Debian Bug report logs - #594519
multiple copyright problems make software non-redistributable as currently packaged

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Hein-Pieter van Braam <hp@tmm.cx> (by way of Hein-Pieter van Braam <hp@tmm.cx>)

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: audacious-plugins contains (non-free) MAME licensed code in the "psf2.so" plugin

Date: Thu, 26 Aug 2010 15:36:53 +0000

Package: audacious-plugins
Version: 2.3-2+b1
Severity: serious
Justification: Debian policy 12.5 - Copyright information is wrong and the used license is non-free

The sourcecode of the audacious plugin contains mame licensed code in the
following files :

/audacious-plugins-2.3/src/psf/osd_cpu.h
/audacious-plugins-2.3/src/psf/psx.c
/audacious-plugins-2.3/src/psf/psx.h
/audacious-plugins-2.3/src/psf/cpuintrf.h
/audacious-plugins-2.3/src/psf/mamemem.h

according to /audacious-plugins-2.3/src/psf/license.txt

the MAME license is a non-free license due to

* Redistributions may not be sold, nor may they be used in a commercial product
or activity.
* Redistributions that are modified from the original source must include the
complete source code, including the source code for all components used by a
binary built from the modified sources. However, as a special exception, the
source code distributed need not include anything that is normally distributed
(in either source or binary form) with the major components (compiler, kernel,
and so on) of the operating system on which the executable runs, unless that
component itself accompanies the executable.

Debian copyright does not contain this information.



-- System Information:
Debian Release: squeeze/sid
  APT prefers unstable
  APT policy: (500, 'unstable')
Architecture: amd64 (x86_64)

Kernel: Linux 2.6.32-5-amd64 (SMP w/2 CPU cores)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash

Versions of packages audacious-plugins depends on:
ii  libasound2         1.0.23-1              shared library for ALSA applicatio
ii  libatk1.0-0        1.30.0-1              The ATK accessibility toolkit
ii  libaudcore1        2.3-2                 audacious core engine library
ii  libaudid3tag2      2.3-2                 audacious id3 tag manipulation lib
ii  libavcodec52       5:0.6~svn20100726-0.0 library to encode decode multimedi
ii  libavformat52      5:0.6~svn20100726-0.0 ffmpeg file format library
ii  libavutil49        4:0.5.2-2             ffmpeg utility library
ii  libbinio1ldbl      1.4-14                Binary I/O stream class library
ii  libc6              2.11.2-2              Embedded GNU C Library: Shared lib
ii  libcairo2          1.8.10-5              The Cairo 2D vector graphics libra
ii  libcddb2           1.3.2-2               library to access CDDB data - runt
ii  libcdio-cdda0      0.81-4                library to read and control digita
ii  libcdio10          0.81-4                library to read and control CD-ROM
ii  libcue1            1.4.0-1               CUE Sheet Parser Library
ii  libdbus-1-3        1.2.24-3              simple interprocess messaging syst
ii  libdbus-glib-1-2   0.88-2                simple interprocess messaging syst
ii  libesd0            0.2.41-7              Enlightened Sound Daemon - Shared 
ii  libfaad2           2.7-4                 freeware Advanced Audio Decoder - 
ii  libflac8           1.2.1-3               Free Lossless Audio Codec - runtim
ii  libfluidsynth1     1.1.1-4+b1            Real-time MIDI software synthesize
ii  libfontconfig1     2.8.0-2.1             generic font configuration library
ii  libfreetype6       2.4.2-1               FreeType 2 font engine, shared lib
ii  libgcc1            1:4.4.4-9             GCC support library
ii  libglib2.0-0       2.24.1-1              The GLib library of C routines
ii  libgtk2.0-0        2.20.1-1              The GTK+ graphical user interface 
ii  libjack-jackd2-0 [ 1.9.5~dfsg-19         JACK Audio Connection Kit (librari
ii  liblircclient0     0.8.3-5               infra-red remote control support -
ii  libmad0            0.15.1b-5             MPEG audio decoder library
ii  libmcs1            0.7.1-1               Abstraction library to store confi
ii  libmms0            0.6-1                 MMS stream protocol library - shar
ii  libmowgli1         0.6.1-1               a high performance development fra
ii  libmtp8            1.0.3-1               Media Transfer Protocol (MTP) libr
ii  libneon27-gnutls   0.29.3-2              An HTTP and WebDAV client library 
ii  libogg0            1.2.0~dfsg-1          Ogg bitstream library
ii  libpango1.0-0      1.28.1-1              Layout and rendering of internatio
ii  libpulse0          0.9.21-3+b1           PulseAudio client libraries
ii  libresid-builder0c 2.1.1-8               SID chip emulation class based on 
ii  libsamplerate0     0.1.7-3               Audio sample rate conversion libra
ii  libsdl1.2debian    1.2.14-6              Simple DirectMedia Layer
ii  libshout3          2.2.2-5+b1            MP3/Ogg Vorbis broadcast streaming
ii  libsidplay2        2.1.1-8               SID (MOS 6581) emulation library
ii  libsndfile1        1.0.21-3              Library for reading/writing audio 
ii  libstdc++6         4.4.4-9               The GNU Standard C++ Library v3
ii  libusb-0.1-4       2:0.1.12-15           userspace USB programming library
ii  libvorbis0a        1.3.1-1               The Vorbis General Audio Compressi
ii  libvorbisenc2      1.3.1-1               The Vorbis General Audio Compressi
ii  libvorbisfile3     1.3.1-1               The Vorbis General Audio Compressi
ii  libwavpack1        4.60.1-1              an audio codec (lossy and lossless
ii  libx11-6           2:1.3.3-3             X11 client-side library
ii  libxcomposite1     1:0.4.2-1             X11 Composite extension library
ii  libxfixes3         1:4.0.5-1             X11 miscellaneous 'fixes' extensio
ii  libxml2            2.7.7.dfsg-4          GNOME XML library
ii  libxrender1        1:0.9.6-1             X Rendering Extension client libra
ii  zlib1g             1:1.2.3.4.dfsg-3      compression library - runtime

