Bug#619662: salome: multiple licensing issues

[Francesco Poli (wintermute)]

Package: salome
Version: 5.1.3-12
Severity: serious
Justification: Policy 2.2.1


Hello again Debian Science Maintainers,
thanks for maintaining salome in Debian.

This package is released under the terms of the GNU LGPL v2.1,
but includes files released under the GNU GPL v2 or later,
and links with libcos4-1/libomniorb4-1, which include [1] files
released under the terms of the GNU GPL v2 or later, and with
libqscintilla2-5, which is released [2] under the GNU GPL v2 or
v3 (+ a limited linking exception).

[1] http://packages.debian.org/changelogs/pool/main/o/omniorb-dfsg/current/copyright
[2] http://packages.debian.org/changelogs/pool/main/q/qscintilla2/qscintilla2_2.4.3-1/libqscintilla2-5.copyright

This means that package salome is effectively under the GNU GPL
(v2 or v3).

On the other hand, salome seems to incorporate a GPL-incompatible file
and to link with GPL-incompatible libraries (see below): I would
therefore say that the binary package salome is currently
undistributable, as it is effectively under the GPL (v2 or v3),
but incorporates a GPL-incompatible file and links with
GPL-incompatible libraries.


First issue:
file GEOM_SRC_5.1.3/src/NMTTools/NMTTools_PaveFiller.hxx is released
under the under the terms of the (GPL-incompatible) OCTPL v6.3;
moreover salome links with libopencascade-*-6.3.0, which is also
released under the terms of the OCTPL v6.3; this problem is partially
similar to bug #617613 [3].

[3] http://bugs.debian.org/617613

Possible solutions, in descending order of desirability:

 (1A) Open CASCADE S.A.S. should be contacted and persuaded to
re-license Open CASCADE Technology under GPLv2-and-v3-compatible terms.

 (1B) Open CASCADE Technology should be substituted with a
GPLv2-and-v3-compatible replacement, if any is available.

 (1C) GPL-licensed file copyright holders, omniORB copyright holders, and
QScintilla copyright holders should be asked to add license exceptions
that give permission to link their work with code released under the OCTPL.

As explained in bug #617613 [3], I am trying to push in the direction of
solution (1A), but I need help in persuading Open CASCADE S.A.S. to
switch to the GNU LGPL v2.1: pretty please, join me in this persuasion
effort!

Thanks for any help you can provide.


Second issue:
it seems that salome links with libssl0.9.8, which is released [4] under
the terms of the (GPL-incompatible) OpenSSL license; this is allowed
by QScintilla linking exception, but not by the other GPL-licensed
files, AFAICT.

[4] http://packages.debian.org/changelogs/pool/main/o/openssl/openssl_0.9.8o-5/libssl0.9.8.copyright

Possible solutions, in descending order of desirability:

 (2A) OpenSSL should be substituted with one of the available
GPLv2-and-v3-compatible replacements.

 (2B) GPL-licensed file copyright holders, and omniORB copyright holders
should be asked to add license exceptions that give permission to link
their work with code released under the OpenSSL license.


Third issue:
it seems that salome links with libgvc5, which is released [5] under
the terms of the (GPL-incompatible) CPL v1.0; this is allowed
by QScintilla linking exception, but not by the other GPL-licensed
files, AFAICT.

[5] http://packages.debian.org/changelogs/pool/main/g/graphviz/graphviz_2.26.3-5/libgvc5.copyright

Possible solutions, in descending order of desirability:

 (3A) Graphviz copyright holders should be contacted and persuaded to
re-license (or dual-license) their library under GPLv2-and-v3-compatible
terms.

 (3B) Graphviz should be substituted with a GPLv2-and-v3-compatible
replacement, if any is available.

 (3C) GPL-licensed file copyright holders, and omniORB copyright holders
should be asked to add license exceptions that give permission to link
their work with code released under the CPL.


Fourth issue:
it seems that salome links with libscotch-5.1, which is released [6]
under the terms of the (GPL-incompatible [7]) CeCILL-C license v1.0

[6] http://packages.debian.org/changelogs/pool/main/s/scotch/scotch_5.1.11.dfsg-3/libscotch-5.1.copyright
[7] http://lists.debian.org/debian-legal/2008/01/msg00171.html
 
Possible solutions, in descending order of desirability:

 (1A) SCOTCH copyright holders should be contacted and persuaded to
re-license (or dual-license) it under GPLv2-and-v3-compatible terms.

 (1B) SCOTCH should be substituted with a GPLv2-and-v3-compatible
replacement, if any is available.

 (1C) GPL-licensed file copyright holders, omniORB copyright holders, and
QScintilla copyright holders should be asked to add license exceptions
that give permission to link their work with code released under CeCILL-C
v1.0 .