Re: Embedded packaging of cygwin without installation

[Charles Wilson <cygwin@cwilson.fastmail.fm>]

[Please send all replies to cygwin-licensing at cygwin dot com as this 
is now becoming really off-topic for cygwin at cygwin dot com]

Hans Kaiser wrote:
> Okay maybe I have to precise more. I currently use a prepackaged version of
> the SF unxtools. Now I want to switch to cygwin, because I am working with
> cygwin since 2001 and it is pretty good!

Thanks (whatever MY thanks, as a small cog in a big machine, count for)

> I do not want to make money with the distribution!

But that's not the issue. The GPL allows you to make all the money you 
want from GPL'ed software.  But whoever you sell (or give) your binaries 
to, has a right to request ALL of your source, and ALL of the linked 
cygwin source, and the source of ALL of the other cygwin tools YOU ship. 
  Follow those rules, and we don't care how much money you make.

And then the GPL allows them to turn right around, change the 
mini-distro name from "Kaiser-cygwin" to "ripped-off-Kaiser-cygwin", 
recompile and sell it, too.  But they ALSO have to abide by all the GPL 
rules.

However, http://cygwin.com/acronyms/#YANALATEYHSMBSI

The issue is, Third Party Perverts^WProviders 
http://cygwin.com/acronyms/#3PP
make EVERYBODY's life harder. We just want to encourage potential 3PPs 
to instead be good cygwin citizens.

For everybody's benefit (theirs, other ex-3PPs who become good citizens, 
AND ours).

> For me it would be okay, if I could detect if there is a installed cygwin
> with my needed utils (bash, grep, sed, awk, read...)
> For now my only idea was to package it with my distribution.
> So here my new suggestion:
> 1.    is cygwin installed?
> 1.1.  yes, setup the environment-variables to use the installed one
> 1.1.1 are the needed tools installed?
> 1.1.2 no, run cygwin-setup and preselect the additionally needed tools
> 1.2.  no, run cygwin-setup with the preselected needed tools
> 
> Is this possible to realize?

That sounds almost ideal (to me, but I'm no authority).  Your proposed 
program logic, however, would have to be coded natively in your 
installer program/NSIS script/whatever -- for example, you can't use 
cygwin-bash to detect cygwin, except only in the grossest sense (I tried 
to CreateProcess("bash.exe") and it failed...) which is NOT what you 
want to do.

But overall, IMO, the outline above would make you a good cygwin 
citizen, and not a 3PP.

But you ALSO must provide all the source code for all of your binaries 
that link against cygwin, under an OSI-approved license (not necessarily 
the GPL, unless the GPL applies to your code for some other reason).

However, http://cygwin.com/acronyms/#YANALATEYHSMBSI


 From OUR perspective, the truly ideal scenario would be one of the 
following:

======
(1) (a) Just create a setup.exe-compatible package for your tool
     (b) create a cygwin "release" directory on a website of your control
     (c) populate it with all the cygwin packages (including -src) you 
want to include in your mini-distro PLUS all of the dependencies for 
those packages
     (d) create a setup.exe-compatible setup.ini script that describes 
the packages available on your site (use 'genini')
     (e) tell people to use setup.exe, with "custom mirror" set to your 
site, and 'install all'.  (FWIW, this is what I did for an internal 
customized cygwin distro for my employer)  If they already have cygwin, 
and/or newer versions of some of your copied packages, they get to keep 
their newer versions, and just pull in your special package, and any 
other requirements they don't already have.
     (f) alternatively, if setup.exe has cmdline args to set a specific 
mirror choice (I don't know), give your user a batch file that 
automatically runs setup.exe with --some-option your-mirror.

==== aside:
(No longer ideal to us; most of us like free (as in speech) software. So 
we're probably not going to go our of our way to make this easier for 
you -- but we can't stop you, either, as long as you follow the legal 
rules attaining to GPL software. That's why we can't STOP 3PP's, but 
just try to shame them into being (better) citizens).

To use this scenario in a money-making venture, you could distribute a 
customized setup.exe that, when accessing YOUR download site, requires 
some sort of licensing key or validation before downloading any binaries 
from that site.  This way, only the folks who have paid you are able to 
  (legally) get a copy of your binaries, so only those folks have the 
right to ask YOU for source.  (But then, they can still create 
"ripped-off-Kaiser-cygwin" and post it on any public website they like. 
The GPL allows that, and by linking to cygwinl.dll, YOUR app is GPL (or 
covered under some other OSI-approvide license, as allowed by cygwin's 
'exception clause' in its GPL license).