Versions of packages audacious-plugins recommends:
ii  audacious                     2.3-2      small and fast audio player which 

audacious-plugins suggests no packages.

-- no debconf information

Message #12 received at 594519-close@bugs.debian.org (full text, mbox, reply):

From: William Pitcock <nenolod@dereferenced.org>

To: 594519-close@bugs.debian.org

Date: Sun, 26 Sep 2010 08:20:00 +0400 (MSD)

license.txt is invalid and has been removed upstream.  There are
no valid copyrights on those files, thus making any license statement
moot until the copyright holders step up, in which case, it will be
handled upstream.

We can close this bug, and thus I am closing it now, as it can be
considered retroactively resolved.

Message #17 received at 594519@bugs.debian.org (full text, mbox, reply):

From: "Adam D. Barratt" <adam@adam-barratt.org.uk>

To: William Pitcock <nenolod@dereferenced.org>

Cc: 594519@bugs.debian.org

Subject: Re: Bug#594519: marked as done (audacious-plugins contains (non-free) MAME licensed code in the "psf2.so" plugin)

Date: Sun, 26 Sep 2010 21:56:56 +0100

reopen 594519
thanks

On Sun, 2010-09-26 at 04:27 +0000, Debian Bug Tracking System wrote:
[...]
> > -------- Forwarded Message --------
> > From: William Pitcock <nenolod@dereferenced.org>
> > To: 594519-close@bugs.debian.org
> > Subject: 
> > Date: Sun, 26 Sep 2010 08:20:00 +0400 (MSD)
> > 
> > license.txt is invalid and has been removed upstream.  There are
> > no valid copyrights on those files, thus making any license statement
> > moot until the copyright holders step up, in which case, it will be
> > handled upstream.

If the license statement is moot and there are no valid copyrights,
where are we getting the right to distribute the files from?

