[Openstack-devel] Websockify has been rejected from upload in Debian

[Joel Martin]

Thomas,

BTW, it might be helpful to think of the noVNC master repository as a
"larger work". noVNC pulls together a bunch of other components plus the
noVNC core code to create the noVNC project.

Here is an example of one of the chains:
- noVNC includes websockify (https://github.com/kanaka/websockify) which
includes both server-side (websocket.py, websockify) and client side
components (e.g. websock.js, ).
- websockify's client side includes web-socket-js (
https://github.com/gimite/web-socket-js)
- web-socket-js includes SWFObject, the gsolo MD5 implementation, the
hurlant crypto library, etc.

I've filed a pull request with gimite to include the original source for
swfobject.js: https://github.com/gimite/web-socket-js/pull/135 Once he
pulls that in I will update the noVNC tree to reflect that.

I've also added a git submodule to point to the original web-socket-js tree
to both noVNC and websockify.

On Thu, Apr 11, 2013 at 12:35 PM, Thomas Goirand <thomas at goirand.fr> wrote:
>
> > I would
> > be surprised if there is such a clause since it would imply that a
> > Debian ISO build would not be free software in the same sense because
> > the source is not physically included (only provided externally).
>
> We also build source ISO images. Though these days, almost everyone
> download from internet, so it is a less known feature, so it is
> understandable that you didn't know.


Certainly I knew about it. But that doesn't change the point that somebody
could download an ISO build that doesn't include the source, but the build
is still 100% free and open source because the source is just as easily
available as the binaries even though it is separate. This is also true of
noVNC (even before I added the submodule links).


> > Your very request is for me to change the way I maintain noVNC
>
> No, my request is that you add the missing source code in your
> repository, so that your project can be said 100% free and open source.
> I wouldn't like to impose anything on anyone.
>

I've added the submodule link to the web-socket-js source. Other options
would require me to change my workflow because I would need to do munging
(and therefore extra testing) of upstream project trees that I don't
control. noVNC is just a side project for me now. I would like to keep the
limited time I do have to be able to actually enhance noVNC and websockify
and not spend any of it complying with extra Debian process overhead.


> My understanding is that this .swf file is there only to add support for
> web sockets in older browser. With time, this is becoming a feature less
> and less important, as newer browser have the feature.
>

Absolutely. I will celebrate the day when I feel like I can remove this
entirely (I am not a Flash fan). Unfortunately, we're not there yet.


> Can't you, instead, just ship swobject.js unobfuscated (that's easy to
> do, right?), and provide a link to the .swf blob somewhere? Is this
> completely unacceptable for you? If so, then we must agree to not agree,
> and indeed, I will continue to ship websockify as <version>+dfsg,
> showing that I had to modify upstream code to make it follow the Debian
> Free Software Guidelines.
>

I've issued the pull request to gimite/web-socket-js to add the original
swfobject.js source to his tree. When (if) he pulls that in then I will
update to reflect that. I've also added the git submodule link to the
version of his tree that the current swf file is built from. If that's not
sufficient (my read of the DFSG is that it should be sufficient), then yes,
you'll probably need to maintain the separate dfsg tree for Debian.


> P.S: Are you going to the OpenStack Summit? It would be nice to meet you
> there.
>

I would love to, but unfortunately I am not. noVNC and websockify are no
longer part of my paid job so I don't have a sponsor to pay my way.

Regards,

Joel Martin (kanaka)

P.S. I'm not sure if Debian work is part of what you are paid to do or not,
but regardless, I wanted to say thank you for doing all the work to package
up OpenStack packages for Debian. I've worked before as a release engineer
creating a large custom Linux distro (Gentoo based) and it's pretty tedious
and thankless work. So thanks!
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.alioth.debian.org/pipermail/openstack-devel/attachments/20130412/220a20f8/attachment.html>