Carrying on from discussions on the mailing list and IRC, I have sent in patches for a PKGBUILD for gmid (not the git package, regular one) from the AUR after I modified the PKGBUILD to remove files without a license/copyright (contrib and webiste directory - not needed by the program at all).
As noted on the mailing list, the patches were submitted after verifying compilation with libremakepkg and running the software to test basic functionality (the compilation stage also includes a comprehensive test suite, which passed all tests).

The only "downside" compared to gmnisrv is that the codebase is larger - but it is better documented and the extra features are useful to most users probably.

Since I might have caused some confusion by using different nicks: "wael" on IRC, "Wael Karram" on the mailing list and cbotulinum here are all the same person.

CBotulinum has since asked the author to add some license notice; but the author is convinced that the mere presence of a GPL file in the code-base is sufficient, [...]

Do we have any public statement of that? If so that might constitute the clarification that we need.

I have sent the author of the software another email asking for permission to post the reply he had given me (by email) earlier.
Once I get his OK I'll post it here.

The author of gemnisrv didn't accept to deal with the licensing issue whatsoever.
I've checked gmid again, it is using the ISC license and has proper license headers in all the project's files except the contrib section (which we can just not package in the first place as it isn't part of the core software).
I'll be working on a PKGBUILD for it, and uploading it shortly.

licenses are recognized by name, only if they match one of the
directory names under /usr/share/licenses/common/ - those
licenses do not need to be installed in the package - any other
license must be prefixed with 'custom:' and the license file
must be installed into a directory named /usr/share/licenses/${pkgname}/

license=(custom:ISC)

VG - hope you dont mind the nit-picking - i noticed a few other things that need attention - this ended up quite lengthy - i will split them into the next 3 comments

WRT "upstream" PKGBUILDs¶

if the PKGBUILD was derived from another, from another arch-like distro (eg: archlinux{,arm,32}, artix, hyperbola, or the AUR), and they are mostly identical (they usually are), it is courteous to keep the attributions in tact - but it is most helpful to indicate to the reader or future maintainer, where to find the original, so to compare/merge the changes, past and future - if the PKGBUILD is well-maintained upstream, and if the software is sufficiently libre; the parabola maintainer may need to do nothing more than to merge new changes from the AUR, for the next version N+1 - it also help parabola users to do the same, in case the parabola maintainer has been slacking

if the AUR PKGBUILD has:

Maintainer: fred <fred@bedrock.tech>

change it to:

Maintainer (aur): fred <fred@bedrock.tech>

and retain all "Contributor:" lines

WRT pkgrel:¶

pkgrel=1.parabola${PARABOLA_RELEASE_COUNT}

put the number by hand - "PARABOLA_RELEASE_COUNT" is a hack - as it is, anyone who runs makepkg on it, will get a blank there

but ... the important thing to remember about pkgrel, is that we only change it for package which exist in arch proper (the pacage would be in one of libre, nonsystemd, or nonprism) - the appended pkgrel segment is semantic - it indicates that the package exists in arch; but that the parabola package over-rides/replaces it for some reason - the appended pkgrel segment indicates that reason

for [libre] packages:

pkgrel+=.parabolaN

for [nonsystemd] packages:

pkgrel+=.nonsystemdN

for [nonprism] packages:

pkgrel+=.nonprismN

also, try to keep the diff as clean as possible - for example, if the upstream PKGBUILD has

pkgrel=1

dont change that line - but add a line just below it like:

pkgrel=1
pkgrel+=.parabola1

even if there is a blacklisted dependency, i usually leave it in tact for the sake of the diff - for example:

depends=(bar foo blacklisted)

i do not change that line, instead i add a new line below it:

depends=( ${depends[*]/blacklisted/} )