Regards,

Adam

Message #24 received at 594519@bugs.debian.org (full text, mbox, reply):

From: Hein-Pieter van Braam <hp@tmm.cx>

To: adam@adam-barratt.org.uk

Cc: 594519@bugs.debian.org, nenolod@dereferenced.org

Subject: Re: Bug#594519: marked as done (audacious-plugins contains (non-free) MAME licensed code in the "psf2.so" plugin)

Date: Mon, 27 Sep 2010 15:12:28 +0200

[Message part 1 (text/plain, inline)]

>If the license statement is moot and there are no valid copyrights, >where are we getting the right to distribute the files from? > >Regards, > >Adam 

that is indeed a problem, both upstream and myself are currently in the process of trying to contact  the copyright holders of the offending files. 

 

Upstream has already removed almost all offending files. If rights to the remaining files cannot be secured a replacement will be ported from a GPL or BSD source. 

 

In the meantime, this bug should probably remain open, me or upstream will update this bug once the last of the copyright questions have been answered and/or a free replacement has been released.

 

- Hein-Pieter van Braam

[Message part 2 (text/html, inline)]

Message #29 received at 594519@bugs.debian.org (full text, mbox, reply):

From: Mike O'Connor <stew@debian.org>

To: 594519@bugs.debian.org

Subject: More info

Date: Mon, 27 Sep 2010 15:19:50 -0400

[Message part 1 (text/plain, inline)]

retitle 594519 multiple copyright problems make software non-redistributable as currently packaged
thanks

I encouraged the submitter to submit this bug after he raised concerns
on IRC about some of software in this package.  I thought that I'd
better take a closer look at this source myself, and I immediately found
multiple problems related to the licenses/copyrights of this software
package.  The problem originally reported by the submitter appears to be
a valid concern for upstream.  There are also errors in the
debian/copyright file which should be addressed by the maintainers with
the next upload.  I found many instances where copyright holders were
missing from debian/copyright when the BSD like license requires that
they be present.  There are multiple flavors of the BSD license which
should be explicitly present in debian/copyright.  There were files
which were GPL v2 only and files which were GPL v3 only where
debian/copyright simply said "GPL".  I haven't closely enough to
determine if software from these two incompatible licenses is beiong
used in such a way as to produce non-redistributable binaries.

I don't have time to make a full source code audit of this source
package immediately, but one needs to be done.

Thanks,
stew

[Message part 2 (application/pgp-signature, inline)]

Message #36 received at 594519@bugs.debian.org (full text, mbox, reply):

From: Hein-Pieter van Braam <hp@tmm.cx>

To: 594519@bugs.debian.org

Subject: Code audit

Date: Mon, 27 Sep 2010 21:58:16 +0200

I will perform a code audit of the audacious package and send a diff 
for the debian/copyright as soon as I'm finished. Should be somewhere this week.

Message #41 received at 594519@bugs.debian.org (full text, mbox, reply):

From: Chris Taylor <ctaylor@debian.org>

To: 594519@bugs.debian.org

Subject: Re: Bug#594519: Code audit

Date: Mon, 27 Sep 2010 14:50:55 -0700

On Mon, 27 Sep 2010 21:58:16 +0200
Hein-Pieter van Braam <hp@tmm.cx> wrote:

> I will perform a code audit of the audacious package and send a diff 
> for the debian/copyright as soon as I'm finished. Should be somewhere
> this week.
> 
> 
> 

I will also go through the code tonight, and will try fix up
debian/copyright.

-Chris

Message #46 received at 594519@bugs.debian.org (full text, mbox, reply):

From: Benjamin Drung <bdrung@ubuntu.com>

To: 594519@bugs.debian.org, Hein-PietervanBraam <hp@tmm.cx>

Subject: Re: Bug#594519: Code audit

Date: Tue, 28 Sep 2010 00:05:29 +0200

[Message part 1 (text/plain, inline)]

Am Montag, den 27.09.2010, 14:50 -0700 schrieb Chris Taylor:
> On Mon, 27 Sep 2010 21:58:16 +0200
> Hein-Pieter van Braam <hp@tmm.cx> wrote:
> 
> > I will perform a code audit of the audacious package and send a diff 
> > for the debian/copyright as soon as I'm finished. Should be somewhere
> > this week.
> 
> I will also go through the code tonight, and will try fix up
> debian/copyright.

