Issues to figure out

[Colin Walters <walters verbum org>]

So as I mentioned in the BoF, while I think this effort is going to bear
some useful fruit, and I'm motivated to work on stuff related to it,
there are a lot of high level issues we should discuss.

* Entirely FOSS?

What we're going to be shipping is all Free Software, right?  I take
this as a given myself...but there are some details.

In particular, right now my gnome-ostree binaries include
linux-firmware; this is under the same philosophy that Fedora has
that code that doesn't execute on the host CPU is ok:
https://fedoraproject.org/wiki/Firmware

But Debian disagrees: http://wiki.debian.org/Firmware/

And of course, it's worth mentioning how Ubuntu suggests proprietary
graphics drivers: https://help.ubuntu.com/community/RestrictedDrivers

My take: Ship firmware, don't ship proprietary graphics drivers (or
even link to them).

* Scope of shipped system

While it seems pretty clear to me that we're not going to include
e.g. KDE (leaving that to distributions), there's a lot of other
stuff that might be useful to people actually using the gnome-ostree
builds.  For example, Samba.  Shipping stuff like that would
significantly increase our software set.

My take: Ship only what's useful for non-enterprise deployments
(i.e. independent developers and testers).  This means no Samba.

We'd point people who want a more "fully featured" GNOME to
distributions.

Also, there's stuff like alternative shells (zsh), etc.  I suggest
we also tell these people to use distributions.

I suspect that scope creep is going to be our biggest problem to
stay on top of once people are actually using the system.

Maybe long term, we can help with a "ports tree" type thing...but
anyways.

* Security updates

Suggest we don't do any except for the web browser, gdk-pixbuf, and
libpoppler - basically, network inputs.  Once we have an application
format that works, we should use contacts with Mozilla to get them to
ship it from the Firefox website.  If we do official Epiphany builds in
GNOME...we'd really need some organization that would actually keep it
up to date and secure.

* Governance model

This is going to actually become much more seriously important once
built binaries are going directly to users.  I think we need something
better than "anyone can commit", especially given that translators etc.
have the same code access.  

I don't have a really good suggestion here because I don't think we
should get too formal right now and slow things down.  But this will
become more important, and people should be thinking about it.

* Can we do this at all?

While again I think there is some good stuff going on, and even if we
fail, the world will be a better place, at some point we're going to
need buy-in from the Board/Foundation.  How do we do that?

Probably best to just say "we're an experiment" for now - but this
is the reason I haven't been publicizing my gnome-ostree builds; I
don't consider them "official" (for all of the reasons above).