DomainKey-Signature: a=rsa-sha1; c=nofws; d=sourceware.org; h=list-id
	:list-unsubscribe:list-subscribe:list-archive:list-post
	:list-help:sender:from:to:subject:references:date:in-reply-to
	:message-id:mime-version:content-type; q=dns; s=default; b=N0Z22
	Q9OQ/Ji1Q8lWYA66vJogEnNu62ikVCG5MIXaKdLUWSHSf3P8NpwBgRKRjo30n/g/
	mRaxfj+ChIK+MpplhQ0RJu97TrklMtoe+BQSZzHkzMWgGIKGCTbPhm0+gQ+47Jyb
	OqgAddhOezfOHnSmsu+ythXmjm/lZAGpnk8iL4=
Mailing-List: contact cygwin-help@cygwin.com; run by ezmlm
Sender: cygwin-owner@cygwin.com
Mail-Followup-To: cygwin@cygwin.com
From: Achim Gratz <Stromeko@nexgo.de>
To: cygwin@cygwin.com
Subject: Re: [ANN] Cygwin-OpenSSH 8.2.2.2
References: <CANV9t=Rxr4R3UKcjk4E0JZ+vd1nzPMtioCE0_rk502faF83pCA@mail.gmail.com>	<87sgiwedci.fsf@Otto.invalid>	<CANV9t=Tap+RQqSH2_po9qEVww0TNHgBiDcefc2ZioYU2yoG4PQ@mail.gmail.com>	<87imjrj21y.fsf@Rainer.invalid>	<CANV9t=SyEJcGm3+--gWcvuuRQ0GOK206FaZ9PyoU5Xugh__r+A@mail.gmail.com>	<0853870f-74de-8ab5-835e-d97b310fcd91@SystematicSw.ab.ca>	<CANV9t=ST0X5P7CR2A9C9H79kRq=8NEjCWg7gA=Rj68E6D3ZDGA@mail.gmail.com>
Date: Sun, 01 Mar 2020 12:53:34 +0100
In-Reply-To: <CANV9t=ST0X5P7CR2A9C9H79kRq=8NEjCWg7gA=Rj68E6D3ZDGA@mail.gmail.com>	(Bill Stewart's message of "Fri, 28 Feb 2020 07:51:23 -0700")
Message-ID: <87pndwgukh.fsf@Rainer.invalid>
User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/26.3 (gnu/linux)
MIME-Version: 1.0
Content-Type: text/plain

Bill Stewart writes:
> I have removed the package. (The phrase "no good deed goes unpunished"
> comes to mind.)

I don't think anybody assumed any bad intentions on your part and it
just was to make you aware of the licensing problem and ask you to fix
it.  The GPL's stated purpose istp protect the freedom of the user, not
necessarily the convenience of the distributor (or even the user).

> I will put up a separate package later that does not contain any cygwin
> binaries and write a script instead that can download the needed binaries
> and sources using the cygwin setup tool (that the user will have to
> download themselves). In this way I will be hosting no binaries and will
> not be in violation of any license.

Unless you are using setup.exe to do that, please ensure that you use a
secure method for downloading the setup.ini file and the signature,
actually check the validity of the signature and then proceed to
checksum the downloaded files before installation.

https://cygwin.com/faq.html#faq.setup.install-security
https://cygwin.com/faq.html#faq.setup.increase-install-security
https://cygwin.com/install.html

If you so use setup.exe, note that it is GPLv2 licensed.  Since there is
no source package, you will instead have to point your installer to get
a Git snapshot if the user requests the source.  Again, if you use that
binary, please use a secure transport and check it against the
signature, also obtained via secure transport.


Regards,
Achim.
-- 
+<[Q+ Matrix-12 WAVE#46+305 Neuron microQkb Andromeda XTk Blofeld]>+

SD adaptations for Waldorf Q V3.00R3 and Q+ V3.54R2:
http://Synth.Stromeko.net/Downloads.html#WaldorfSDada

--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple