When using an open source component (say, licensed under CDDL), we are required to distribute the source code for any components directly derived from the component. Is it acceptable to just provide a link to the web page where I downloaded the software from, or do I have to somehow make an additional point from where people can access it?
1 Answer
This depends on the license. The CDDL 1 says about source availability:
You must inform recipients of any such Covered Software in Executable form as to how they can obtain such Covered Software in Source Code form in a reasonable manner on or through a medium customarily used for software exchange.
Downloading a ZIP or TAR archive from a website would be a “medium customarily used for software exchange”, so I think that would work.
However, other licenses might make different provisions. Some licenses have no such requirements at all (permissive licenses like MIT). The different GPL versions allow you to provide a written offer for the source code, but that offer must be valid for a specific period.
In any case, the easiest way to comply with these source availability requirements is to distribute the source along with any binaries. Source code typically compresses well so this usually won't inflate downloads unreasonably.
One extra difficulty is that you must generally be able to provide the corresponding source code for every version you have distributed, not just the most recent version. It is difficult to keep track of this unless you have an automated deployment pipeline that builds the software completely from source and then uploads both the source and the executables to some sever. Even flagship open source projects like Emacs have got this wrong! Again, this is easier to get right if you always accompany the binaries with their source code, and build from that source instead of relying on precompiled components.
