Package source code

[oscarfv]

Some licenses (i.e. the GPL) require the distribution of the source code used to produce a binary package. This is the exact source code used for creating the binary. MSYS2 publishes that source code (see https://sourceforge.net/projects/msys2/files/REPOS/MINGW/Sources/).

It would be nice from Styrene to (optionally) create a parallel package containing the source code that corresponds to the binaries. This would greatly help people to comply with the requirements of certain software licenses.

[achadwick]

Sounds interesting. The snapshotting aspect will be useful.

• Should the output format be a tarball of all the available .src.tar.gz for all the installed packages, or should they go into a _sources toplevel in the bundle itself?
• Do you happen to know of anything like Debian's apt-get source for Arch-like systems?

A few thoughts:

• The list of all the installed packages can be gathered by looking at <BUNDLEROOT>/var/lib/pacman/local after the installation phase, including version numbers.
  • Wrinkle: they may be hit by a delete line later on if the bundle creator wants to avoid a particularly lengthy bit post-install stuff.
• Source package filenames are predictable enough that we can grab the like-versioned thing from the --pkg-dir the user specified. That covers the case for packages built by the user.
• CHECK: are the .src.tar.gz files @oscarfv mentioned built with makepkg[-mingw] --allsource?

[oscarfv]

To satisfy GPL-like requirements, a tarball with the .src.tar.gz files published by MSYS2 is fine. Possibly other licenses require things like separating the upstream source code from the local MSYS2 patches, etc.

MSYS2, like Arch, use the Arch Build System. If you pass the correct switch to makepkg-mingw it will download the sources and stop, instead of proceeding with the build. Those sources come from upstream though, while many MSYS2 packages are locally patched, so we really need the source tarballs uploaded by Alexey to SF.

The snapshotting aspect you mention is very interesting too and it would require those same patched source tarballs from SF.

[Please forgive me if I don't follow this discussion on the future. Most Github email notifications do not arrive at my inbox]

[achadwick]

Depends on #11, ideally.