to stop violations of the GPL. -- bkuhn
