[Pkg-rust-maintainers] Bug#995339: lalrpop: Incomplete license information

[Bastian Germann]

Control: reopen -1
Control: reassign -1 ftp.debian.org

On Sat, 23 Oct 2021 19:11:04 +0100 Ximin Luo <infinity0 at debian.org> wrote:
> Source: rust-lalrpop
> Followup-For: Bug #995339
> 
> The d/copyright file is about the source package not the binary package, you are misinterpreting policy.

In Policy 12.5, I read "Every package must be accompanied by a verbatim copy of its 
distribution license(s) in the file /usr/share/doc/PACKAGE/copyright." There is no 
indication that the d/copyright file is about the source package only. In fact quite the 
opposite, as in 2.3 (Copyright consideration) there is a distinction between source and 
binary distribution.

In my interpretation, the copyright file for one specific package has to fulfill the legal 
obligations of its contents' distribution license(s), including binary packages with their 
specific obligations. How would a user who does not know about the X-Cargo-Built-Using 
shtick know that they are to obtain the copyright files of dozens of other packages (NOT 
dependencies) to get the complete distribution license information? I think, Debian 
manuals just point to the copyright file for license information.

https://wiki.debian.org/StaticLinking mentions: "Packages can declare they were built 
using code from other packages by using the Built-Using header and the Debian archive 
keeps around old sources, marking them with the Extra-Source-Only header. Debian Policy 
unfortunately says that Built-Using may *only* be used for the purposes of DFSG/license 
compliance so tracking static linking must be done using custom headers."

> In fact there is nowhere in the d/copyright file format to put this information; and it would not be efficient to do so since the information already exists in the d/copyright of those other packages.

Maybe there is nowhere in the DEP-5 format, which is not mandatory by now. This 
inefficiency is why I suggested to contact FTP Master about it. I do not think, there is a 
good mechanism for it in Debian right now. Maybe, there should be a similar field to 
Built-Using that is not about source retaining but about applicable licenses from other 
packages.

> Closing the bug report for this reason.

Reopening and reassigning to FTP Master to check if they are content with the current 
"custom headers" over a complete d/copyright approach. If "custom headers" is enough, I 
request to have a complete list of their names at a prominent place to enable users to get 
the complete license info for a package.