Snappy server source code?

[Mark Shuttleworth]

On 23/06/16 19:23, Max wrote:
> So, if an independent Distro, wanted to supply their users with their
> own appstore
> they could just set up a webserver an fork the Ubuntu-appstore?
> Would this even be legal, or could you only put the FreeSoftware Apps
> in your store?

Yes it would be legal from the point of view of snap code.

You might need the snap creator's permission, depending on the license
of the source but there's every reason to expect the people who make
snaps to want them in as many stores as possible.

It would be your decision as to whether you want non-free snaps in your
store; fine for most distros, but folks like FSF and Debian would likely
filter snaps based on license.

>
> And how would you make sure they are the correct Binaries, build from the
> correct source? In LP you can build "reproducable" Snaps, but if you
> would build
> an independent appstore, you would have to find all the different
> locations where
> the developers put their source and the corresponding .yaml files to
> be sure that
> your Snaps correctly and veritably build.

This is in the nature of all bundled app formats. For open source snaps,
you would likely want to build them yourself.

>
> Wouldn't it make sense for snaps under an OS Licenses to be obliged by
> snapcraft
> to upload their .yaml files, so someone could verify they pull from
> the right repo, e.g
> github? Or maybe upload the whole source code like in Debian, to avoid
> fork-ability issues.

Yes indeed, and that's what we see happening. Drop a snapcraft.yaml in
your source tree and anybody / everybody can then build the snap for
themselves on hardware they trust.

> The Snap store is a really great distribution tool for proprietary
> apps ATM , but OS apps have slightly
> other requirements, and not being forced to upload your source code,
> could lead potentially
> to bad practice or even malware being included in snaps.

Yes, agreed.

Mark