Haikuports: closed source package?

[letarg0]

Is possible to create closed source package?

[fbrosson]

You can, but probably not in this repo.
What you can do is create the hpkg and a repo with the package_repo command, host this repo in a server you control, and publish the address of your repo.

Well, if your question is: _"Can we create a package with a SOURCE_URI which points to an archive containing pre-compiled binaries ?"_ (like what some distros have for e.g. Skype or DropBox, or like the rust_bin recipe we have) then this is a political question.

(I'd say that what we do for rust_bin is a special case because @nielx is a Haiku contributor.)

I'll let others complete this answer :)

[pulkomandy]

"is an Haiku contributor" is not a diplomatic immunity allowing people to do everything here.

We have binary only package for Sync Modular and Wonderbrush, and liblayout as well, for example.It is fine as long as the licence for whatever you are packaging allows it. Source based packages are preferred where possible but I don't see why binary-only ones would be disallowed.

However, it has to be a "trusted" binary. We should make sure no malicious code is injected in it.

[korli]

you can eventually publish a closed source package in other repositories, see:
https://www.haiku-os.org/community/software
Some are available in HaikuDepot.

[fbrosson]

"is an Haiku contributor" is not a diplomatic immunity allowing people to do everything here.

Yeah, my previous reply was not clear enough. That was only _one_ of the conditions.

However, it has to be a "trusted" binary. We should make sure no malicious code is injected in it.

The _other_ condition, imo, is that the binaries should be produced from either:

• an open source project, and be compiled by someone we trust,
• or a closed source project which has been audited by at least 2 people we trust and be built by one of them.

That said, if you plan to ask 2 trusted contributors to sign a NDA (in order to send them the source code and have it compiled) you may not find enough trusted contributors with enough available time. So @korli's suggestion is probably the best solution.
Moreover, I'd say that if a contributor has write access to the Haiku and/or HaikuPorts repositories this does not mean that this contributor is a trusted contributor. Members with write permission are trusted for _source_ contributions. Binary contributions require more trust.