Thanks for your work. Can we migrate the copyright format to DEP-5 [1]?

[1] http://dep.debian.net/deps/dep5/

-- 
Benjamin Drung
Ubuntu Developer (www.ubuntu.com) | Debian Maintainer (www.debian.org)

[signature.asc (application/pgp-signature, inline)]

Message #51 received at 594519@bugs.debian.org (full text, mbox, reply):

From: Moritz Muehlenhoff <jmm@inutil.org>

To: Chris Taylor <ctaylor@debian.org>

Cc: 594519@bugs.debian.org

Subject: Re: Bug#594519: Code audit

Date: Wed, 24 Nov 2010 22:25:51 +0100

On Mon, Sep 27, 2010 at 02:50:55PM -0700, Chris Taylor wrote:
> On Mon, 27 Sep 2010 21:58:16 +0200
> Hein-Pieter van Braam <hp@tmm.cx> wrote:
> 
> > I will perform a code audit of the audacious package and send a diff 
> > for the debian/copyright as soon as I'm finished. Should be somewhere
> > this week.
> > 
> > 
> > 
> 
> I will also go through the code tonight, and will try fix up
> debian/copyright.

It's been two months?

Cheers,
        Moritz

Message #56 received at 594519@bugs.debian.org (full text, mbox, reply):

From: Luca Falavigna <dktrkranz@debian.org>

To: 594519@bugs.debian.org

Subject: Re: Bug#594519: Code audit

Date: Thu, 02 Dec 2010 15:36:37 +0100

[Message part 1 (text/plain, inline)]

tags 594519 + patch
thanks


I've performed a full source scan, and generated a (pseudo) DEP5
copyright file I attach for your convenience.

HTH,

-- 

  .''`.
 : :' :   Luca Falavigna <dktrkranz@debian.org>
 `. `'
   `-

[copyright (text/plain, attachment)]

[signature.asc (application/pgp-signature, attachment)]

Message #63 received at 594519-close@bugs.debian.org (full text, mbox, reply):

From: Benjamin Drung <bdrung@ubuntu.com>

To: 594519-close@bugs.debian.org

Subject: Bug#594519: fixed in audacious-plugins 2.3+dfsg-1

Date: Thu, 16 Dec 2010 15:47:12 +0000

Source: audacious-plugins
Source-Version: 2.3+dfsg-1

We believe that the bug you reported is fixed in the latest version of
audacious-plugins, which is due to be installed in the Debian FTP archive:

audacious-plugins-dbg_2.3+dfsg-1_i386.deb
  to main/a/audacious-plugins/audacious-plugins-dbg_2.3+dfsg-1_i386.deb
audacious-plugins_2.3+dfsg-1.debian.tar.gz
  to main/a/audacious-plugins/audacious-plugins_2.3+dfsg-1.debian.tar.gz
audacious-plugins_2.3+dfsg-1.dsc
  to main/a/audacious-plugins/audacious-plugins_2.3+dfsg-1.dsc
audacious-plugins_2.3+dfsg-1_i386.deb
  to main/a/audacious-plugins/audacious-plugins_2.3+dfsg-1_i386.deb
audacious-plugins_2.3+dfsg.orig.tar.gz
  to main/a/audacious-plugins/audacious-plugins_2.3+dfsg.orig.tar.gz