However, http://cygwin.com/acronyms/#YANALATEYHSMBSI
And don't expect us to help you write this custom setup.

(Now, if somebody hacks your site, and ILLEGALLY obtains your binaries 
(and source), the rules are tricky. You aren't liable, and you could 
(probably?) sue and/or prosecute the criminal.  But the genie really 
can't be put back in the bottle if the criminal puts the ill-gotten 
source on a public website. See the GPL FAQ over at the FSF.  And as a 
practical matter, this is no different to you than if one of your 
customers -- who all have a legal right to your source under some 
OSI-approved license because your binary links against cgywin1.dll -- 
posts it on that public website.)

However, http://cygwin.com/acronyms/#YANALATEYHSMBSI

Side note: this license key can't be hardcoded into your setup program, 
because setup.exe itself is GPL, so if you distribute a modified version 
of setup.exe to (unlicensed) potential customers, they can ask you for 
the source code of your setup.exe.  I hope the consequences of THAT are 
obvious... You might be able to use some sort of publickey/privatekey 
message signing, but those are details. And don't expect help for that, 
here.

Also, http://cygwin.com/acronyms/#YANALATEYHSMBSI

This is why most companies who make money using GPL software do it via 
"support contracts". Anybody can get "Company Foo's" software for free, 
but paying customers get access to faster servers, direct support from 
Company Foo's engineers, additional non-GPL tools that make using the 
GPL tools easier / more streamlined, etc.

This is why companies like WindRiver or TimeSys and others tend to feed 
their customizations to GPLed tools (like gcc, or the linux kernel) back 
to the public projects.  It's just easier for them: they have to 
distribute the source anyway, so maintaining a private fork that gets 
"differenter and differenter" from the public version is just plain hard 
[read: costs them money because they have employees spending more and 
more time maintaining this fork -- which means higher costs, and lower 
profits.  And it costs them calendar time, which means slower 
time-to-market, which in turn means possible loss of market 
share/sales/$$.  Which also means less profit].  Worse, keeping a 
"private" fork of GPLed software doesn't protect any "proprietary 
information" anyway -- 'cause they have to give that source away to 
their OWN customers -- and to their competitors if said competitor buys 
a single copy -- under the GPL.  So why not make their own lives easier, 
and push "their" changes back to the public project?

However, http://cygwin.com/acronyms/#YANALATEYHSMBSI
I also don't have business, economics, or marketing degrees, so please 
no quibbles about the rough economic "analysis" above. Smarter people 
than me have written reams of business plans in this area, go read (and 
complain to) them.
===== end aside

But, all this 'how to make money with GPLed software' is moot, because 
it doesn't apply to you -- you "do not want to make money with the 
distribution".  But *even so*, you have to abide by the GPL (or other 
OSI-yadda yadda), which means (1)(a)--(f), or (2)below, or your own 1, 
1.1, 1.1.1, 1.1.2, 1.2 proposal -- the GPL is about 'free as in speech' 
not 'free as in beer'.

But remember, http://cygwin.com/acronyms/#YANALATEYHSMBSI

======
Or
(2) (a) same as (1a)
     (b) petition for inclusion in the official cygwin distro. This 
requires adherence to cygwin packaging rules, plus affirmative votes 
from five active package maintainers. And even then, might be subject to 
vetos from the Project Lead(s) -- but you'll never know 'till you try.
     (c) but this would preclude any "money making" option because we 
aren't going to set up private, license-protected mirrors for Q. Random 
Guy's binary package (and his -src).  So that's out.

You could still sell "support" via some other mechanism  but that 
definitely doesn't involve us (unless your 'support' involves some 
mechanism that attempts to bypass/subvert the GPL in some 'clever' way. 
Then we care, because 'clever' almost always means 'actually illegal' -- 
just ask LinkSys).  But again, this doesn't matter to you.

However, http://cygwin.com/acronyms/#YANALATEYHSMBSI

--
Chuck

PS. Just in case you missed it:  http://cygwin.com/acronyms/#YANALATEYHSMBSI