[ANN] Cygwin-OpenSSH 8.2.2.2

[ANN] Cygwin-OpenSSH 8.2.2.2

[Bill Stewart]

I have updated the package:

https://github.com/Bill-Stewart/Cygwin-OpenSSH

Installer is available on the 'Releases' tab.

Description:

Cygwin-OpenSSH is a convenient packaging of the Cygwin version of OpenSSH
for Windows systems.

Notable changes:

- Updated OpenSSH to version 8.2

- Updated cygwin1.dll to 3.1.4

- posh.exe (default shell, launches PowerShell) can now launch PowerShell
Core (if installed)*

- ps1exec.exe replaced with runposh.exe (supports PowerShell Core)

- Minor script updates

*To use PowerShell Core instead of Windows PowerShell, modify /etc/profile
to run '/bin/posh -c' instead of just '/bin/posh'.

Bill

--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple

Re: [ANN] Cygwin-OpenSSH 8.2.2.2

[ASSI]

Bill Stewart writes:
> Installer is available on the 'Releases' tab.

You will perhaps want to read the Cygwin licensing terms
plus the licensing terms of each of the packages you distribute.


Regards,
Achim.
-- 
+<[Q+ Matrix-12 WAVE#46+305 Neuron microQkb Andromeda XTk Blofeld]>+

SD adaptations for KORG EX-800 and Poly-800MkII V0.9:
http://Synth.Stromeko.net/Downloads.html#KorgSDada

--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple

Re: [ANN] Cygwin-OpenSSH 8.2.2.2

[Bill Stewart]

On Wed, Feb 26, 2020 at 11:47 PM ASSI wrote:

You will perhaps want to read the Cygwin licensing terms
> plus the licensing terms of each of the packages you distribute.
>

The relevant licenses are provided as links in the installer and referenced
in the User's Guide.

Bill

--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple

Re: [ANN] Cygwin-OpenSSH 8.2.2.2

[Henry S. Thompson]

Bill Stewart writes:

> On Wed, Feb 26, 2020 at 11:47 PM ASSI wrote:
>
> You will perhaps want to read the Cygwin licensing terms
>> plus the licensing terms of each of the packages you distribute.
>>
>
> The relevant licenses are provided as links in the installer and referenced
> in the User's Guide.

What I believe everyone is being too polite to say explicitly is that
you have not conformed to Cygwin's license terms [1] yourself:

   What are the licensing terms?

   Most of the tools are covered by the GNU GPL, some are public domain,
   and others have a X11 style license. To cover the GNU GPL
   requirements, the basic rule is if you give out any binaries, you
   must also make the source available. For the full details, be sure to
   read the text of the GNU General Public License (GPL).

   The Cygwin™ API library found in the winsup subdirectory of the
   source code is covered by the GNU Lesser General Public License
   (LGPL) version 3 or later. For details of the requirements of LGPLv3,
   please read the GNU Lesser General Public License (LGPL).

I have tried pretty hard to find the Cygwin and OpenSSH sources in your
distro and cannot find them...

It seems likely that you're trying to do a good thing here, although in
general pointing people to the Cygwin site with instructions allows a
much better user experience than giving them a package which depends on
a 3rd party (you) for updates.  But you should play by the rules,
please.

ht

[1] https://cygwin.com/licensing.html
-- 
       Henry S. Thompson, School of Informatics, University of Edinburgh
      10 Crichton Street, Edinburgh EH8 9AB, SCOTLAND -- (44) 131 650-4440
                Fax: (44) 131 650-4587, e-mail: ht@inf.ed.ac.uk
                       URL: http://www.ltg.ed.ac.uk/~ht/
 [mail from me _always_ has a .sig like this -- mail without it is forged spam]

The University of Edinburgh is a charitable body, registered in
Scotland, with registration number SC005336.


--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple

Re: [ANN] Cygwin-OpenSSH 8.2.2.2

[Achim Gratz]

Bill Stewart writes:
> The relevant licenses are provided as links in the installer and referenced
> in the User's Guide.

They are incomplete as they do not include the libraries you depend on.

But more to the point: since you include GPL components, a binary-only
distribution is not OK.  The sources for at least the GPL licensed
utilities and libraries is missing.  It's not enough to say what these
are and roughly where to get them and leave the users with figuring it
out for themselves, you are supposed to provide sources in the same way
as your binaries, for the exact version you used to create the binaries,
including any modifications to the build system or the sources
themselves.


