Are the Linux distributions violating the GPL? Sends a shiver down your spine, don't it. Ce n'est pas possible! Perhaps unthinkable, but nonetheless, it may be true, at least true for that handful of crews using a package manager to distribute their distro-harmonized binary-format bundles.

Allow me to explain ...

First off, so there's no mistake, let's establish our ground rules and quote from the source, from the GPL2 Terms and Conditions, section 3:

"... The source code for a work means the preferred form of the work for making modifications to it. For an executable work, complete source code means all the source code for all modules it contains, plus any associated interface definition files, plus the scripts used to control compilation and installation of the executable."
GNU General Public License version 2

Ok, now, this says that if you distribute software, you must make the source available for free.

That means the source of the binary you are redistributing, including any patches you may have applied, the source code for the software you actually bundle.

Now here's where it maybe gets a little fuzzy, fuzzy enough for vendors to retain their proprietary edge while remaining inside the letter of the law if not it's spirit: C/C++ code is source, no question, and .h header files are also indisputably source code. So are Makefile and even configure.in and Makefile.in and herein the problem ... what about config.status?

A Problem of Replicating Results

To have the source code for the software I am using should mean that I am able to replicate the original package, completely; the GPL then grants me permission to make whatever modifications I might need to that package to suit my purposes, but it remains that I cannot modify the original binary unless I can replicate it.

With most distros, I can't. Or perhaps I can, but if I can, the path is not as obvious as "the scripts used to control compilation and installation of the executable".

True, I have the source code as it came from the original author, and so far it is all above board GPL friendly ... but what happens next? The distro package authors might apply their own patches to the code (often taken from disputed submissions to the core) and yes, they will include those patches (although not with any instructions for the application of them) so I do have the 'source code' ... at least I have it in principle, if I have the wits to figure out how to rethread the beads.

But then the process gets lossy: the distro packager will craft highly specific and distro-centric command lines to initiate the build, and that source code is completely hidden, unpublished, unavailable.

When Source is not Enough

Here's an example: Mozilla from Mozilla.org

The Mozilla browser has a massive list of program options to the configure stage, so many they provide an online form to help you manage all the choices (could do with some conflict resolution, but it's still a form) -- nowhere do the sources you download from mozilla.org even hint at the options chosen for the binary copy of mozilla or firefox that you have obtained via their installer!

You might duplicate the original, but only through labourious trial and error, or careful sleuthing and many private interviews.

Even if the defacto standard configure options are available someplace, our problem doesn't stop there: MandrakeLinux ships a slightly modified mozilla, patched and matched to their LSB-style directory structure, harmonized to their distribution, perhaps with a few patches applied ... the thing is, we don't know.

Our private-eye fees just doubled.

Now, to be fair to everyone, if you can hunt down the person who bundled the package, I'm sure they will be more than happy to share their configuration details, but the point is, the GPL doesn't say we have the right to hire a private investigator to locate missing persons, it says the source code, and even the modified source code and everything required to build and install the software, should be available, and free.

It's important

Here's the thing: The spirit of the GNU General Public License, the impetus of the GNU Manifesto, is to ensure that your computer works for you ... and mine for me, and that is a basic human right in a digital information society.

Here's a scenario from direct experience, and how I ended up writing this post: I'd been happily using XEmacs until I ran into some troubles forking background processes and someone suggested that I re-visit GNU Emacs -- I had used GNU before, since about 1986 or so, having only switched to XEmacs because I felt the need for GUI glamour, and by all accounts, GNU Emacs had, in version 21.3, finally caught up. So it was worth a shot.

And it worked beautifully for the purposes needed, but it was Ugly, and the scrollbars, having reverted to the ancient and arcane behaviours of the legendary Athena widget set, were a constant source of page-navigation sorrow.

Fortunately, the fix was relatively easy, at least, it was easy to state and also easy to consider given the spirit of the GPL: GNU Emacs had recently introduced the --with-x-toolkit=gtk configuration option, so all I needed to do was append this short simple string to the configure command line.

And that's when the fun started. The MandrakeLinux sources include the cannonical 21.3 FSF sources, a long list of patch-files tagged for versions back to 20.4 (for PPC?), no README.mdk, no master build, no hints whatsoever as to what this might be, what, if any, order dependencies I might need, and no mention of what would need to be fairly complex configure options to effect the MandrakeLinux directory structure.

All I could do was a simple recompile of the Emacs sources (with --prefix=/usr) and hope for the best. So far so good, but then, it's not like I have a suite of regression tests or anything. I'll just have to sweat it out ... and hope.

For the record, I'd tried something similar a while back with Mozilla, and not only could I not duplicate the standard binary distribution, but I couldn't even get a binary that would run without crashing.

Thus MandrakeLinux and Mozilla.org have given me the choice, I can build my own completely independent versions, or I can use their gracious gift binary edition as is and which probably suits them just fine.

Only ... what if I really really liked their thoughtfully and expertly patched distro-harmony all kept intact, I just wanted their version tweaked a little tiny bit my way? What say the distros then?

Go fish.

I'm not asking for their support, advice or even for their co-operation. I'm only asking for what's rightfully mine, expressly provided under the GPL.

Gifts vs Responsibility

Most distros operate out of volunteer labour, many of them pulling together community contributed packages kindly assembled by the users of that distro, and I am certainly thankful for everyone who contributes back to the free software pool no matter how small that contribution may be.

But there's this annoying matter of that section 3 in the GPL -- if someone graciously contributes patent-infringing code, we'd respectfully request they resubmit their modified redistribution with the offending portions removed or restated. The same, I think, may be needed here: As ugly as it is to consider picking through and monitoring all those thousands of packages across hundreds of GNU distros, when package maintainers bundle their SRC collections for general distribution, it is not enough to include the sources as they obtained them, the GPL (and likely other licenses as well) requires them to include the scripts for their added value.

It's the law, our law, and it's a good law. Like it or not, regardless how much extra bother it might be, when unpacked from the .src.rpm, the end-user must be able to exactly duplicate the distro edition. Exactly.

No if's, no and's, no but's.