Bug#893561: libtablelayout-java: license does not seem to meet the DFSG

Sat Mar 24 14:22:12 UTC 2018

Am 24.03.2018 um 00:17 schrieb Francesco Poli:
> On Thu, 22 Mar 2018 18:30:53 +0100 Markus Koschany wrote:
> 
>> Am 19.03.2018 um 22:28 schrieb Francesco Poli (wintermute):
> [...]
>>> I noticed that the license was
>>> [discussed](https://lists.debian.org/debian-legal/2009/06/msg00050.html)
>>> on debian-legal a long time ago.
>>> My
>>> [opinion](https://lists.debian.org/debian-legal/2009/06/msg00053.html)
>>> was that at least two clauses fail to meet the DFSG.
>>
>> In the end the ftp-team accepted the package into Debian and that is the
>> only thing that counts.
> 
> Was the debian-legal discussion pointed out to the FTP Masters?
> Did they explain the rationale behind their decision? 

FYI, debian-legal is a mailing list and not a Debian body that can exert
any power over the FTP masters. They may or may not have been aware of
the discussion but by accepting libtablelayout-java into Debian they
clearly made a decision in favor of the license.

>>> The debian/copyright file states, in part:
>>>
>>> | The source code has been modified to make the package suitable for main (see
>>> | license III. 4.). The package namespace has been changed from
>>> | info.clearthought.layout to org.debian.tablelayout.
>>>
>>> Personally, I don't think that applying a patch that changes the namespace
>>> is enough to make the package suitable for Debian main.
>>
>> This is certainly enough. We change the namespace all the time in Debian
>> Java packages by using maven.rules for example. Also using patch files
>> is explicitly allowed by DFSG 4.
> 
> The issue is not the requirement to modify the package through patch
> files. Patch-only clauses are explicitly allowed by DFSG#4, as you
> correctly point out.
> As I have previously said, the issue is that the license forbids to
> create a derived work that uses the info.clearthought namespace/package.
> 
> This goes beyond what is allowed by DFSG#4, which only talks about
> patch files and requirements to change the *name* or the *version
> number*.

No, this is precisely why DFSG 4 mentions patch files explicitly and why
DFSG 4 is named "Integrity of The Author's Source Code". We respect the
authors source code and his wish to preserve the info.clearthough
namespace. Nevertheless we are allowed to change it for derived works
and can rename it to any name we want. This is sufficiently DFSG-free.
The name is "info.clearthought" which is the official upstream URL. It
is common practice in Java to use a namespace that corresponds to some
URL. It is completely fair to reserve info.clearthought because Debian
also reserves the rights for debian.org or the name Debian in general.

> 
>>
>>> I mean: it's true that it is now possible to create drop-in replacements
>>> for the Debian package (without further changing the namespace), but it is
>>> still forbidden to create a modified version that changes the namespace
>>> back to "info.clearthought".
>>>
>>> I think that this restriction goes beyond what is allowed by DFSG#4.
>>
>> This is your personal opinion. It was already discussed on debian-legal
>> back in 2009 that the license is still acceptable and in the spirit of
>> the DFSG.
> 
> Wait, it was indeed discussed on debian-legal back in 2009.
> 
> The thread is the very
> [one](https://lists.debian.org/debian-legal/2009/06/msg00050.html)
> I cited in my bug report.
> 
> There were two replies, one by Joe Smith and one by me.
> Joe said that the license is acceptable and within the spirit of the
> DFSG.
> On the other hand, I said that two clauses fail to meet the DFSG.
> 
> Now, I respect Joe's opinion, but it's not clear to me why you claim
> that *his* reply represents the outcome of the debian-legal discussion,
> while *my* reply is just my personal opinion...

I have never said that and it is also not relevant.

>>> Additionally, the license is clearly GPL-incompatible, which may
>>> be an issue for other packages that link with this library.
>>>
>>> Is it possible to persuade the upstream copyright holder to
>>> drop clauses III.3 and III.4?
>>> Or, even better, to re-license the library under well-vetted and
>>> clearly DFSG-free terms, such as the
>>> [Expat/MIT license](http://www.jclark.com/xml/copying.txt)
>>> or the
>>> [zlib license](http://www.zlib.net/zlib_license.html)
>>> ?
>>
>> No. We do not need to persuade the upstream copyright holder to change
>> the license as long as the package was accepted by the ftp-team. If you
>> think a package is GPL-incompatible
> 
> The license of libtablelayout-java is *clearly* GPL-incompatible, no
> doubt about it.
> 
> It is a patch-only license and has restrictions on namespace change for
> derived works.
> These restrictions (and possibly other ones) are not included in the
> GNU GPL v2 or v3, nor allowed by them.

Again, this is _your_ opinion. If it was that easy we wouldn't need any
lawyers in the world.

>> and you are not sure whether you can
>> use it together with this library you should seek legal advice in your
>> country. This is out-of-scope for Debian and as far as I am and the rest
>> of the team are concerned, this is not an issue for us. Closing as
>> not-a-bug.
> 
> It seems to be an issue for Debian: there are packages in Debian which
> are GPL-licensed and link (directly or indirectly) with
> libtablelayout-java.
> 
> Linking a GPL-licensed program or library with a GPL-incompatible
> library requires special permission from the copyright holders of the
> GPL-licensed program or library, as explain in the dedicated GPL
> [FAQ](https://www.gnu.org/licenses/gpl-faq.html#InterpreterIncompat).
> 
> Some examples of GPL-licensed packages which link with
> libtablelayout-java:
> 
>  • [jfractionlab](https://packages.debian.org/jfractionlab)
>    [is GPL-v3-licensed](https://tracker.debian.org/media/packages/j/jfractionlab/copyright-0.91-3)
>    without any special exception and is linked with libtablelayout-java
> 
>  • [sweethome3d](https://packages.debian.org/sweethome3d)
>    [is GPL-v2-licensed](https://tracker.debian.org/media/packages/s/sweethome3d/copyright-5.7dfsg-2)
>    without any special exception and is linked with libtablelayout-java
>    (indirectly through libfreehep-graphicsio-svg-java,
>    libfreehep-graphicsio-tests-java, and libjas-plotter-java)

> 
> In order to solve these issues, the easiest solution is persuading the
> upstream copyright holder of libtablelayout-java to re-license it under
> GPL-v2-and-v3-compatible terms.
> 
> Please reopen the bug report.

No. I will not reopen this bug report because we do not have to persuade
upstream to change a DFSG-free license. Feel free to contact all
upstreams yourself though and discuss any licensing issues with them.

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 963 bytes
Desc: OpenPGP digital signature
URL: <http://lists.alioth.debian.org/pipermail/pkg-java-maintainers/attachments/20180324/f230f6ba/attachment.sig>