[From nobody Thu Mar 26 05:51:04 2026
Received: (at submit) by bugs.debian.org; 10 Feb 2026 15:09:12 +0000
X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02
 (2024-03-25) on buxtehude.debian.org
X-Spam-Level: 
X-Spam-Status: No, score=-109.2 required=4.0 tests=BAYES_00,DKIMWL_WL_HIGH,
 DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FROMDEVELOPER,
 SPF_HELO_NONE,SPF_NONE,UNPARSEABLE_RELAY,USER_IN_DKIM_WELCOMELIST,
 XMAILER_REPORTBUG autolearn=ham autolearn_force=no
 version=4.0.1-bugs.debian.org_2005_01_02
X-Spam-Bayes: score:0.0000 Tokens: new, 13; hammy, 109; neutral, 19; spammy,
 2. spammytokens:0.876-+--H*MI:localdomain, 0.870-+--H*M:localdomain
 hammytokens:0.000-+--Hx-spam-relays-external:sk:stravin,
 0.000-+--H*RT:sk:stravin, 0.000-+--Hx-spam-relays-external:311,
 0.000-+--H*RT:311, 0.000-+--H*RT:108
Return-path: <bage@debian.org>
Received: from stravinsky.debian.org ([2001:41b8:202:deb::311:108]:34730)
 by buxtehude.debian.org with esmtps
 (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256)
 (Exim 4.96) (envelope-from <bage@debian.org>) id 1vppMW-003pY2-0k
 for submit@bugs.debian.org; Tue, 10 Feb 2026 15:09:12 +0000
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=debian.org; 
 s=smtpauto.stravinsky;
 h=X-Debian-User:Date:Message-ID:Subject:To:From:
 Content-Transfer-Encoding:MIME-Version:Content-Type:Reply-To:Cc:Content-ID:
 Content-Description:In-Reply-To:References;
 bh=KoXiNgN88rRrauOeVF5iSq4kTNN10CGYSOPHfciiJsA=; b=c5Hr8QCD6pinW0qId7unz3P2dx
 ySMezhDNbIkHhF2GawQg+rdgNqZXffielCU3RXxVNvbj5im4iXZgKfldi4Jd/I1sJTYbS2Tt6/iED
 08chdNkvV+iZE0TaUJvw5x+6rXWXkBSJLhWsgItlgdf29FvNoFdwq5SNOqYVVxKtSFtCVTX8SSy0i
 +plrz9THaKKFGGB0L0D4YReX4m52S9z7sRmtOZ5A+NuaDB1v0zh3gwo2NLvb1VUDwrlP8+A6ZBN62
 ncCz5zE6VivSP9QZuamPN9vPNjF54Fd/fnwMH8hXyouYqTMfKesLhdc9lFlCqY2uZfxmmYLBhhIKq
 cdwIVQ/A==;
Received: from authenticated user by stravinsky.debian.org with esmtpsa
 (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256)
 (Exim 4.94.2) (envelope-from <bage@debian.org>)
 id 1vppMU-00ALXd-Ar; Tue, 10 Feb 2026 15:09:10 +0000
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
From: Bastian Germann <bage@debian.org>
To: Debian Bug Tracking System <submit@bugs.debian.org>
Subject: nss-pem: license misrepresentations in copyright file
Message-ID: <177073614986.289876.4706405311648976415.reportbug@duagon-BXN3S64.localdomain>
X-Mailer: reportbug 13.2.0
Date: Tue, 10 Feb 2026 16:09:09 +0100
X-Debian-User: bage
Delivered-To: submit@bugs.debian.org

Source: nss-pem
Version: 1.1.0+1-1.1
Severity: serious

Your package's copyright file misrepresents the contained licenses:

BSD-3-clause references the wrong license file (GPL-2).

The zlib files are claimed to be licensed under BSD-3-clause but it is
actually the Zlib license.

The License: GPL-2 stanza has the "or-later" clause but this is not
found in the upstream files that reference this license.
]