[Pkg-javascript-devel] MIT +no-false-attribs

[Jérémy Lal]

On 24/01/2012 15:24, MJ Ray wrote:
> Jérémy Lal <jerry at edagames.com>
>> following npm license is Expat + one restriction,
>> is it still DFSG ?
> 
> If it just this one addition:
>> Distributions of all or part of the Software intended to be used
>> by the recipients as they would use the unmodified Software,
>> containing modifications that substantially alter, remove, or
>> disable functionality of the Software, outside of the documented
>> configuration mechanisms provided by the Software, shall be
>> modified such that the Author's bug reporting email addresses and
>> urls are either replaced with the contact information of the
>> parties responsible for the changes, or removed entirely.
> 
> Then I feel that would be acceptable under DFSG 4 but it's not exact
> and I have not looked for similar examples in the archive.
> 
> The wording could be better and suggests a need to consult a lawyer.
> Actually, as a quick fix, could you just remove the undefined word
> "Author's" from it?
> 
> Hope that helps,

After some exchanges, it appears the author welcomes clarifications to
its addition to the license.

In the latest version, "Author" has been replaced by "Original Author",
and that term defined in the copyright line :
https://raw.github.com/isaacs/npm/master/LICENSE

To be honest, i have been bad at arguing with him; here's his last reply :

On 06/03/2012 19:20, Isaac Schlueter wrote:
> On 06/03/2012 18:06, Jonas Smedegaard wrote:
>> I would recommend upstream to not try hack legalese but instead
>> simply document clearly a friendly _request_ to do do same as now
>> codified in license.
> However, it is clearly in Debian's interest, and not in mine, so it
> is not reasonable for me to comply with it. The goal is to prevent
> distros from clobbering my software and letting me handle the
> fallout. Friendly requests in the past have gone unheeded by several
> different groups, some of which asserted that they have the right to
> direct bug reports to me, claiming that it's *my* responsibility to
> make my software work with their distribution (after they've modified
> it without my knowledge!) The only thing that distros pay any
> attention to is LICENSE files, so that what I use here. (Evidenced
> clearly by the degree of attention that has been paid to it in this
> case - would anyone care if it was a plain old MIT?) If a particular
> person or distribution would like a special dispensation to disable
> or alter features in npm, and to then distribute their modified copy
> without changing the name, then they may ask for that directly, and
> we can perhaps work something out, whereby they take ownership of
> their changes, clearly communicate them to users, and perhaps even
> rebrand the software as a downstream fork. If a distro wishes to
> alter or disable features of npm, and does *not* wish to take
> ownership of their changes, then it would be better for me if they
> did not include npm in their distribution. Linux users can already
> install npm quite easily from source. Debian users can get it from
> Chris Lea's PPA, which does not alter the source code, and thus has
> no problem complying with the license. Mac and PC users can get it
> automatically along with the node binary installers. Anyone who
> installs node from source gets it by default. In other words, if the
> terms of this license keep npm out of Debian Stable, or any
> particular distro, then that means it's working. The fact that npm is
> not in the distro is worse for the distro than it is for npm.

This is not encouraging, despite that :

* it is really easy to comply with this license.
* the bug-reporting contacts can be changed easily
* they don't need to be changed anyway, the npm debian package won't need
  any patch (i mean the one being prepared, version 1.1.x, not the one in sid,
  which is outdated)
* the author knows perfectly well i'm willing to distribute npm unpatched,
  since we've talked this through a while ago.

What can i do from now on ?

Jérémy.