Debian Bug report logs - #431109
Deprecate use of GPL/LGPL/GFDL symlinks

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Robert Millan <rmh@aybabtu.com>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: please add GPL-3 and LGPL-3

Date: Fri, 29 Jun 2007 21:31:37 +0200

Package: base-files
Version: 4
Severity: wishlist

Please could you add GPL-3 and LGPL-3 to common-licenses?  They're not common
yet, but they will certainly be within a few weeks.

-- System Information:
Debian Release: 4.0
  APT prefers stable
  APT policy: (500, 'stable')
Architecture: amd64 (x86_64)
Shell:  /bin/sh linked to /bin/bash
Kernel: Linux 2.6.18-4-amd64
Locale: LANG=ca_AD.UTF-8, LC_CTYPE=ca_AD.UTF-8 (charmap=UTF-8)

Versions of packages base-files depends on:
ii  base-passwd               3.5.11         Debian base system master password
ii  gawk [awk]                1:3.1.5.dfsg-4 GNU awk, a pattern scanning and pr

base-files recommends no packages.

-- no debconf information

Message #10 received at 431109@bugs.debian.org (full text, mbox, reply):

From: Santiago Vila <sanvila@unex.es>

To: Robert Millan <rmh@aybabtu.com>, 431109@bugs.debian.org

Cc: control@bugs.debian.org

Subject: Re: Bug#431109: please add GPL-3 and LGPL-3

Date: Fri, 29 Jun 2007 22:04:02 +0200 (CEST)

reassign 431109 debian-policy
thanks

On Fri, 29 Jun 2007, Robert Millan wrote:

> Package: base-files
> Version: 4
> Severity: wishlist
> 
> Please could you add GPL-3 and LGPL-3 to common-licenses?  They're not common
> yet, but they will certainly be within a few weeks.

Following /usr/share/doc/base-files/FAQ, I'm reassigning this to debian-policy.

Please read my email to debian-legal ad debian-policy from two days ago.

Message #15 received at 431109@bugs.debian.org (full text, mbox, reply):

From: Robert Millan <rmh@aybabtu.com>

To: Santiago Vila <sanvila@unex.es>

Cc: 431109@bugs.debian.org, debian-legal@lists.debian.org

Subject: [PROPOSAL] Disambiguate of Section 12.5, Deprecate GPL/LGPL symlinks

Date: Sat, 30 Jun 2007 00:03:19 +0200

[Message part 1 (text/plain, inline)]

retitle 431109 [PROPOSAL] Disambiguate of Section 12.5, Deprecate GPL/LGPL symlinks
thanks

On Fri, Jun 29, 2007 at 10:04:02PM +0200, Santiago Vila wrote:
> 
> Following /usr/share/doc/base-files/FAQ, I'm reassigning this to debian-policy.
> 
> Please read my email to debian-legal ad debian-policy from two days ago.

In my interpretation, Policy doesn't exclude any version of the GPL from this
requirement, but I admit that it is ambigous, specially considering the
examples.

This proposal does essentialy two things:

  - Disambiguate GPL/LGPL versioning requirement by extending it to any DFSG
  compatible version the FSF may publish.

  - Deprecate use of symlinks, since they're a source of problems (as exposed
  by GPLv3, see http://lists.debian.org/debian-legal/2007/06/msg00234.html)

-- 
Robert Millan

My spam trap is honeypot@aybabtu.com.  Note: this address is only intended
for spam harvesters.  Writing to it will get you added to my black list.

[gplv3.diff (text/x-diff, attachment)]

[signature.asc (application/pgp-signature, inline)]

Message #22 received at 431109@bugs.debian.org (full text, mbox, reply):

From: Santiago Vila <sanvila@unex.es>

To: Robert Millan <rmh@aybabtu.com>

Cc: 431109@bugs.debian.org, debian-legal@lists.debian.org

Subject: Re: [PROPOSAL] Disambiguate of Section 12.5, Deprecate GPL/LGPL symlinks

Date: Sat, 30 Jun 2007 00:10:07 +0200 (CEST)

> This proposal does essentialy two things:
> 
>   - Disambiguate GPL/LGPL versioning requirement by extending it to any DFSG
>   compatible version the FSF may publish.
> 
>   - Deprecate use of symlinks, since they're a source of problems (as exposed
>   by GPLv3, see http://lists.debian.org/debian-legal/2007/06/msg00234.html)

Symlinks are not a problem. The real problem are hardcoded references
to "GPL" when they should have been references to GPL-2.

For programs which are under "GPL v2 or later" or "GPL v3 or later"
(most of them, if I'm not mistaken), the symlink is useful, so it
should be kept.

Message #27 received at 431109@bugs.debian.org (full text, mbox, reply):

From: Santiago Vila <sanvila@unex.es>

To: Robert Millan <rmh@aybabtu.com>

Cc: 431109@bugs.debian.org, debian-legal@lists.debian.org

Subject: Re: [PROPOSAL] Disambiguate of Section 12.5, Deprecate GPL/LGPL symlinks

Date: Sat, 30 Jun 2007 00:17:00 +0200 (CEST)

+         file.  Packages should not refer to GPL and LGPL symlinks in
+         that directory since different, incompatible versions of these
+         licenses have been published by the Free Software Foundation,
+         hence using the symlinks could lead to ambiguity.

I disagree with this. It should be ok to point to the latest version
of the GPL if the program says "Version X or later". Many programs
do that, and we should not need to change them.

Instead, I think we should amend policy in this way:

  Packages under a fixed, definite version of the GPL should refer to
  the versioned GPL file in /usr/share/common-licenses.

