This is the mail archive of the cygwin mailing list for the Cygwin project.

Index Nav: [Date Index] [Subject Index] [Author Index] [Thread Index]
Message Nav: [Date Prev] [Date Next] [Thread Prev] [Thread Next]
Other format: [Raw text]

Re: Embedded packaging of cygwin without installation

[Please send all replies to cygwin-licensing at cygwin dot com as this is now becoming really off-topic for cygwin at cygwin dot com]

Hans Kaiser wrote:
Okay maybe I have to precise more. I currently use a prepackaged version of
the SF unxtools. Now I want to switch to cygwin, because I am working with
cygwin since 2001 and it is pretty good!

Thanks (whatever MY thanks, as a small cog in a big machine, count for)

I do not want to make money with the distribution!

But that's not the issue. The GPL allows you to make all the money you want from GPL'ed software. But whoever you sell (or give) your binaries to, has a right to request ALL of your source, and ALL of the linked cygwin source, and the source of ALL of the other cygwin tools YOU ship. Follow those rules, and we don't care how much money you make.

And then the GPL allows them to turn right around, change the mini-distro name from "Kaiser-cygwin" to "ripped-off-Kaiser-cygwin", recompile and sell it, too. But they ALSO have to abide by all the GPL rules.


The issue is, Third Party Perverts^WProviders
make EVERYBODY's life harder. We just want to encourage potential 3PPs to instead be good cygwin citizens.

For everybody's benefit (theirs, other ex-3PPs who become good citizens, AND ours).

For me it would be okay, if I could detect if there is a installed cygwin
with my needed utils (bash, grep, sed, awk, read...)
For now my only idea was to package it with my distribution.
So here my new suggestion:
1.    is cygwin installed?
1.1.  yes, setup the environment-variables to use the installed one
1.1.1 are the needed tools installed?
1.1.2 no, run cygwin-setup and preselect the additionally needed tools
1.2.  no, run cygwin-setup with the preselected needed tools

Is this possible to realize?

That sounds almost ideal (to me, but I'm no authority). Your proposed program logic, however, would have to be coded natively in your installer program/NSIS script/whatever -- for example, you can't use cygwin-bash to detect cygwin, except only in the grossest sense (I tried to CreateProcess("bash.exe") and it failed...) which is NOT what you want to do.

But overall, IMO, the outline above would make you a good cygwin citizen, and not a 3PP.

But you ALSO must provide all the source code for all of your binaries that link against cygwin, under an OSI-approved license (not necessarily the GPL, unless the GPL applies to your code for some other reason).


From OUR perspective, the truly ideal scenario would be one of the following:

(1) (a) Just create a setup.exe-compatible package for your tool
(b) create a cygwin "release" directory on a website of your control
(c) populate it with all the cygwin packages (including -src) you want to include in your mini-distro PLUS all of the dependencies for those packages
(d) create a setup.exe-compatible setup.ini script that describes the packages available on your site (use 'genini')
(e) tell people to use setup.exe, with "custom mirror" set to your site, and 'install all'. (FWIW, this is what I did for an internal customized cygwin distro for my employer) If they already have cygwin, and/or newer versions of some of your copied packages, they get to keep their newer versions, and just pull in your special package, and any other requirements they don't already have.
(f) alternatively, if setup.exe has cmdline args to set a specific mirror choice (I don't know), give your user a batch file that automatically runs setup.exe with --some-option your-mirror.

==== aside:
(No longer ideal to us; most of us like free (as in speech) software. So we're probably not going to go our of our way to make this easier for you -- but we can't stop you, either, as long as you follow the legal rules attaining to GPL software. That's why we can't STOP 3PP's, but just try to shame them into being (better) citizens).

To use this scenario in a money-making venture, you could distribute a customized setup.exe that, when accessing YOUR download site, requires some sort of licensing key or validation before downloading any binaries from that site. This way, only the folks who have paid you are able to (legally) get a copy of your binaries, so only those folks have the right to ask YOU for source. (But then, they can still create "ripped-off-Kaiser-cygwin" and post it on any public website they like. The GPL allows that, and by linking to cygwinl.dll, YOUR app is GPL (or covered under some other OSI-approvide license, as allowed by cygwin's 'exception clause' in its GPL license).

And don't expect us to help you write this custom setup.

(Now, if somebody hacks your site, and ILLEGALLY obtains your binaries (and source), the rules are tricky. You aren't liable, and you could (probably?) sue and/or prosecute the criminal. But the genie really can't be put back in the bottle if the criminal puts the ill-gotten source on a public website. See the GPL FAQ over at the FSF. And as a practical matter, this is no different to you than if one of your customers -- who all have a legal right to your source under some OSI-approved license because your binary links against cgywin1.dll -- posts it on that public website.)


Side note: this license key can't be hardcoded into your setup program, because setup.exe itself is GPL, so if you distribute a modified version of setup.exe to (unlicensed) potential customers, they can ask you for the source code of your setup.exe. I hope the consequences of THAT are obvious... You might be able to use some sort of publickey/privatekey message signing, but those are details. And don't expect help for that, here.


This is why most companies who make money using GPL software do it via "support contracts". Anybody can get "Company Foo's" software for free, but paying customers get access to faster servers, direct support from Company Foo's engineers, additional non-GPL tools that make using the GPL tools easier / more streamlined, etc.

This is why companies like WindRiver or TimeSys and others tend to feed their customizations to GPLed tools (like gcc, or the linux kernel) back to the public projects. It's just easier for them: they have to distribute the source anyway, so maintaining a private fork that gets "differenter and differenter" from the public version is just plain hard [read: costs them money because they have employees spending more and more time maintaining this fork -- which means higher costs, and lower profits. And it costs them calendar time, which means slower time-to-market, which in turn means possible loss of market share/sales/$$. Which also means less profit]. Worse, keeping a "private" fork of GPLed software doesn't protect any "proprietary information" anyway -- 'cause they have to give that source away to their OWN customers -- and to their competitors if said competitor buys a single copy -- under the GPL. So why not make their own lives easier, and push "their" changes back to the public project?

I also don't have business, economics, or marketing degrees, so please no quibbles about the rough economic "analysis" above. Smarter people than me have written reams of business plans in this area, go read (and complain to) them.
===== end aside

But, all this 'how to make money with GPLed software' is moot, because it doesn't apply to you -- you "do not want to make money with the distribution". But *even so*, you have to abide by the GPL (or other OSI-yadda yadda), which means (1)(a)--(f), or (2)below, or your own 1, 1.1, 1.1.1, 1.1.2, 1.2 proposal -- the GPL is about 'free as in speech' not 'free as in beer'.

But remember,

(2) (a) same as (1a)
(b) petition for inclusion in the official cygwin distro. This requires adherence to cygwin packaging rules, plus affirmative votes from five active package maintainers. And even then, might be subject to vetos from the Project Lead(s) -- but you'll never know 'till you try.
(c) but this would preclude any "money making" option because we aren't going to set up private, license-protected mirrors for Q. Random Guy's binary package (and his -src). So that's out.

You could still sell "support" via some other mechanism but that definitely doesn't involve us (unless your 'support' involves some mechanism that attempts to bypass/subvert the GPL in some 'clever' way. Then we care, because 'clever' almost always means 'actually illegal' -- just ask LinkSys). But again, this doesn't matter to you.



PS. Just in case you missed it:

Unsubscribe info:
Problem reports:

Index Nav: [Date Index] [Subject Index] [Author Index] [Thread Index]
Message Nav: [Date Prev] [Date Next] [Thread Prev] [Thread Next]