Bug#554456: Source package contains non-free IETF RFC/I-D

[Simon Josefsson]

Severity: serious
Package: bouncycastle
Version: 1.44-1
User: debian-release at lists.debian.org
Usertags: nonfree-doc rfc

Hi!

This source package contains the following files from the
IETF under non-free license terms:

+  bouncycastle-1.44/test/data/rfc4134/rfc4134.txt

The license on RFC/I-Ds is not DFSG-free, see:
 * http://bugs.debian.org/199810
 * http://release.debian.org/removing-non-free-documentation
 * http://wiki.debian.org/NonFreeIETFDocuments

The lenny/squeeze release policy says binary and source packages must each be free:
 * http://release.debian.org/lenny/rc_policy.txt
 * http://release.debian.org/squeeze/rc_policy.txt

The severity is serious, because this violates the Debian policy:
 * http://www.debian.org/doc/debian-policy/ch-archive.html#s-dfsg

There are (at least) three ways to fix this problem.  In order of
preference:

1. Ask the author of the RFC to re-license the RFC under a free
   license.  A template for this e-mail request can be found at
   http://wiki.debian.org/NonFreeIETFDocuments

2. Remove the non-free material from the source, e.g., by re-packaging
   the upstream archive and adding 'dfsg' to the Debian package
   version name.

3. Move the package to non-free.

General discussions are kindly requested to take place on debian-legal
or debian-devel in the thread with Subject: "Non-free IETF RFC/I-Ds in
source packages".

Thanks,
Simon