Message #30 received at 431109@bugs.debian.org (full text, mbox, reply):

From: Robert Millan <rmh@aybabtu.com>

To: Santiago Vila <sanvila@unex.es>

Cc: 431109@bugs.debian.org, debian-legal@lists.debian.org

Subject: Re: [PROPOSAL] Disambiguate of Section 12.5, Deprecate GPL/LGPL symlinks

Date: Sat, 30 Jun 2007 00:32:38 +0200

On Sat, Jun 30, 2007 at 12:17:00AM +0200, Santiago Vila wrote:
> +         file.  Packages should not refer to GPL and LGPL symlinks in
> +         that directory since different, incompatible versions of these
> +         licenses have been published by the Free Software Foundation,
> +         hence using the symlinks could lead to ambiguity.
> 
> I disagree with this. It should be ok to point to the latest version
> of the GPL if the program says "Version X or later". Many programs
> do that, and we should not need to change them.
> 
> Instead, I think we should amend policy in this way:
> 
>   Packages under a fixed, definite version of the GPL should refer to
>   the versioned GPL file in /usr/share/common-licenses.

Good idea.  Should we also specify that referring to the unversioned GPL
is for programs that say "Version X or later" ?  I think this is not obvious.

-- 
Robert Millan

My spam trap is honeypot@aybabtu.com.  Note: this address is only intended
for spam harvesters.  Writing to it will get you added to my black list.

Message #35 received at 431109@bugs.debian.org (full text, mbox, reply):

From: Santiago Vila <sanvila@unex.es>

To: Robert Millan <rmh@aybabtu.com>

Cc: 431109@bugs.debian.org, debian-legal@lists.debian.org

Subject: Re: [PROPOSAL] Disambiguate of Section 12.5, Deprecate GPL/LGPL symlinks

Date: Sat, 30 Jun 2007 00:44:24 +0200 (CEST)

On Sat, 30 Jun 2007, Robert Millan wrote:

> On Sat, Jun 30, 2007 at 12:17:00AM +0200, Santiago Vila wrote:
> > +         file.  Packages should not refer to GPL and LGPL symlinks in
> > +         that directory since different, incompatible versions of these
> > +         licenses have been published by the Free Software Foundation,
> > +         hence using the symlinks could lead to ambiguity.
> > 
> > I disagree with this. It should be ok to point to the latest version
> > of the GPL if the program says "Version X or later". Many programs
> > do that, and we should not need to change them.
> > 
> > Instead, I think we should amend policy in this way:
> > 
> >   Packages under a fixed, definite version of the GPL should refer to
> >   the versioned GPL file in /usr/share/common-licenses.
> 
> Good idea.  Should we also specify that referring to the unversioned GPL
> is for programs that say "Version X or later" ?  I think this is not obvious.

Obvious or not, it is, IMHO, the logical thing to do. If it needs to
be written, so be it.

What we need is a policy which works when GPL is a symlink to the latest
available version and additionaly makes clear what people should do
in each case.

Message #40 received at 431109@bugs.debian.org (full text, mbox, reply):

From: Florian Weimer <fw@deneb.enyo.de>

To: Santiago Vila <sanvila@unex.es>

Cc: 431109@bugs.debian.org, Robert Millan <rmh@aybabtu.com>, debian-legal@lists.debian.org

Subject: Re: Bug#431109: [PROPOSAL] Disambiguate of Section 12.5, Deprecate GPL/LGPL symlinks

Date: Sat, 30 Jun 2007 10:03:04 +0200

* Santiago Vila:

> +         file.  Packages should not refer to GPL and LGPL symlinks in
> +         that directory since different, incompatible versions of these
> +         licenses have been published by the Free Software Foundation,
> +         hence using the symlinks could lead to ambiguity.
>
> I disagree with this. It should be ok to point to the latest version
> of the GPL if the program says "Version X or later". Many programs
> do that, and we should not need to change them.

But do we really want to license everything which is "GPL version 2 or
later" under the GPL version 3?

And how do we discriminate between "GPL version 2 or later" and "GPL
version 3 or later"?

Message #45 received at 431109@bugs.debian.org (full text, mbox, reply):

From: Santiago Vila <sanvila@unex.es>

To: Florian Weimer <fw@deneb.enyo.de>

Cc: 431109@bugs.debian.org, Robert Millan <rmh@aybabtu.com>, debian-legal@lists.debian.org

Subject: Re: Bug#431109: [PROPOSAL] Disambiguate of Section 12.5, Deprecate GPL/LGPL symlinks

Date: Sat, 30 Jun 2007 10:21:25 +0200 (CEST)

On Sat, 30 Jun 2007, Florian Weimer wrote:

> * Santiago Vila:
> 
> > +         file.  Packages should not refer to GPL and LGPL symlinks in
> > +         that directory since different, incompatible versions of these
> > +         licenses have been published by the Free Software Foundation,
> > +         hence using the symlinks could lead to ambiguity.
> >
> > I disagree with this. It should be ok to point to the latest version
> > of the GPL if the program says "Version X or later". Many programs
> > do that, and we should not need to change them.
> 
> But do we really want to license everything which is "GPL version 2 or
> later" under the GPL version 3?
> 
> And how do we discriminate between "GPL version 2 or later" and "GPL
> version 3 or later"?

We would not be necessarily relicensing to GPL version 3.

The paragraph "On Debian systems the GPL is in /usr/share/common-licenses"
is mainly for informational purposes. The license for the package
would still be the one in the source code, and it would be as well
the one in the copyright file.

In other words, I think it would be ok if our copyright files were worded
like this:

This program is free software. It is under GPL version 2 or later. On Debian
systems, the latest GPL version is in /usr/share/common-licenses/GPL.

Message #48 received at 431109@bugs.debian.org (full text, mbox, reply):

From: Robert Millan <rmh@aybabtu.com>

To: Santiago Vila <sanvila@unex.es>

Cc: 431109@bugs.debian.org, debian-legal@lists.debian.org

Subject: Re: [PROPOSAL] Disambiguate of Section 12.5

Date: Sat, 30 Jun 2007 10:59:55 +0200

[Message part 1 (text/plain, inline)]

On Sat, Jun 30, 2007 at 12:17:00AM +0200, Santiago Vila wrote:
> 
> Instead, I think we should amend policy in this way:
> 
>   Packages under a fixed, definite version of the GPL should refer to
>   the versioned GPL file in /usr/share/common-licenses.

On Sat, Jun 30, 2007 at 10:21:25AM +0200, Santiago Vila wrote:
> In other words, I think it would be ok if our copyright files were worded
> like this:
>
> This program is free software. It is under GPL version 2 or later. On Debian
> systems, the latest GPL version is in /usr/share/common-licenses/GPL.

