[Openstack-devel] Websockify has been rejected from upload in Debian

Thomas Goirand thomas at goirand.fr
Thu Apr 11 17:35:42 UTC 2013

On 04/11/2013 09:20 PM, Joel Martin wrote:
> Please don't confuse "provide" with "include". Even the GPL doesn't
> require that sources be physically included with the generated objects,
> it only requires that the sources that correspond to those objects are
> provided via a mechanism that is equally convenient.

Ok, I can re-phrase if you prefer. Could you "include" the source code,
please? :)

> Please cite the specific Debian policy that prohibits the inclusion
> object files that have been generated from other free software.

Debian imposes that everything that it releases includes source. It's
not even in our policy, it is in the DFSG, which is regarded as even
more important than the Debian policy manual:

http://www.debian.org/social_contract (point 2 of the DFSG):

"The program must include source code"

This is a *must*, and not an option in Debian.

It wouldn't be a problem if we had a libjs-web-socket package in Debian,
but we don't ... :/

> I would
> be surprised if there is such a clause since it would imply that a
> Debian ISO build would not be free software in the same sense because
> the source is not physically included (only provided externally).

We also build source ISO images. Though these days, almost everyone
download from internet, so it is a less known feature, so it is
understandable that you didn't know.

> Your very request is for me to change the way I maintain noVNC

No, my request is that you add the missing source code in your
repository, so that your project can be said 100% free and open source.
I wouldn't like to impose anything on anyone.

> so as to
> make it more convenient for you and Debian (so you don't have to
> maintain a separate source tree) while making life less convenient for
> me and other users/integrators of noVNC.

That's quite the opposite way in fact. I'm asking you to make the life
of integrators easier, by providing the source code of all the objects
needed by your project, in a single repository, rather than having to
gather things from here and there. I think that is a very reasonable

> I value free software more than
> I value convenience, but convenience is a lesser, but nonetheless still
> a real value. I would like to make it as convenient as possible for you
> and I and other users and integrators of noVNC. However, I'm not willing
> to remove the swf because I don't believe that this actually violates
> any tenet of free software (or even the GPL) because the source that
> corresponds to the swf is available as I've stated
> (https://github.com/gimite/web-socket-js).

Yeah. And from there, it points to http://code.google.com/p/swfobject/.
In there, you may find the unobfuscated version of swfobject.js in the
src folder. Do you think it is too much to ask you to at least use that
version instead of the compressed one that is in your source tree?

> If having a generated object in the tree violates Debian policy (which
> specific clause is that?), then one of the less convenient options will
> need to be applied: either you continue to maintain a separate tree, or
> put noVNC in universe.

If by "universe" you mean "non-free" (which is the debian term for it,
if I understand well what "universe is (sorry, I'm not very familiar
with Ubuntu)), well, then the problem is that nova build-depends on
websockify, which means that I would have to put Nova in the "contrib"
repository at least, and even maybe in non-free. I don't want to do
that, so this isn't an option.

> Also, if including/attaching web-socket-js sources as a git submodule
> makes it more convenient for you, that offer still stands so let me know.

That would be an option to include it in your git repo yes, I'm not sure
if web-socket-js would be able to be built from source with the tools
that we have in Debian.

I believe that some people worked on having the Adobe thing (flex?) in
Debian, but I'm not sure how far this effort went.

My understanding is that this .swf file is there only to add support for
web sockets in older browser. With time, this is becoming a feature less
and less important, as newer browser have the feature.

Can't you, instead, just ship swobject.js unobfuscated (that's easy to
do, right?), and provide a link to the .swf blob somewhere? Is this
completely unacceptable for you? If so, then we must agree to not agree,
and indeed, I will continue to ship websockify as <version>+dfsg,
showing that I had to modify upstream code to make it follow the Debian
Free Software Guidelines.

Thanks for taking the time to answer me,

Thomas Goirand (zigo)

P.S: Are you going to the OpenStack Summit? It would be nice to meet you

More information about the Openstack-devel mailing list