On Tue, 30 Sep 2003, Greg A. Woods wrote:

> The only tricky part is figuring out when a distribution file can be
> removed from the distfiles collection.  If I'm not mistaken though both
> pkgsrc and ports have ways of generating lists of distfiles currently
> "in-use" so it's just a matter of merging those lists from all
> "supported" branches and systems and then removing any files which are
> no longer in the merged list.

Any current pkgsrc doesn't provide enough information to determine
which distfiles can be deleted. The GPL requires every binary package
be "covered" by the distfile that generated it, and then again for
three more years after the binary package is deleted. I've been
thinking about this, and what we need is a monthly script to 1) parse
the output of "pkg_info -b" for every extant binary package, 2) use
that to pull the distinfo file of that exact version, 3) use that to
associate the distfile(s) with each package, and maintain a database
of distfiles as they appear, and especially when they are "orphaned",
and 4) use that to identify the packages that have been orphaned for
three years or more. If we stored the names of the distfiles in the
binary packages, we could skip the first two steps.

Note, packages that aren't GPL'd may as well follow the same rule.
We want to provide the distfiles for a little while after the package
is deleted, so it may as well be for three years.

Note also, that we've hardly deleted any significant number of
packages yet -- the 1.4* packages were simply moved to the
"unsupported" directory -- so even if the procedure is put into place
right away, we wouldn't actually be able to delete anything for at
least three years.

Frederick