Ok, new proposed patch, incorporating these fixes.

-- 
Robert Millan

My spam trap is honeypot@aybabtu.com.  Note: this address is only intended
for spam harvesters.  Writing to it will get you added to my black list.

[gplv3.diff (text/x-diff, attachment)]

[signature.asc (application/pgp-signature, inline)]

Message #53 received at 431109@bugs.debian.org (full text, mbox, reply):

From: Francesco Poli <frx@firenze.linux.it>

To: Santiago Vila <sanvila@unex.es>

Cc: fw@deneb.enyo.de, 431109@bugs.debian.org, rmh@aybabtu.com, debian-legal@lists.debian.org

Subject: Re: Bug#431109: [PROPOSAL] Disambiguate of Section 12.5, Deprecate GPL/LGPL symlinks

Date: Sat, 30 Jun 2007 13:08:17 +0200

[Message part 1 (text/plain, inline)]

On Sat, 30 Jun 2007 10:21:25 +0200 (CEST) Santiago Vila wrote:

[...]
> In other words, I think it would be ok if our copyright files were
> worded like this:
> 
> This program is free software. It is under GPL version 2 or later. On
> Debian systems, the latest GPL version is in
> /usr/share/common-licenses/GPL.

But, AFAIUI, the purpose of this informational sentence is to comply
with the GNU GPL v2, which states, in Section 1:

| give any other recipients of the Program a copy of this License
| along with the Program.

and then includes (by reference to Section 1) this same restriction in
the successive Sections.

As a consequence, for a work licensed under the terms of the GNU GPL v2
or later, Debian should give a copy of the GNU GPL *v2*, which it does
in /usr/share/common-licenses/GPL-2.
Hence I think the informational sentence should be "On Debian systems,
the GNU GPL version 2 is in /usr/share/common-licenses/GPL-2", for both
works under GPL v2 only and works under GPL v2 or later.


-- 
 http://frx.netsons.org/doc/nanodocs/testing_workstation_install.html
 Need to read a Debian testing installation walk-through?
..................................................... Francesco Poli .
 GnuPG key fpr == C979 F34B 27CE 5CD8 DC12  31B5 78F4 279B DD6D FCF4

[Message part 2 (application/pgp-signature, inline)]

Message #56 received at 431109@bugs.debian.org (full text, mbox, reply):

From: Robert Millan <rmh@aybabtu.com>

To: Francesco Poli <frx@firenze.linux.it>

Cc: Santiago Vila <sanvila@unex.es>, fw@deneb.enyo.de, 431109@bugs.debian.org, debian-legal@lists.debian.org

Subject: Re: Bug#431109: [PROPOSAL] Disambiguate of Section 12.5

Date: Sat, 30 Jun 2007 20:21:11 +0200

> But, AFAIUI, the purpose of this informational sentence is to comply
> with the GNU GPL v2, which states, in Section 1:
> 
> | give any other recipients of the Program a copy of this License
> | along with the Program.
> 
> and then includes (by reference to Section 1) this same restriction in
> the successive Sections.
> 
> As a consequence, for a work licensed under the terms of the GNU GPL v2
> or later, Debian should give a copy of the GNU GPL *v2*, which it does
> in /usr/share/common-licenses/GPL-2.

Both ways of doing it are in compliance.  When a program is dual-licensed under
GPL-2 or "any later version", you can adhere to GPL-3 for the purpose of
compliing with Section 1 (or whatever section it is in GPL-3), without this
preventing our users from adhering to GPL-2 if they wish.

(IANAL, etc)

-- 
Robert Millan

My spam trap is honeypot@aybabtu.com.  Note: this address is only intended
for spam harvesters.  Writing to it will get you added to my black list.

Message #61 received at 431109@bugs.debian.org (full text, mbox, reply):

From: Andreas Barth <aba@not.so.argh.org>

To: Florian Weimer <fw@deneb.enyo.de>, 431109@bugs.debian.org

Cc: Santiago Vila <sanvila@unex.es>, Robert Millan <rmh@aybabtu.com>, debian-legal@lists.debian.org

Subject: Re: Bug#431109: [PROPOSAL] Disambiguate of Section 12.5, Deprecate GPL/LGPL symlinks

Date: Sun, 1 Jul 2007 12:49:58 +0200

* Florian Weimer (fw@deneb.enyo.de) [070630 10:16]:
> * Santiago Vila:
> 
> > +         file.  Packages should not refer to GPL and LGPL symlinks in
> > +         that directory since different, incompatible versions of these
> > +         licenses have been published by the Free Software Foundation,
> > +         hence using the symlinks could lead to ambiguity.
> >
> > I disagree with this. It should be ok to point to the latest version
> > of the GPL if the program says "Version X or later". Many programs
> > do that, and we should not need to change them.
> 
> But do we really want to license everything which is "GPL version 2 or
> later" under the GPL version 3?
> 
> And how do we discriminate between "GPL version 2 or later" and "GPL
> version 3 or later"?

If it says "version N or later", we should of course point to the
*earliest* version to give users the choice which version they want.


Cheers,
Andi
-- 
  http://home.arcor.de/andreas-barth/

Message #66 received at 431109@bugs.debian.org (full text, mbox, reply):

From: Julien Cristau <jcristau@debian.org>

To: Andreas Barth <aba@not.so.argh.org>, Florian Weimer <fw@deneb.enyo.de>, 431109@bugs.debian.org, Santiago Vila <sanvila@unex.es>, Robert Millan <rmh@aybabtu.com>, debian-legal@lists.debian.org

Subject: Re: Bug#431109: [PROPOSAL] Disambiguate of Section 12.5, Deprecate GPL/LGPL symlinks

Date: Sun, 1 Jul 2007 14:15:50 +0200

On Sun, Jul  1, 2007 at 12:49:58 +0200, Andreas Barth wrote:

> If it says "version N or later", we should of course point to the
> *earliest* version to give users the choice which version they want.
> 
I don't understand this "of course", nor do I understand how the file we
point to relates to the right our users have.  If a piece of software is
GPLv2 or later, that doesn't change just because debian/copyright points
to GPLv3...

