[Debian-med-packaging] Debian NEW review of ctk 2026.08.06-1: REJECTED

[dfsg-team at debian.org]

The Debian NEW review of ctk 2026.08.06-1 has been completed.

Decision: REJECTED
Reviewer: Mechtilde Stehmann

Review comment:

Hello

you nmentioned that

Libs/Core/ctkBinaryFileDescriptor.cpp and
Libs/Core/ctkBinaryFileDescriptor.h

are under Apache-2.0 *or* 3D-Slicer-1.0 license.

The license isn't dfsg-compliant. 
Reason:

3D Slicer license — export-control and anti-copyleft contribution clauses
    The 3D Slicer Software License Agreement, used by the 3D Slicer
    medical-imaging platform from Brigham and Women's Hospital, is
    DFSG-incompatible on two independent grounds:

    1. Export controls and compliance with laws (Part B, Sections 4 & 7).
    Part B §4 conditions the copyright grant on the licensee's compliance
    with "all applicable governmental laws, regulations and orders,
    including without limitation those relating to export and import
    control." Part B §7 makes any non-compliant use automatically revoke
    "all rights granted to you." Tying the copyright licence to statutory
    compliance turns a local legal violation (e.g. exporting to a sanctioned
    country) into a copyright infringement and makes redistribution
    contingent on the recipient's jurisdiction. Debian has historically
    rejected such clauses as violating DFSG #1 (Free Redistribution) and
    DFSG #6 (No Discrimination Against Persons or Fields of Endeavor).

    2. Anti-copyleft contribution warranty (Part A, Section 6). Part A §6
    requires every contributor to warrant that their contribution "DOES NOT
    CONTAIN ANY CODE THAT REQURES [sic] OR PRESCRIBES AN 'OPEN SOURCE
    LICENSE' FOR DERIVATIVE WORKS (by way of non-limiting example, the GNU
    General Public License...)". Although Part A reads as a Contributor
    License Agreement, the licence bundles it into the distribution terms;
    if a downstream modifier is legally construed as making a
    "Contribution", the clause amounts to an outright ban on combining the
    work with GPL-licensed (or other copyleft) code. That violates DFSG #3
    (Derived Works) and DFSG #9 (License Must Not Contaminate Other
    Software).
references:
    - url: https://slicer.org/LICENSE
      title: Canonical 3D Slicer License v1.0 text (slicer.org)
    - url: https://github.com/Slicer/Slicer/blob/main/License.txt
      title: 3D Slicer License v1.0 text (upstream repository)
    - url: https://lists.debian.org/debian-legal/2015/11/msg00026.html
      title: debian-legal discussion of the CISST licence (a derivative of this licence)

In the files itself you can read this isn't dual licesed. It contains somme parts under Apache 2 and somme other parts under 3-C-slicer license.

Please discuss it with upstream how they can fix the license problem.

For the file 
Files: Libs/CommandLineModules/Documentation/xs3p.xsl
you mentioned it under a DSTC license. The text you show in d/copyright is n't the license text itself.it only descries how you can find the right license.
Please improve this statement.

For the license Paraview-1.2 you show only a link to an external license statement. The file debian/copyright must contain the real complete license text except the licenses shipped with /usr/share/common-licenses.

Please improve this part, too.

Thanks

Full review details: https://dfsg-new-queue.debian.org/reviews/ctk