Regards,
Achim.
-- 
+<[Q+ Matrix-12 WAVE#46+305 Neuron microQkb Andromeda XTk Blofeld]>+

Factory and User Sound Singles for Waldorf Q+, Q and microQ:
http://Synth.Stromeko.net/Downloads.html#WaldorfSounds

--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple

Re: [ANN] Cygwin-OpenSSH 8.2.2.2

[Bill Stewart]

On Thu, Feb 27, 2020 at 11:52 AM Achim Gratz wrote:

But more to the point: since you include GPL components, a binary-only
> distribution is not OK.  The sources for at least the GPL licensed
> utilities and libraries is missing.  It's not enough to say what these
> are and roughly where to get them and leave the users with figuring it
> out for themselves, you are supposed to provide sources in the same way
> as your binaries, for the exact version you used to create the binaries,
> including any modifications to the build system or the sources
> themselves.
>

I misunderstood, since the source is already freely available from cygwin
and I am not changing any of the binaries.

I can certainly include the source as a component in the installer for the
next version.

Bill

--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple

Re: [ANN] Cygwin-OpenSSH 8.2.2.2

[Brian Inglis]

On 2020-02-27 12:36, Bill Stewart wrote:
> On Thu, Feb 27, 2020 at 11:52 AM Achim Gratz wrote:
> But more to the point: since you include GPL components, a binary-only
>> distribution is not OK.  The sources for at least the GPL licensed
>> utilities and libraries is missing.  It's not enough to say what these
>> are and roughly where to get them and leave the users with figuring it
>> out for themselves, you are supposed to provide sources in the same way
>> as your binaries, for the exact version you used to create the binaries,
>> including any modifications to the build system or the sources
>> themselves.

> I misunderstood, since the source is already freely available from cygwin
> and I am not changing any of the binaries.
> 
> I can certainly include the source as a component in the installer for the
> next version.

No, you must backport all sources to the current and all previous versions and
redistribute, or at least make them visible and available on your site,
otherwise you are in breach of the licence and must withdraw all distributions -
see:

	https://www.fsf.org/licensing

and you may consult them for more accurate and complete information.

-- 
Take care. Thanks, Brian Inglis, Calgary, Alberta, Canada

This email may be disturbing to some readers as it contains
too much technical detail. Reader discretion is advised.

--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple

Re: [ANN] Cygwin-OpenSSH 8.2.2.2

[Bill Stewart]

On Thu, Feb 27, 2020 at 3:31 PM Brian Inglis wrote:

No, you must backport all sources to the current and all previous versions
> and
> redistribute, or at least make them visible and available on your site,
> otherwise you are in breach of the licence and must withdraw all
> distributions
>

I have removed the package. (The phrase "no good deed goes unpunished"
comes to mind.)

I will put up a separate package later that does not contain any cygwin
binaries and write a script instead that can download the needed binaries
and sources using the cygwin setup tool (that the user will have to
download themselves). In this way I will be hosting no binaries and will
not be in violation of any license.

Bill

--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple

Re: [ANN] Cygwin-OpenSSH 8.2.2.2

[Andrew Schulman via cygwin]

> On Thu, Feb 27, 2020 at 3:31 PM Brian Inglis wrote:
> 
> No, you must backport all sources to the current and all previous versions
> > and
> > redistribute, or at least make them visible and available on your site,
> > otherwise you are in breach of the licence and must withdraw all
> > distributions
> >
> 
> I have removed the package. (The phrase "no good deed goes unpunished"
> comes to mind.)

No cheering here about that. Thanks for contributing, and I hope your next
iteration is more successful. Andrew


--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple

Re: [ANN] Cygwin-OpenSSH 8.2.2.2

[Andrey Repin]

Greetings, Bill Stewart!

>> No, you must backport all sources to the current and all previous versions
>> and
>> redistribute, or at least make them visible and available on your site,
>> otherwise you are in breach of the licence and must withdraw all
>> distributions
>>

> I have removed the package. (The phrase "no good deed goes unpunished"
> comes to mind.)

> I will put up a separate package later that does not contain any cygwin
> binaries and write a script instead that can download the needed binaries
> and sources using the cygwin setup tool (that the user will have to
> download themselves).