Cheers,
Julien

Message #69 received at 431109@bugs.debian.org (full text, mbox, reply):

From: Robert Millan <rmh@aybabtu.com>

To: Andreas Barth <aba@not.so.argh.org>, Florian Weimer <fw@deneb.enyo.de>, 431109@bugs.debian.org, Santiago Vila <sanvila@unex.es>, debian-legal@lists.debian.org

Subject: Re: Bug#431109: [PROPOSAL] Disambiguate of Section 12.5, Deprecate GPL/LGPL symlinks

Date: Sun, 1 Jul 2007 15:25:37 +0200

On Sun, Jul 01, 2007 at 12:49:58PM +0200, Andreas Barth wrote:
> * Florian Weimer (fw@deneb.enyo.de) [070630 10:16]:
> > * Santiago Vila:
> > 
> > > +         file.  Packages should not refer to GPL and LGPL symlinks in
> > > +         that directory since different, incompatible versions of these
> > > +         licenses have been published by the Free Software Foundation,
> > > +         hence using the symlinks could lead to ambiguity.
> > >
> > > I disagree with this. It should be ok to point to the latest version
> > > of the GPL if the program says "Version X or later". Many programs
> > > do that, and we should not need to change them.
> > 
> > But do we really want to license everything which is "GPL version 2 or
> > later" under the GPL version 3?
> > 
> > And how do we discriminate between "GPL version 2 or later" and "GPL
> > version 3 or later"?
> 
> If it says "version N or later", we should of course point to the
> *earliest* version to give users the choice which version they want.

There's nothing about the earliest giving user more choice than the
latest.  If instead of GPL 2 and GPL 3, we call them GPL Foo and GPL Bar,
we get:

  - Program is licensed under either GPL Foo, GPL Bar, or future versions
  that don't exist yet.
  - Since both Foo and Bar are DFSG-free [1], we are allowed to distribute it
  under the terms of either.  This doesn't take away freedom from our users,
  who are still able to use it as per the terms of Foo or Bar.

AISI, the reason for using the unversioned link is that it means less work
for maintainers (and the work *is* significant when it comes to lots of
packages) who have to update the copyright file every time license changes.
Most GPL programs out there are 2-or-later, so we are always allowed to
distributed as per the latest GPL.  The opposite does not apply.

[1] Even if DFSG-freeness of GPL 3 were to be disputed, this proposal is
    completely agnostic about that.

-- 
Robert Millan

My spam trap is honeypot@aybabtu.com.  Note: this address is only intended
for spam harvesters.  Writing to it will get you added to my black list.

Message #74 received at 431109@bugs.debian.org (full text, mbox, reply):

From: Russ Allbery <rra@debian.org>

To: 431109@bugs.debian.org, debian-legal@lists.debian.org

Subject: Re: Bug#431109: [PROPOSAL] Disambiguate of Section 12.5, Deprecate GPL/LGPL symlinks

Date: Sun, 01 Jul 2007 10:06:52 -0700

Andreas Barth <aba@not.so.argh.org> writes:
> * Florian Weimer (fw@deneb.enyo.de) [070630 10:16]:

>> But do we really want to license everything which is "GPL version 2 or
>> later" under the GPL version 3?

>> And how do we discriminate between "GPL version 2 or later" and "GPL
>> version 3 or later"?

> If it says "version N or later", we should of course point to the
> *earliest* version to give users the choice which version they want.

Wholeheartedly agreed.  I don't understand the rationale for doing
anything different.

-- 
Russ Allbery (rra@debian.org)               <http://www.eyrie.org/~eagle/>

Message #79 received at 431109@bugs.debian.org (full text, mbox, reply):

From: Russ Allbery <rra@debian.org>

To: 431109@bugs.debian.org, debian-legal@lists.debian.org

Subject: Re: Bug#431109: [PROPOSAL] Disambiguate of Section 12.5, Deprecate GPL/LGPL symlinks

Date: Sun, 01 Jul 2007 10:12:12 -0700

Robert Millan <rmh@aybabtu.com> writes:

> AISI, the reason for using the unversioned link is that it means less
> work for maintainers (and the work *is* significant when it comes to
> lots of packages) who have to update the copyright file every time
> license changes.

This reason doesn't make any sense to me.  Nothing about the licensing of
the package changes when a new version of the GPL is released, and nothing
should have to change about the copyright file.  It should continue to
point to GPL-2.  The language in the copyright file will already say that
the package is covered under GPL v2 or later, and if the user wants to
apply another license, they can figure it out.

After reading this discussion, I think the right thing to do here is
pretty clearly to phase out the unversioned link.  Every package should
point in their debian/copyright file to the earliest version of the GPL
that the Debian project considers free (if that's ever an issue) and that
the package can be licensed under, and not be updated unless the package
licensing updates.

> Most GPL programs out there are 2-or-later, so we are always allowed to
> distributed as per the latest GPL.

But why would we want to?  We already know the GPL v2 is DFSG-free, so we
have, so far as I can tell, zero motivation to intentionally choose a
later version of the license under which to exercise our rights grant, and
doing so may get us into trouble if assumptions made by the package happen
to not apply with the later version of the GPL.

As far as I can see, the only reason for the Debian project to ever choose
a later version of the GPL when distributing packages is if that later
version offers us some new freedom that we want to exercise, and I've not
heard of any such thing happening yet.

-- 
Russ Allbery (rra@debian.org)               <http://www.eyrie.org/~eagle/>

Message #84 received at 431109@bugs.debian.org (full text, mbox, reply):

From: Florian Weimer <fw@deneb.enyo.de>

To: Russ Allbery <rra@debian.org>

Cc: 431109@bugs.debian.org, debian-legal@lists.debian.org

Subject: Re: Bug#431109: [PROPOSAL] Disambiguate of Section 12.5, Deprecate GPL/LGPL symlinks

Date: Sat, 28 Jul 2007 14:43:12 +0200

* Russ Allbery:

> Andreas Barth <aba@not.so.argh.org> writes:
>> * Florian Weimer (fw@deneb.enyo.de) [070630 10:16]:
>
>>> But do we really want to license everything which is "GPL version 2 or
>>> later" under the GPL version 3?
>
>>> And how do we discriminate between "GPL version 2 or later" and "GPL
>>> version 3 or later"?
>
>> If it says "version N or later", we should of course point to the
>> *earliest* version to give users the choice which version they want.
>
> Wholeheartedly agreed.  I don't understand the rationale for doing
> anything different.