A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 594519@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Benjamin Drung <bdrung@ubuntu.com> (supplier of updated audacious-plugins package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.8
Date: Sun, 12 Dec 2010 18:36:24 +0100
Source: audacious-plugins
Binary: audacious-plugins audacious-plugins-dbg
Architecture: source i386
Version: 2.3+dfsg-1
Distribution: unstable
Urgency: low
Maintainer: Debian Multimedia Maintainers <pkg-multimedia-maintainers@lists.alioth.debian.org>
Changed-By: Benjamin Drung <bdrung@ubuntu.com>
Description: 
 audacious-plugins - Base plugins for audacious
 audacious-plugins-dbg - Audacious-Plugins debug symbols
Closes: 594519
Changes: 
 audacious-plugins (2.3+dfsg-1) unstable; urgency=low
 .
   * Put Audacious under the umbrella of the Multimedia Maintainers team.
   * Update debian/copyright. - thanks to Luca Falavigna <dktrkranz@debian.org>
   * Remove psf plugin from source because its license does not comply to the
     DFSG and add a NEWS entry (Closes: #594519).
   * Bump Standards-Version to 3.9.1 (no changes required).
Checksums-Sha1: 
 611459885132d7361bc008ec4b0c1aa9f85efc2e 2664 audacious-plugins_2.3+dfsg-1.dsc
 c156421382a890ff496669a2b8b35c79925d9180 2900578 audacious-plugins_2.3+dfsg.orig.tar.gz
 6233d4423e5a33ab3d35869b3d79edfe0e741945 10914 audacious-plugins_2.3+dfsg-1.debian.tar.gz
 451e587f02699d8f2354c743e7edc1e2c4077b50 2265376 audacious-plugins_2.3+dfsg-1_i386.deb
 24cf035d9edcaba841c1f08214e83ca0089e561d 5021614 audacious-plugins-dbg_2.3+dfsg-1_i386.deb
Checksums-Sha256: 
 fa83b0bf1b50161b0800b9bedd92a00cfcc94769d10487f04e1885215dffea3c 2664 audacious-plugins_2.3+dfsg-1.dsc
 b1b837992a0c25b28e413b44f758524fd5745cd491937b43d1c4adf160123365 2900578 audacious-plugins_2.3+dfsg.orig.tar.gz
 1263253070e93077c62bf4db102363a9280b44f293c555ed189d91d913d2067c 10914 audacious-plugins_2.3+dfsg-1.debian.tar.gz
 5d8306423bb65e3af7541d31d76fba890d364b6957f7cfd0560d38cbe60c7173 2265376 audacious-plugins_2.3+dfsg-1_i386.deb
 db83d3a18c862763f7114e5dd1100881dab00c2c95f63221b71efecba27a99bf 5021614 audacious-plugins-dbg_2.3+dfsg-1_i386.deb
Files: 
 9c017c8fd333cd347899d69f441bd9ad 2664 sound optional audacious-plugins_2.3+dfsg-1.dsc
 5c9e104fde91a6a09800c0167d53b63f 2900578 sound optional audacious-plugins_2.3+dfsg.orig.tar.gz
 390d6f96b2bc5b74ce97fb7a8b1d0427 10914 sound optional audacious-plugins_2.3+dfsg-1.debian.tar.gz
 b1ae1b6df0403de28f8d4843b3df86f3 2265376 sound optional audacious-plugins_2.3+dfsg-1_i386.deb
 d4f14644bd873671ab0790e4f20f5c67 5021614 debug extra audacious-plugins-dbg_2.3+dfsg-1_i386.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
Comment: Debian Powered!

iJwEAQECAAYFAk0KMAcACgkQ78RAoABp8o/A0QQAnUiWtuu1Qb3B24ZRAJ8rwUxx
XfpXt1DXQfwZdoWkLmBJqMEASxGdsgwe3SsMznBlsDg6MokzN3PjXJQDqZe8srxT
rFnjyTU0qPGLNzgaI3yoxlKmZaKdwcCqvVoNxMW4DdgPdJd/z60FQZMSIlNCHv8+
pNhJudah1zga2/S+6ww=
=/0Qm
-----END PGP SIGNATURE-----

Send a report that this bug log contains spam.