Jonathan Wilson wrote at 07:18 (EST) on Thursday: > Why not simply have the makefiles for the program in question do a > shasum of the source, put that checksum into some source file and have > the file linked into the binaries in a way that can easily be found.
This is the basis of Ed's idea, but the problem becomes wasting a lot of space. A shasum of the entire source in aggregate, plus "scripts used to control compilation and installation of the executable", won't be that helpful. > Although I guess the question then becomes "what goes into the shasum" Exactly right! What if there's a one-byte change somewhere in a build script, or a space added to a source file? What you want is a more fine-grained set of shasums for each component, possibly with pathnames somehow encoded, etc. The idea would not just to be able to tell "does this source match" (the answer to that is almost always "no", anyway) but "what source is missing when it doesn't match", or "how can I quickly check that the change to the sources since this was built is surely benign"? > Now some GPL violators will simply strip the feature out before > shipping but for those who don't, it will help in verifying that the > source they distribute matches the binaries. Right, this idea is purely to make testing compliance of good actors easy. -- -- bkuhn
