Merge remote-tracking branch 'origin/pr/739'

docs/about.md

@@ -60,6 +60,29 @@ All you wanted to know about GHCup.
 3. handling cabal projects
 4. being a stack alternative
 
+## Distribution policies
+
+Like most Linux distros and other distribution channels, GHCup also
+follows certain policies. These are as follows:
+
+1. The end-user experience is our primary concern
+    - ghcup in CI systems as a use case is a first class citizen
+2. We strive to collaborate with all maintainers of all the tools we support and maintain a good relationship
+3. We may fix build system or other distribution bugs in upstream bindists
+    - these are always communicated upstream
+4. We may even patch source code of supported tools in very rare cases if that is required to ensure that the end-user experience does not break
+    - we'll first try to upstream any such required patch and request a new release to avoid downstream patching
+    - patches will be communicated to the maintainers either way and we'll strive to get their review
+    - they will also be communicated to the end-user
+    - they will be uploaded along with the bindist
+    - we will avoid maintaining long-running downstream patches (currently zero)
+5. We may add bindists for platforms that upstream does not support
+    - this is currently the case for GHC for e.g. Alpine and possibly FreeBSD in the future
+    - this is currently also the case for stack on darwin M1
+    - we don't guarantee for unofficial bindists that the test suite passes at the moment (this may change in the future)
+6. We GPG sign all the GHCup metadata as well as the unofficial bindists
+    - any trust issues relating to missing checksums or GPG signatures is a bug and given high priority
+
 ## How
 
 Installs a specified GHC version into `~/.ghcup/ghc/<ver>`, and places `ghc-<ver>` symlinks in `~/.ghcup/bin/`.