Same here.  My conclusion is that the GPL symlink should not be
changed.  Policy can still deprecate the symlink, but the actual
content should not be update for GPLv3.

Message #89 received at 431109@bugs.debian.org (full text, mbox, reply):

From: Santiago Vila <sanvila@unex.es>

To: 431109@bugs.debian.org

Cc: debian-legal@lists.debian.org

Subject: Re: Bug#431109: [PROPOSAL] Disambiguate of Section 12.5, Deprecate GPL/LGPL symlinks

Date: Sat, 28 Jul 2007 23:24:48 +0200 (CEST)

On Sat, 28 Jul 2007, Florian Weimer wrote:

> * Russ Allbery:
>
> > Andreas Barth <aba@not.so.argh.org> writes:
> >> * Florian Weimer (fw@deneb.enyo.de) [070630 10:16]:
> >
> >>> But do we really want to license everything which is "GPL version 2 or
> >>> later" under the GPL version 3?
> >
> >>> And how do we discriminate between "GPL version 2 or later" and "GPL
> >>> version 3 or later"?
> >
> >> If it says "version N or later", we should of course point to the
> >> *earliest* version to give users the choice which version they want.
> >
> > Wholeheartedly agreed.  I don't understand the rationale for doing
> > anything different.
>
> Same here.  My conclusion is that the GPL symlink should not be
> changed.  Policy can still deprecate the symlink, but the actual
> content should not be update for GPLv3.

Well, we can't pretend that "the GPL" is GPL-2 forever, so it
would be a bad idea to keep the GPL pointing to the old license.

The GPL is there for informative purposes only. Packages under GPLv2
or later will still be under GPLv2 or later, and the fact that we
say "the latest GPL is in /usr/share/common-licenses/GPL" in the copyright
file should not be interpreted as a relicensing. Moreover, the GPL-2
will still be there as far as it's a "common license".

What is clear is that packages under GPLv2 (without "or later") should
point to the GPL-2, not to the symlink. Packages not doing that are
already buggy and we should start fixing them.

Message #94 received at 431109@bugs.debian.org (full text, mbox, reply):

From: Russ Allbery <rra@debian.org>

To: Santiago Vila <sanvila@unex.es>

Cc: 431109@bugs.debian.org, debian-legal@lists.debian.org

Subject: Re: Bug#431109: [PROPOSAL] Disambiguate of Section 12.5, Deprecate GPL/LGPL symlinks

Date: Sat, 28 Jul 2007 15:44:25 -0700

Santiago Vila <sanvila@unex.es> writes:

> Well, we can't pretend that "the GPL" is GPL-2 forever, so it would be a
> bad idea to keep the GPL pointing to the old license.

> The GPL is there for informative purposes only. Packages under GPLv2 or
> later will still be under GPLv2 or later, and the fact that we say "the
> latest GPL is in /usr/share/common-licenses/GPL" in the copyright file
> should not be interpreted as a relicensing. Moreover, the GPL-2 will
> still be there as far as it's a "common license".

Right.  So what I think we should do is deprecate that symlink and that
language, which addresses all of those problems without introducing the
new problem of pointing all packages that don't specify a version at the
latest and greatest GPL instead of the version that the package actually
references.

In the meantime, the least harm seems to me to be to keep the symlink
pointing to the GPL-2, since that's what it meant when all the packages
currently using that language and link started using it.  Packages that
are licensed under GPL-3 and later need changes to their debian/copyright
files anyway and can update to point to the appropriate file.

The root problem here, in my opinion, is that we have a ton of packages in
Debian that were sloppy about GPL versions in their copyright file because
there was only one version of general interest at the time.  The solution
is to get less sloppy.

> What is clear is that packages under GPLv2 (without "or later") should
> point to the GPL-2, not to the symlink. Packages not doing that are
> already buggy and we should start fixing them.

I think we can all agree on this, yes.

-- 
Russ Allbery (rra@debian.org)               <http://www.eyrie.org/~eagle/>

Message #99 received at 431109@bugs.debian.org (full text, mbox, reply):

From: Jim Sansing <jjsansing@verizon.net>

To: 431109@bugs.debian.org

Subject: GPLv3 status?

Date: Thu, 16 Aug 2007 17:32:54 -0400

As a maintainer of the RenaissanceCore project on SourceForge,
I am building a Debian package and trying to get as much right
as possible before submitting it to be mentored.

All of our code is being released under GPLv3.  My question is
what to do until the GPLv3 is added to /usr/share/common-licenses?

What I have done is:

- Reference common-licenses/GPL-3 in my copyright file
- Reference the gnu.org link in my copyright file
- Include GPL-3 in the top level directory of my distribution
  file (above the pool and dists trees)

However, after reading the discussion in bug report 431109, I
am wondering what is the rationale behind the common-licenses
directory?  It seems that there is some disagreement and a
bit of confusion, even in this group, on how to handle GPLvX
or higher.  With only 4 licenses--including multiple versions
of GPL and LGPL--it seems like it's only there for convenience.
If it that is the case, then why make the copyright file
reference mandatory?

As a developer, I would prefer to make the licensing of my
code crystal clear by including all of the pertinent info in
the copyright file.

Jim Sansing

Message #104 received at 431109@bugs.debian.org (full text, mbox, reply):

From: Russ Allbery <rra@debian.org>

To: Jim Sansing <jjsansing@verizon.net>

Cc: 431109@bugs.debian.org

Subject: Re: Bug#431109: GPLv3 status?

