Bug#851111: gargoyle-free: violates font license

[beuc at debian.org]

Hi,


Globally we agree but I can't help but correct a few things.


On Sun, Feb 12, 2017 at 07:38:47PM +0800, Paul Wise wrote:
> On Fri, 20 Jan 2017 20:20:46 +0100 Sylvain wrote:
> Yes, that is likely the case, except I thought I forwarded the initial
> bug report to the maintainer addresses. Perhaps I forgot to do that for
> gargoyle-free. I am very sorry about that, my MUA is annoying at times.

I received another removal notice for freedink, so not just
gargoyle-free :/

OK, it's weird though that the BTS doesn't notify maintainers when a
bug is reassigned to their package.

> > A mass bug filling, when the freeze is in effect.
> 
> This wasn't a mass bug filing.

What do you call this?

> > This will take additional time for both the maintainer and the Debian
> > Release team.
> 
> As per normal.

It seems to me that outside of the freeze, the Debian Release team is
not involved.  Anyway I need to say the freeze was only in "soft"
phase hence not a problem actually.

> > No patch.
> 
> The needed changes are trivial.

That depends, for another package the presence of the file was
necessary for the build system (as it's normally installed in pkgdir,
then removed in debian/rules).

> > Wait, Debian is distributing the source code of Liberation, on the
> > same servers as the source and binaries packages.
> 
> Yes, in a different source package and directory.

Hence, compliant?

> It is likely to be a different version and if it isn't already then in
> the future when Liberation is updated, it will be a different version.
> 
> In addition, when people mirror by source package, they will be missing
> the source code for the font unless they manually mirror deps too.

Sounds like a corner case a bit outside of the Debian goal but ok.

> > Doesn't this comply with the GPL already?
> 
> Given the version issue above, I doubt it.

Yes.

> > What threats are we trying to address?
> 
> Losing our ability to distribute Liberation fonts at all.
> 
> The same for Debian derivatives and other redistributors.
> 
> Users not being able to exercise their GPL/DFSG-promised rights
> and our reputation suffering as a result.

That sounds dramatic. RedHat suing Debian over this?

Interestingly enough, last time I used Liberation font, the .sfd could
be created from the .ttf and vice-versa - consequently isn't the .ttf
already a source form?

> > Unless they ship the source on the same server as their tarball.
> > (like a binary package with [L]GPL'd deps)
> 
> I was referring to the source package here.

So did I. I read "upstream is violating the license". I say "not if
they distribute the source on the same server".

> > This sounds like an automated mail with little effort on the sending
> > side while expecting decent effert on the receiving side.
> 
> This is incorrect, I spent a lot of effort tracking down which packages
>  were probably violating the GPL and confirming that for each one.

OK, that didn't convey in the bug report.

> OTOH, it should be a very minor amount of work for package maintainers,
> just repacking the tarball and adding the dependencies.

I mentioned build system issues, plus testing, plus possibly scripting
if upstream doesn't change and this has to be done at each upload.
(depending on distro-provided version though, that was covered long ago)

> > I never heard of the Debian Fonts Task Force
> 
> The team maintains a lot of different fonts (232 src pkgs) in Debian.
> 
> > for all these reasons this was quite a bad first impression :(
> 
> I have to say I wasn't expecting a maintainer response either, almost
> all the other bug reports I filed about this issue in other packages
> were promptly fixed with no extra communication with maintainers.

Wait - sending a lot of release-critical bugs marking packages for
deletion just before a freeze and... not expecting to be involved? :/

Cheers!
Sylvain