Summary

  • GIMP moved its main Windows installer downloads from SourceForge in 2013, but many existing links still pointed to the old project page.
  • SourceForge changed that page into a mirror under its own administrative control. In May 2015, it tested third-party offers on mirrored downloads; GIMP said its users received a wrapper containing other software without the project's permission.
  • SourceForge ended the test on 27 May, then removed mirrors lacking original-developer co-maintenance on 18 June, with an exception for discontinued upstream sites. It said affected traffic went to the projects' canonical homes.

The old address kept doing business

GIMP had moved. Its old address had not.

In November 2013, the image-editing project shifted its primary Windows installer downloads from SourceForge to its own server. The move did not erase years of links scattered across the web. GIMP said those links were the reason it left installers on the former hosting page: a visitor following an old bookmark still needed somewhere sensible to land.

That made the old address valuable. It could still receive users who thought they were following the project. It also gave the host an opportunity to decide what those users saw when they arrived.

On 27 May 2015, GIMP reported that its Windows installer maintainer was locked out of the SourceForge project entry. Visitors, it said, were receiving a small installer that brought additional software with it. In a formal statement the same day, GIMP said SourceForge had wrapped the project's binaries in its own downloader without GIMP's knowledge or permission. The project said the added software reached users' systems. Its complaint was blunt: a download destination could trade on an old project address while changing the journey from click to installation.

SourceForge offered a different account of the administrative decision. Its 27 May post said the GIMP-Win entry had been registered on SourceForge in October 2004 and that its author had ceased using SourceForge for delivery in 2013. The host called that entry abandoned, said it had converted the page into a mirror of releases hosted elsewhere, and said the change of status and administrative control was made visible so readers would know SourceForge curated it. It maintained that original downloads remained available. An update said the GIMP-Win mirror's downloads carried no additional offers from 28 May.

The two accounts agree on a crucial piece of plumbing: SourceForge had become the administrator of the page reached by old GIMP-Win links. They differ sharply on what that authority justified. For the host, keeping a mirror current preserved access to software after the original maintainer stopped using its service. For GIMP, the project was still active, the official download had moved, and the old address should not become a route to a different installer experience.

A mirror can preserve the file and seize the doorway

The word “abandoned” carried too much weight in this argument. SourceForge was describing a project entry on its own service. GIMP was describing a living software project and the people who followed its download links. Those are different things. An inactive hosting account can coexist with active development elsewhere. Treating the former as permission to repurpose the public doorway made the host's internal status more consequential than the project's chosen distribution path.

GIMP's requested remedy showed exactly what it wanted to control. Its official statement called for a way to remove the project and its files from SourceForge, prevent replacement mirrors, and make the old URLs issue permanent HTTP 301 redirects to a location chosen by the project. That was a demand for the right to retire an address cleanly. It did not merely ask SourceForge to remove one bundled offer.

SourceForge's first response was narrower. On 1 June it said it had stopped presenting third-party offers with unmaintained projects and would use them only where developers explicitly approved or the project already bundled such offers. The host still defended mirroring as a way to keep historical releases available and users current. Its June statement therefore separated two questions that had been tangled together in one download button: whether the host could keep a copy, and whether it could attach a commercial installer path to it.

The second response went after the mirror programme itself. SourceForge said a short test of offers had touched five mirrored projects and had ended on 27 May. It reported 295 projects in its mirror catalogue on 17 June. On 18 June, it said it had removed mirrors not co-maintained with an original developer, except where the upstream site had been discontinued. For removed mirrors, it said traffic was redirected to the canonical software home. The 295 figure describes the mirror catalogue, not 295 wrapped downloads. The policy used developer participation and a living upstream site as the dividing line for who should hold the doorway.

The dispute outlasted that particular test. After SourceForge changed owners, its February 2016 announcement said the broader DevShare programme, which delivered installer bundles for participating projects, had been eliminated. The new owner framed the decision as a first step toward rebuilding trust. It was a later business decision, separate from the five-project mirror test and the June cleanup.

GIMP's and SourceForge's public statements do not contain a URL-by-URL redirect log or a preserved installer hash for every download served during the test; those records would pin down which visitor received which payload. The recorded conflict is already concrete. The project had moved its official release path. The host controlled an older address and the wrapper attached to some downloads. When users arrived through that address, the host's choices stood between the author and the installer.

The Internet remembers links long after a project changes its mind. In 2015, GIMP found that an old link could keep working while no longer doing the job its author intended. SourceForge eventually sent affected mirror traffic back to canonical homes. The fight was over the years in between: who gets to decide what a familiar download address delivers when the people who made the software have gone elsewhere.

Sources