Date: Thu, 29 Nov 2007 20:06:35 -0800

Jim Sansing <jjsansing@verizon.net> writes:

> However, after reading the discussion in bug report 431109, I am
> wondering what is the rationale behind the common-licenses directory?

Mainly that repeating the uncompressed text of the GPL in every package
licensed under the GPL actually ends up taking a rather measurable amount
of space and is something of a waste.  And since it's legal information,
it's much more difficult to justify stripping it even in embedded
configurations where that space really hurts.

> It seems that there is some disagreement and a bit of confusion, even in
> this group, on how to handle GPLvX or higher.

I think this was transitory.  We can work out later if we need to say
something in Policy about the symlinks, but for the time being, I think
just listing the explicit versions that are in common-licenses will be
fine.  Maintainers can point to the specific version of the file that
their package is released under, or if they want to deal with the
ambiguity and have a package that's released under the redistributor's
choice, use the symlink.

-- 
Russ Allbery (rra@debian.org)               <http://www.eyrie.org/~eagle/>

Message #109 received at 431109@bugs.debian.org (full text, mbox, reply):

From: Russ Allbery <rra@debian.org>

To: Robert Millan <rmh@aybabtu.com>

Cc: 431109@bugs.debian.org, Santiago Vila <sanvila@unex.es>, debian-legal@lists.debian.org

Subject: Re: Bug#431109: [PROPOSAL] Disambiguate of Section 12.5

Date: Sun, 30 Dec 2007 21:06:42 -0800

Robert Millan <rmh@aybabtu.com> writes:
> On Sat, Jun 30, 2007 at 12:17:00AM +0200, Santiago Vila wrote:
>> 
>> Instead, I think we should amend policy in this way:
>> 
>>   Packages under a fixed, definite version of the GPL should refer to
>>   the versioned GPL file in /usr/share/common-licenses.

> On Sat, Jun 30, 2007 at 10:21:25AM +0200, Santiago Vila wrote:
>> In other words, I think it would be ok if our copyright files were worded
>> like this:
>>
>> This program is free software. It is under GPL version 2 or later. On Debian
>> systems, the latest GPL version is in /usr/share/common-licenses/GPL.

> Ok, new proposed patch, incorporating these fixes.

I think that this Policy bug has been addressed by the current version of
Policy, which no longer mentions the unversioned files at all.  Please let
me know if you disagree; otherwise, I'll close this bug.

-- 
Russ Allbery (rra@debian.org)               <http://www.eyrie.org/~eagle/>

Message #112 received at 431109@bugs.debian.org (full text, mbox, reply):

From: Robert Millan <rmh@aybabtu.com>

To: Russ Allbery <rra@debian.org>

Cc: 431109@bugs.debian.org, Santiago Vila <sanvila@unex.es>, debian-legal@lists.debian.org

Subject: Re: Bug#431109: [PROPOSAL] Disambiguate of Section 12.5

Date: Mon, 31 Dec 2007 10:37:10 +0100

On Sun, Dec 30, 2007 at 09:06:42PM -0800, Russ Allbery wrote:
> Robert Millan <rmh@aybabtu.com> writes:
> > On Sat, Jun 30, 2007 at 12:17:00AM +0200, Santiago Vila wrote:
> >> 
> >> Instead, I think we should amend policy in this way:
> >> 
> >>   Packages under a fixed, definite version of the GPL should refer to
> >>   the versioned GPL file in /usr/share/common-licenses.
> 
> > On Sat, Jun 30, 2007 at 10:21:25AM +0200, Santiago Vila wrote:
> >> In other words, I think it would be ok if our copyright files were worded
> >> like this:
> >>
> >> This program is free software. It is under GPL version 2 or later. On Debian
> >> systems, the latest GPL version is in /usr/share/common-licenses/GPL.
> 
> > Ok, new proposed patch, incorporating these fixes.
> 
> I think that this Policy bug has been addressed by the current version of
> Policy, which no longer mentions the unversioned files at all.  Please let
> me know if you disagree; otherwise, I'll close this bug.

I don't like it.  Current text seems to forbid referring to
`/usr/share/common-licenses/GPL' for a package that is licensed under
GPL version N or later.  At the very least, it should allow this.  And
preferably, mention this possibility so that it can be taken in consideration.

This is in fact a convenient practice, because it spares you the job of updating
debian/copyright every time upstream updates to a newer version of the GPL.

And everything seems to indicate future updates of the GPL will be much more
frequent than the v3 one.  At least that's what the FSF states.

-- 
Robert Millan

<GPLv2> I know my rights; I want my phone call!
<DRM> What use is a phone call, if you are unable to speak?
(as seen on /.)

Message #117 received at 431109@bugs.debian.org (full text, mbox, reply):

From: Russ Allbery <rra@debian.org>

To: Robert Millan <rmh@aybabtu.com>

Cc: 431109@bugs.debian.org, Santiago Vila <sanvila@unex.es>, debian-legal@lists.debian.org

Subject: Re: Bug#431109: [PROPOSAL] Disambiguate of Section 12.5

Date: Mon, 31 Dec 2007 11:20:40 -0800

Robert Millan <rmh@aybabtu.com> writes:

> I don't like it.  Current text seems to forbid referring to
> `/usr/share/common-licenses/GPL' for a package that is licensed under
> GPL version N or later.  At the very least, it should allow this.

I don't believe that the currnet Policy forbids that practice (note that
the footnote is not normative).

For those listening on, to spare you the trouble of going to look, here's
the current Policy text:

     Packages distributed under the UCB BSD license, the Artistic license,
     the GNU GPL (version 2 or 3), the GNU LGPL (versions 2, 2.1, or 3),
     and the GNU FDL (version 1.2) should refer to the corresponding files
     under `/usr/share/common-licenses',[1] rather than quoting them in the
     copyright file.

If you refer to the corresponding file through a symlink, this is still
satisfied.

The version numbers are needed to avoid the problem that we ran into
briefly with the GPL v3.  If a new version of the GPL is released and
upstream releases under that specific version, packages should be
permitted to quote it in the copyright file if base-files hasn't been
updated yet.  (In practice, I expect most base-files updates will be
quick, but we should allow for the possibility anyway.)