WRT un-licensed files¶

unfortunately, this one is more hairy

because of the "unlicensed files" in the upstream sources, the "# Remove unlicensed files." code should be in a mksource() function - the reason is that those files will be present in the *.src..tar.xz source package - in most cases, there is no effect of deleting them during build()

in order for the source package to be fully libre, any un-licensed files must be removed before the source package is generated - the source package is generated before prepare() runs; so the the mksource() mechanism was invented to accomplish this task - there is a proposal to eliminate mksource() and have the source package generated after prepare(); but changes in build() would never be reflected in the source package - for now mksource() is the only semi-automated way to accomplish it - unfortunately, it's use was never documented

mksource packages are a bit trickier to build; and the mechanism is broken in current libretools - the patch is simple though - it will be working again in the next libretools

TODO: add these instructions to the wiki (section 6.1)
https://wiki.parabola.nu/Package_maintainer_guide#mksource.28.29_and_intermediate_source-balls

to create a mksource PKGBUILD, or to convert an existing PKGBUILD to support mksource:

• put whatever would normally be in source=() in mksource=()
• put whatever would normally be in <ALGO>sums=() in mk<ALGO>sums=()
• add a new source=() containing the URL to the (yet non-existent) intermediate source-ball, of the form:
  https://repo.parabola.nu/other/${pkgname}-libre/${pkgname}-libre-${pkgver}.tar.xz{,.sig}
• add a new <ALGO>sums=() containing: (0 SKIP)
• add, or move out of prepare(), any code that applies libre-treatments, into a new mksource() function
• run libremakepkg normally

• run the mksource() function
• generate the intermediate source-ball
• replace the '0' checksum with the appropriate one for the newly generated source-ball
• prompt the user to sign the source-ball

if the user elects to sign the libre source-ball, libremakepkg will restart itself, and build the package normally - otherwise, the build will halt - the user must sign the source package, and run libremakepkg again - initially, it is probably most convenient to make the PKGBUILD work without mksource first - after converting it to mksource, it should "just work" - it would not be necessary to actually generate the libre source-ball, nor to sign it - future revisions would need the signature, or to prepare the libre source-ball manually, and delete the .sig from the source array temporarily

librerelease will upload the libre source-ball to it's expected location, along with the package, so the PKGBUILD will work normally for anyone else later, without running mksource(), even with the standard makepkg

the intermediate source-ball does not need to be on the server -
none of the source do - all PKGBUILDs can be packaged offline -
if all files listed in the source=() array are present in the
working directory (alongside the PKGBUILD), then no network
connection is needed

libremakepkg relies on that - networking is not available to
libremakepkg inside the librechroot - all sources must exist
locally, then copied into the chroot before libremakepkg enters
the chroot

i merged this PKGBUILD with the one from AUR - most of the changes are superficial, to minimize the diffs (such as changing double-quote to single-quotes)

WRT the service files:¶

the files gmid.conf and gmid.sysusers are redundant - they are identical, and get installed into the same directory, and serve the same purpose - only one is needed

you used the GMID_USER in the openrc init script; but that is not defined anywhere - the syncthing example also had a file under /etc/conf.d/ which defines that var - np, i added the conf file

however i noticed one thing of concern - both the systemd and openrc service files start the server with `-c /etc/gmid.conf` - is that file installed by the package ? - or, do you know what that file is expected to be? - could it be a symlink to something under /usr/lib ? - does the user need to add it manually ?
TODO: (i have not built the package yet - i will erase this question if i find the answer)

WRT depends:¶

the one significant difference is the depends array - why did you change the 'libbsd' dependency to 'libevent'? - those appear to be very different software - without using the program, and without knowing how it presumably uses 'libbsd' or 'libevent', its difficult to know if either are actually required

AUR PKGBUILD:

depends=('libretls' 'libbsd')

depends=('libretls' 'libevent')

WRT mksource:¶

this is just a note - the commented line was correct - even though you created the source-ball manually, it still would have worked -

the file gets downloaded only if it does not already exist in the working directory - if the file exists in the working directory, both lines are equivalent - normally, the file will not exist until after mksource has completed at least once - initially, mksource needs to know where to get the upstream source-ball; so that github URL must be in the PKGBUILD

mksource=(
    #"https://github.com/omar-polo/${pkgname}/releases/download/${pkgver}/${pkgname}-${pkgver}.tar.gz" 
    "gmid-1.8.3.tar.gz"