Missing distfiles before July 2, 2012

[Joshua Root]

On 2012-9-3 06:10 , Jeremy Huddleston Sequoia wrote:
> 
> On Sep 2, 2012, at 07:24, Joshua Root <jmr at macports.org> wrote:
> 
>>> Our policy had previously been to keep all old distfiles. This is especially valuable for old software projects whose web sites have gone away, or for projects which use unversioned and thus impermanent distfiles, and whose distfiles are thus only available on our mirrors, assuming the mirror fetched them at the time. That was actually one of the primary reasons why we set up distfiles mirrors of our own. If my assumption above is correct, then we still have distfiles of the latest version of all ports that we had before, we've just lost access to earlier versions of some of them.
>>>
>>> I have no problem with the retention policy changing, if disk space is becoming a problem, I was just surprised to find old files missing with no announcement of intention to do that, so I thought I'd ask.
>>
>> This does affect users following the InstallingOlderPort instructions
>> for some ports. There's also a GPL compliance issue in that we no longer
>> offer the corresponding source for older archives of GPL'd software that
>> are still available on packages.macports.org.
>>
>> So if we don't bring back the older distfiles, we have to remove the
>> older archives, at least those for (L)GPL'd ports.
> 
> That's not now the GPL2 works.  The GPL2 does not require the source code to be mirrored by us or even for it to be *easily* accessible or downloadable.  It just requires that we either distribute source, let users know how to request the source from us (with requester paying reasonable processing, shipping, and handling costs), or direct the requester to the upstream provider of the source code.  We currently satisfy this requirement with the third case (cf GPL2 3(c)) by listing the site in the Portfile.

We don't include the requisite "written offer" with our archives, so I
don't believe 3(b) or 3(c) apply to us. We stay compliant by offering
"equivalent access" to the source as per the last paragraph of section 3.

GPLv3 section 6(d) does allow the equivalent access to be on a third
party server, but it doesn't remove the obligation to ensure that the
source is available as long as the binary is being distributed. So
again, the easiest way for us to stay compliant is to mirror all the
source in case all the third party mirrors go away (which has actually
happened in a number of cases).

- Josh