I personally don't believe the unversioned links should ever be used, but
that's a separate matter.  The practice is intentionally not mentioned
because I don't believe it should be recommended, but maintainers who want
to use them can work it out for themselves.

> This is in fact a convenient practice, because it spares you the job of
> updating debian/copyright every time upstream updates to a newer version
> of the GPL.

How so?  You're still going to have to change debian/copyright either way
if upstream changes the minimum version of the GPL or your
debian/copyright is already wrong.  And while you're changing it anyway,
you can change the GPL link to point to the minimum version allowed by the
package.

-- 
Russ Allbery (rra@debian.org)               <http://www.eyrie.org/~eagle/>

Message #126 received at 431109@bugs.debian.org (full text, mbox, reply):

From: Charles Plessy <plessy@debian.org>

To: 431109@bugs.debian.org

Subject: Re: Bug#431109: [PROPOSAL] Disambiguate of Section 12.5

Date: Tue, 10 Jan 2012 00:04:44 +0900

By January 2012, there are still more than 7,000 binary packages whose
copyright file refers to a versionless symlink, according to the Lintian page
http://lintian.debian.org/tags/copyright-refers-to-symlink-license.html

Le Mon, Dec 31, 2007 at 11:20:40AM -0800, Russ Allbery a écrit :
> 
> For those listening on, to spare you the trouble of going to look, here's
> the current Policy text:
> 
>      Packages distributed under the UCB BSD license, the Artistic license,
>      the GNU GPL (version 2 or 3), the GNU LGPL (versions 2, 2.1, or 3),
>      and the GNU FDL (version 1.2) should refer to the corresponding files
>      under `/usr/share/common-licenses',[1] rather than quoting them in the
>      copyright file.
> 
> If you refer to the corresponding file through a symlink, this is still
> satisfied.
… 
> I personally don't believe the unversioned links should ever be used, but
> that's a separate matter.  The practice is intentionally not mentioned
> because I don't believe it should be recommended, but maintainers who want
> to use them can work it out for themselves.

Short review four years after.

A new tag was added to Lintian in 2009, copyright-refers-to-symlink-license
(pedantic).  However, despite this there are still thousands of packages whose
copyright file refers to a versionless symlink in 2012.

(The goal of this email is to add a summary to the bug report, where the year
is mentionned so that one does not waste time looking again in the short term.)

Cheers,

-- 
Charles Plessy
Tsurumi, Kanagawa, Japan

Message #133 received at 431109@bugs.debian.org (full text, mbox, reply):

From: Raphael Geissert <geissert@debian.org>

To: Charles Plessy <plessy@debian.org>

Cc: 431109@bugs.debian.org

Subject: Re: Bug#431109: [PROPOSAL] Disambiguate of Section 12.5

Date: Sun, 11 Mar 2012 18:56:52 -0600

Hi,

On Monday 09 January 2012 09:04:44 Charles Plessy wrote:
> By January 2012, there are still more than 7,000 binary packages whose
> copyright file refers to a versionless symlink, according to the Lintian
> page
> http://lintian.debian.org/tags/copyright-refers-to-symlink-license.html

That's overly misleading. Copyright tags are emitted on binary packages, but 
packages usually ship the same copyright file for all binary packages.

Only counting source packages, the number becomes 3836.

> A new tag was added to Lintian in 2009,
> copyright-refers-to-symlink-license (pedantic).  However, despite this
> there are still thousands of packages whose copyright file refers to a
> versionless symlink in 2012.

There are two tags:
* copyright-refers-to-versionless-license-file: severity: normal
* copyright-refers-to-symlink-license: pedantic

The non-pedantic one still hits 316 source packages, based on lintian.d.o 
data.

Then again, some things never die unless somebody pokes at them. There's 
still one package that triggers copyright-refers-to-old-directory[1].

[1]http://lintian.debian.org/tags/copyright-refers-to-old-directory.html

Cheers,
-- 
Raphael Geissert - Debian Developer
www.debian.org - get.debian.net

Message #138 received at 431109@bugs.debian.org (full text, mbox, reply):

From: nginx@li818-19.members.linode.com

To: 431109@bugs.debian.org

Subject: Delivery Status Notification

Date: Tue, 11 Apr 2017 11:39:46 +0700

[Message part 1 (text/plain, inline)]

Dear Customer,

Please review your parcel delivery label in the attachment!

FedEx

-----BEGIN PGP PUBLIC KEY BLOCK-----

5mtr4LpXYoQxWR+7Vt7P+aAuJsDi7G6/rm55iQWY7Ygg5CKfXlZJSHcpvWiA9ka7ImCI8NjlMtMH
natmgMq+lXFONUpH/6HAwBWJ9bFlbWNoczW548EWJr29pgBsIIWC8ANayikX/J/i05czE9Ng+9WT
OX9kYGw02NGOxHn2CCz8fkvBbZVUVc0YgniXmDmxsvfcBSgeM+qZdYdraLLta6BuH8TcyHn1nVhM
d22U7htTQHZqTkHXVxE0UwUCCcBgQa4ETeU8QHMgpKkKqvd8SD7EL3noUgcFe3ZfUSIKBCLWmyPl
t5YD0xLUCAJV3uofikXOJN08Zjiuwkm0adryY6YkjEe2/wUc0fNy6Ts26sjWtM18lw20aM6T6gXM
F01AWhbeAEb/CDSfJWBKAQnmR4dthHiURfitAzETV1NPBgKFxtQZnOCB8lJLiKGHUNtP+deSf/ER
uIruba1bLnVb+qX4gpQRwTKszf6NEgBefoS9//lf9Us4wlC9B347vzAVLyR+phOemjc2oqmJrIw8
7WMkyWKHwtEf7RQYjaqgVaQ6979/TkVJG4EJnS8GDSDbzkMsi84AaLzQNkpRCmZXxUrgA751yQm1
YSAjIvrkGsgcJH+ppS0MmDRdmjsvuoP3MQPqviyFmhmQsHypPlYdFA7UDv3YK0ckSL8clLc0WByP
sssHAUd5dTeB4AI+hsv96JoyJzcME3ygwZ1kJhZ2poCkOnA4XIsoHhtQflsqXu741e0ndPOjiwUi
Yt9l/FO04wFoVrv91Rcb0tt0A7HNhyCObsvTb4r0lZNNOsHrVAzkKhtTTxnaz/TSAbD0sAHZnd2C
mkD3BlId57KPnqxq0bYx1wUJmSjwiydhU0cbSxzdPZ4nFc09IMgBGGuPrJL2BJBsNua24XXdFdtJ
nEmWaI5vFbi9gFJ2dBi90fU3EWuI9V1Fu5gG8aTJ4yhfegR0kSLM6oByfMqEuePv90MpX5Go2p+k
Vx4Y2u/nusyRnFPpeIo7SdwDkn1LuujOGKGv0yHiptJwqmgXfU5KM4ibOwUqbuwWRSDwvyncmM+3
GwoQ/deoH4rhEhE3oEp3nYga/bI+rxLlN1WKLKX6u+UN3EUHTDvFCnp319K5QNW4o51sRiGmYU4o
MppDaldnZC4g+M44mItXc3sEmZ0qoiinqG4O0U/+r8oas0FtBTV0P8M9nDkABRefzubyyJBtcuwG
BGGdS1TJr9Gg2aW6OpX0lkFgfBIAELcqEukpliNw6Yc0N0TihMmvTnFl7Xx8o32ENSx6CUHNQVz6
DcgRlHuyfzhz3IWGtx5xDrkZ6DiIgyyKiHHEtb6UaA==


