From debbugs-submit-bounces@debbugs.gnu.org Wed Feb 20 11:19:04 2019 Received: (at 34565) by debbugs.gnu.org; 20 Feb 2019 16:19:04 +0000 Received: from localhost ([127.0.0.1]:58353 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1gwUaO-0005hb-6s for submit@debbugs.gnu.org; Wed, 20 Feb 2019 11:19:04 -0500 Received: from lepiller.eu ([89.234.186.109]:51402) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1gwUaM-0005h9-2t for 34565@debbugs.gnu.org; Wed, 20 Feb 2019 11:19:02 -0500 Received: from webmail.lepiller.eu (static-176-182-42-79.ncc.abo.bbox.fr [176.182.42.79]) by lepiller.eu (OpenSMTPD) with ESMTPSA id 873aeaff (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256:NO); Wed, 20 Feb 2019 16:18:57 +0000 (UTC) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 8bit Date: Wed, 20 Feb 2019 17:18:56 +0100 From: Julien Lepiller To: Jason Self Subject: Re: bug#34565: ungoogled-chromium contains Widevine DRM In-Reply-To: <1550667811.25277.1.camel@jxself.org> References: <1550547897.31222.1.camel@jxself.org> <20190219070601.GA8273@jasmine.lan> <1550582906.5431.7.camel@jxself.org> <20190219144342.GA2688@jasmine.lan> <1550623152.12316.5.camel@jxself.org> <1550625137.14138.3.camel@jxself.org> <1550625587.14780.2.camel@jxself.org> <1550667811.25277.1.camel@jxself.org> Message-ID: X-Sender: julien@lepiller.eu User-Agent: Roundcube Webmail/1.3.8 X-Spam-Score: 0.0 (/) X-Debbugs-Envelope-To: 34565 Cc: 34565@debbugs.gnu.org X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -1.0 (-) Le 2019-02-20 14:03, Jason Self a écrit : > Jason Self wrote: >> I should probably add on that this position comes from my interaction >> with the FSF in 2010: When LibreWRT was founded in 2010 (before it >> later merged into libreCMC) we submitted a similar question to the >> FSF,as to if it was sufficient for the LibreWRT build scripts (which >> would be run by the person building the firmware image from source >> and would have completely automated, just like how someone might >> instruct Guix to build from source) to download Linux and then run >> the Linux-libre deblobbing scripts on it vs having the build scripts >> instead download tarballs that were already cleaned up. I can't seem >> to find the email from back then but the response was that we needed >> to use already cleaned-up tarballs, not ask the user to clean up the >> software afterward even if automated. So that was what we did. Guix >> should do something similar. > > I haven't been able to find this conversation in my email. As it seems > to be directly relevant to Guix, since it seems to also be the exact > same method they use, I have emailed the FSF asking if they can locate > this in their ticketing system and to re-send the conversation to me. > More to come. I think the situation is different though. You can see the build script inside the "origin" record as the liberation procedure that anyone can see and verify. It's also a procedure targeted at our build farms, so that they can produce the liberated source code. Users never manipulate non-free source code, unless something is wrong on the build farm side. Essentially, users only download the liberated sources, and build the package from that, or they download the sources from the build farm and build the package from that. The source they download is the one that `guix build -S foo` gives you, and the semantics is "give me the sources to build foo", not "build the sources of foo". I think that this way is more transparent, since we can independently, altough with tooling not provided by guix, check and re-run the liberation procedure that is documented as part of the guix package recipe. This is much better than trusting someone to have actually run the right liberation procedure as you can examine both the result and the procedure itself. I hope this is clearer now :) Well, I'm still interested by that discussion on libreWRT.