GNOME Bugzilla – Bug 742830
No corresponding sources for SDK binary packages
Last modified: 2016-08-26 19:55:07 UTC
The SDK binary packages on the GStreamer website contain LGPL-licensed libraries, but are not accompanied by complete corresponding source code as required by LGPLv2.1 section 4. See discussion here: http://lists.freedesktop.org/archives/gstreamer-devel/2015-January/051072.html Source code distribution is required only for the LGPL-licensed components, but please consider supplying sources for the permissively-licensed ones as well. That would make life easier for developers of GPL-licensed applications, who are required to distribute source code for all of their dependencies.
This has been my pet peeve with cerbero for a while. My suggestion is to add a command that creates the regular cerbero tarball (what make dist-tarball does), then adds the sources from ~/cerbero/sources/local to a "sources" subdirectory in that tarball. Then as a last step, modify cerbero to first try in the "sources" local subdirectory before trying to download from the Internet.
Created attachment 307116 [details] [review] source: Take sources from local directory instead of downloading if possible This will take the sources from the cerbero tarball instead of the Internet if the recipes were put into the tarball.
Created attachment 307117 [details] [review] setup: Only package selected recipes/packagees with --recipe/--package
Created attachment 307118 [details] [review] setup: Add command to include source code during sdist With --source-dirs, one can specify a list of source code directories to bundle
Created attachment 307119 [details] [review] fetch: Add --deps to also "fetch-package" to also fetch dependencies
Created attachment 307120 [details] [review] source-bundle: Add new command to generate a source bundle This creates a tarball with all of the source code needed to rebuild the selected packages, including the Cerbero source code. This allows for easy GPL compliance.
Here is a patchset that adds a command to create a source bundle for a particular platform. To use it, do ./cerbero-uninstalled source-bundle <package1> [package2] ... This will create a giant tarball with all the source that was used to build the relevant packages. I also added a "--deps" to fetch-package to make it easy to just fetch all of the source code for a package, then create a giant tarball, move it to a container/VM with no network and try to build it to make sure the bundle is complete. By default, the tarball includes the sources to the build tools, but not to the toolchains, I think we should just add recipes for the toolchains too so they're not special things.
Created attachment 307276 [details] [review] setup: Add command to include source code during sdist With --source-dirs, one can specify a list of source code directories to bundle
Created attachment 307277 [details] [review] fetch: Add --deps to also "fetch-package" to also fetch dependencies
Created attachment 307278 [details] [review] git: Also fetch submodules during the fetch stage Instead of fetching the submodules during the build, do it as the fetch stage. Also copy the submodules from the local sources during the local checkout.
Created attachment 307279 [details] [review] bundle-source: Add new command to generate a source bundle This creates a tarball with all of the source code needed to rebuild the selected packages, including the Cerbero source code. This allows for easy GPL compliance.
Created attachment 307280 [details] [review] setup: Match cerbero version to GStreamer version Also change the URL to the upstream GStreamer
commit 49d7555bb33a0926125e25615c8d9edfda29b9df Author: Olivier Crête <olivier.crete@collabora.com> Date: Fri Jul 10 14:53:23 2015 -0400 setup: Match cerbero version to GStreamer version Also change the URL to the upstream GStreamer https://bugzilla.gnome.org/show_bug.cgi?id=742830 Merged! When building the next binary packages, please also ./cerbero-uninstalled bundle-source <package> and create source packages so fully compliant! commit 8b706ae58763c3b9ce133e473846a2b67ed83cc6 Author: Olivier Crête <olivier.crete@collabora.com> Date: Wed Jul 8 20:05:41 2015 -0400 bundle-source: Add new command to generate a source bundle This creates a tarball with all of the source code needed to rebuild the selected packages, including the Cerbero source code. This allows for easy GPL compliance. https://bugzilla.gnome.org/show_bug.cgi?id=742830 commit 6692a69b6abe35bca60e9e1975aef8a54736a7b0 Author: Olivier Crête <olivier.crete@collabora.com> Date: Fri Jul 10 14:48:01 2015 -0400 git: Also fetch submodules during the fetch stage Instead of fetching the submodules during the build, do it as the fetch stage. Also copy the submodules from the local sources during the local checkout. https://bugzilla.gnome.org/show_bug.cgi?id=742830 commit a4da77b0b759eaf8a131f33a6daed6c76364f885 Author: Olivier Crête <olivier.crete@collabora.com> Date: Wed Jul 8 20:04:53 2015 -0400 fetch: Add --deps to also "fetch-package" to also fetch dependencies https://bugzilla.gnome.org/show_bug.cgi?id=742830 commit 848be21cd07002f8d9c230aed5233b433cda8dba Author: Olivier Crête <olivier.crete@collabora.com> Date: Wed Jul 8 15:15:45 2015 -0400 setup: Add command to include source code during sdist With --source-dirs, one can specify a list of source code directories to bundle https://bugzilla.gnome.org/show_bug.cgi?id=742830 commit 0d02965d68d27800416c622f2935b68925db45e7 Author: Olivier Crête <olivier.crete@collabora.com> Date: Tue Jul 7 16:11:23 2015 -0400 setup: Only package selected recipes/packagees with --recipe/--package https://bugzilla.gnome.org/show_bug.cgi?id=742830 commit 35e20b47d8ba3597d8d4c4b41a37d0152ed31e47 Author: Olivier Crête <olivier.crete@collabora.com> Date: Mon Jul 6 18:56:30 2015 -0400 source: Take sources from local directory instead of downloading if possible This will take the sources from the cerbero tarball instead of the Internet if the recipes were put into the tarball. https://bugzilla.gnome.org/show_bug.cgi?id=742830
As of SDK 1.6.0, there are still no corresponding sources posted on the GStreamer website.
Sources for 1.6.1 are here: http://gstreamer.freedesktop.org/data/pkg/src/1.6.1/
There's one detail that we still need to work out: That source bundle was done using the Android config. Other architectures/platforms may have slightly different build deps, and generate a different bundle. The differences are minor though - not worth a 557MB tarball for each of the 5 builds that mostly contain identical contents. We need a sensible way to merge the source tarballs, or generate one big bundle that incorporates all the deps for a set of target architectures.
Corresponding sources have not been posted for any SDK release since 1.6.1.
There again since latest release.
Corresponding sources have not been posted for 1.8.3 or 1.9.1. Are there changes that can be made to the release process to prevent this issue from recurring?
1.8.3 is there, 1.9.1 seems pointless as it's only a pre-release. Benjamin, did you actually use the sources for anything meaningful already? Can you confirm that they contain everything needed?
1.9.1 is there too now.
I haven't personally audited the source bundles, so I can't confirm that they're complete. We're distributing them with the sources for our GPL Android app.