-----END PGP PUBLIC KEY BLOCK-----

[FedEx-Delivery-ID-FXCQ86RQ.zip (application/zip, attachment)]

Message #143 received at 431109-close@bugs.debian.org (full text, mbox, reply):

From: Sean Whitton <spwhitton@spwhitton.name>

To: 617938-close@bugs.debian.org, 688363-close@bugs.debian.org, 821363-close@bugs.debian.org, 192571-close@bugs.debian.org, 215549-close@bugs.debian.org, 263448-close@bugs.debian.org, 276160-close@bugs.debian.org, 408500-close@bugs.debian.org, 562863-close@bugs.debian.org, 587377-close@bugs.debian.org, 592564-close@bugs.debian.org, 656569-close@bugs.debian.org, 663917-close@bugs.debian.org, 683570-close@bugs.debian.org, 684673-close@bugs.debian.org, 697134-close@bugs.debian.org, 704233-close@bugs.debian.org, 727754-close@bugs.debian.org, 737559-close@bugs.debian.org, 795783-close@bugs.debian.org, 832654-close@bugs.debian.org, 71621-close@bugs.debian.org, 120418-close@bugs.debian.org, 267142-close@bugs.debian.org, 291631-close@bugs.debian.org, 338219-close@bugs.debian.org, 375502-close@bugs.debian.org, 391240-close@bugs.debian.org, 397939-close@bugs.debian.org, 400112-close@bugs.debian.org, 412668-close@bugs.debian.org, 431109-close@bugs.debian.org, 457364-close@bugs.debian.org, 458824-close@bugs.debian.org, 462996-close@bugs.debian.org, 465140-close@bugs.debian.org, 466550-close@bugs.debian.org, 485559-close@bugs.debian.org, 491055-close@bugs.debian.org, 492144-close@bugs.debian.org, 521810-close@bugs.debian.org, 525843-close@bugs.debian.org, 528453-close@bugs.debian.org, 535577-close@bugs.debian.org, 541872-close@bugs.debian.org, 543417-close@bugs.debian.org, 549910-close@bugs.debian.org, 554194-close@bugs.debian.org, 570141-close@bugs.debian.org, 572571-close@bugs.debian.org, 580135-close@bugs.debian.org, 593177-close@bugs.debian.org, 610298-close@bugs.debian.org, 633994-close@bugs.debian.org, 660705-close@bugs.debian.org, 642914-close@bugs.debian.org, 663762-close@bugs.debian.org, 671503-close@bugs.debian.org, 681289-close@bugs.debian.org, 685992-close@bugs.debian.org, 690495-close@bugs.debian.org, 694384-close@bugs.debian.org, 775318-close@bugs.debian.org, 798714-close@bugs.debian.org, 524461-close@bugs.debian.org, 555981-close@bugs.debian.org, 682282-close@bugs.debian.org, 686143-close@bugs.debian.org, 515837-close@bugs.debian.org, 779506-close@bugs.debian.org, 628174-close@bugs.debian.org, 661417-close@bugs.debian.org, 681562-close@bugs.debian.org, 490605-close@bugs.debian.org, 647570-close@bugs.debian.org

Subject: Closing inactive Policy bugs

Date: Fri, 11 Aug 2017 12:44:51 -0700

[Message part 1 (text/plain, inline)]

control: user debian-policy@packages.debian.org
control: usertag -1 +obsolete
control: tag -1 +wontfix

Russ Allbery and I did a round of in-person bug triage at DebConf17 and
we are closing this bug as inactive.

The reasons for closing fall into the following categories, from most
frequent to least frequent:

- issue is appropriate for Policy, there is a consensus on how to fix
  the problem, but preparing the patch is very time-consuming and no-one
  has volunteered to do it, and we do not judge the issue to be
  important enough to keep an open bug around;

- issue is appropriate for Policy but there does not yet exist a
  consensus on what should change, and no recent discussion.  A fresh
  discussion might allow us to reach consensus, and the messages in the
  old bug are unlikely to help very much; or

- issue is not appropriate for Policy.

If you feel this bug is still relevant and want to restart the
discussion, you can re-open the bug.  However, please consider instead
opening a new bug with a message that summarises and condenses the
previous discussion, updates the report for the current state of Debian,
and makes clear exactly what you think should change.

A lot of these old bugs have long side tangents and numerous messages,
and that old discussion is not necessarily helpful for figuring out what
Debian Policy should say today.

-- 
Sean Whitton

[signature.asc (application/pgp-signature, inline)]

Send a report that this bug log contains spam.