These solely represent my own interpretation and opinions. Some parts might be wrong — actually — some parts will be wrong. Please tell me somewhere.
I am not a lawyer. This is provided solely for the purposes of general information and does not constitute legal advice, guidance, or counsel. No attorney-client relationship is established by the provision of this information, and no reliance should be placed on this information in lieu of seeking professional legal advice. All information is provided “as is”, without warranty of any kind, either express or implied.
Statutes are often interpreted in context and in light of the problem they were written to address, and the stakeholders and organizations that they were intended to target. Nevertheless, it is not appropriate for FOSS projects to simply ignore such statutes solely because of the belief that they were intended for large proprietary software corporations.
I mainly use Alpine, so I’m only familiar with Alpine packaging and package distributions. I assume that most traditional distributions, such as Debian, Arch, Fedora, etc., are similar. I am not at all familiar with Nix, Guix, or immutable distributions, and what I say may or may not apply to them.
Questions presented
How does California’s Digital Age Assurance Act (AB-1043) apply to FOSS distributions, distro-operated package repositories and other stakeholders within the FOSS ecosystem?
I’ll split this up into a few parts:
Whether those actors fall within the statute’s defined categories; Whether the same actor can and/or likely will, occupy multiple categories at once; To what extent do the statute’s exceptions and limitations apply; and How the statute’s operative duties apply to FOSS software distribution.
Summary
The Act is broad enough that a traditional FOSS distribution can plausibly be both an operating system provider, and through its package repositories, a covered application store.
... continue reading