You can download the setup yourself as part of installation process, just make
it clear to the user, what happening, make sure your download process is
sufficiently secure, and include the instructions, how to avoid this in case
the user already have Cygwin environment installed.

> In this way I will be hosting no binaries and will
> not be in violation of any license.


-- 
With best regards,
Andrey Repin
Saturday, February 29, 2020 0:16:46

Sorry for my terrible english...


--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple

Re: [ANN] Cygwin-OpenSSH 8.2.2.2

[Achim Gratz]

Bill Stewart writes:
> I have removed the package. (The phrase "no good deed goes unpunished"
> comes to mind.)

I don't think anybody assumed any bad intentions on your part and it
just was to make you aware of the licensing problem and ask you to fix
it.  The GPL's stated purpose istp protect the freedom of the user, not
necessarily the convenience of the distributor (or even the user).

> I will put up a separate package later that does not contain any cygwin
> binaries and write a script instead that can download the needed binaries
> and sources using the cygwin setup tool (that the user will have to
> download themselves). In this way I will be hosting no binaries and will
> not be in violation of any license.

Unless you are using setup.exe to do that, please ensure that you use a
secure method for downloading the setup.ini file and the signature,
actually check the validity of the signature and then proceed to
checksum the downloaded files before installation.

https://cygwin.com/faq.html#faq.setup.install-security
https://cygwin.com/faq.html#faq.setup.increase-install-security
https://cygwin.com/install.html

If you so use setup.exe, note that it is GPLv2 licensed.  Since there is
no source package, you will instead have to point your installer to get
a Git snapshot if the user requests the source.  Again, if you use that
binary, please use a secure transport and check it against the
signature, also obtained via secure transport.


Regards,
Achim.
-- 
+<[Q+ Matrix-12 WAVE#46+305 Neuron microQkb Andromeda XTk Blofeld]>+

SD adaptations for Waldorf Q V3.00R3 and Q+ V3.54R2:
http://Synth.Stromeko.net/Downloads.html#WaldorfSDada

--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple

Re: Cygwin-OpenSSH 8.2.2.2

[L A Walsh]

On 2020/02/27 14:30, Brian Inglis wrote:
> No, you must backport all sources to the current and all previous versions
----
    What all previous versions?  Going back to year 2000 or before? 

That sounds a bit onerous.

Re: Cygwin-OpenSSH 8.2.2.2

[Adam Dinwoodie]

On Tue, 24 Mar 2020 at 01:04, L A Walsh wrote:
>
> On 2020/02/27 14:30, Brian Inglis wrote:
> > No, you must backport all sources to the current and all previous versions
> ----
>     What all previous versions?  Going back to year 2000 or before?
>
> That sounds a bit onerous.

I think the point Brian was trying to make was that it is not
sufficient to provide the source code in future releases of Bill's
Cygwin-OpenSSH package. To comply with the GPL requirements, Bill
would need to make available all the relevant source code for every
binary release he has made of his package.

Alternatively: yes. The GPL _is_ onerous. That's sort of the point: it
forces people to make source code available even when they don't want
to, regardless of whether that's because they don't want others
changing their code or because they just don't want to do the
additional work.

Re: Cygwin-OpenSSH 8.2.2.2

[Bill Stewart]

On Tue, Mar 24, 2020 at 4:24 AM Adam Dinwoodie wrote:

> On Tue, 24 Mar 2020 at 01:04, L A Walsh wrote:
> >
> > On 2020/02/27 14:30, Brian Inglis wrote:
> > > No, you must backport all sources to the current and all previous versions
> > ----
> >     What all previous versions?  Going back to year 2000 or before?
> >
> > That sounds a bit onerous.
>
> I think the point Brian was trying to make was that it is not
> sufficient to provide the source code in future releases of Bill's
> Cygwin-OpenSSH package. To comply with the GPL requirements, Bill
> would need to make available all the relevant source code for every
> binary release he has made of his package.
>
> Alternatively: yes. The GPL _is_ onerous. That's sort of the point: it
> forces people to make source code available even when they don't want
> to, regardless of whether that's because they don't want others
> changing their code or because they just don't want to do the
> additional work.

As already noted last month, the offending Cygwin-OpenSSH package has
been removed from GitHub.

Bill