Bug#694657: closed by Reinhard Tartler <siretart at tauware.de> (Bug#694657: fixed in libav 6:9.1-1)

Wed Jan 9 21:07:30 UTC 2013

On Wed, 09 Jan 2013 21:10:06 +0100 Jonas Smedegaard wrote:

> Hi Francesco,

Hi, thanks a lot for your very fast reply!

>
> Quoting Francesco Poli (2013-01-09 19:18:02)
> > On Wed, 09 Jan 2013 06:51:10 +0000 Debian Bug Tracking System wrote:
> > 
> > [...]
> > >    [ Jonas Smedegaard ]
> > >    * Rewrite copyright file using copyright format 1.0.
> > >      Closes: bug#694657. Thanks to Francesco Poli.
> > 
> > You're welcome, Jonas!
> > Thanks to you, indeed.
> > 
> > 
> > I have a question, though.
> > At the beginning of the new debian/copyright file, I read the following
> > comment:
> > 
> > | Comment:
> > |  Because the libavcodec-extra-* package (since libavcodec-extra-54)
> > |  links against libraries licensed under Apache-2.0 (not compatible with
> > |  LGPL), effective license of that package and libav-dbg is GPL-3+.
> > 
> > This does not look too clear to me.
> > 
> > Which license is the libavcodec-extra-* package released under?
> > LGPL-2.1+ or GPL-2+ ?
> 
> GPL-2+.  I fail to understand how that can be misunderstood from that 
> comment.

Well, I think it _can_ be misunderstood because... it's not what it is
written there!   :-/

By looking at the debian/copyright file, it seems to me that the
_source files_ that are compiled to produce the _binary_ package
libavcodec-extra-* are under LGPL-2.1+
So this (and GPL-2+, thanks to the explicit conversion-to-GPL clause
included in LGPL-2.1) seems to be the set of licenses we start with.

Then, we have to look at the linked works, in order to determine the
effective license for the _binary_ package.
The comment only talks about libraries under Apache-2.0, which is not
compatible with GPL-2.
This seems to drop GPL-2, leaving the choice among GPL-3+ and LGPL-2.1+.
Hence, by reading the comment (and the rest of the debian/copyright
file), it really looks like the effective license is
"GPL-3+ or LGPL-2.1+ (excluding GPL-2)".

Moreover, the comment states that Apache-2.0 is incompatible with LGPL:
I think this is incorrect and misleading.

> 
> 
> > By looking at the rest of the debian/copyright file, it seems to me
> > that the answer is LGPL-2.1+ : can you confirm, please?
> 
> What a debian/copyright file covers is _source_ licensing.  That's why 
> it is merely a comment.

Indeed: I looked at the debian/copyright file in order to figure out
the license for the _source_ files that end up compiled into the
_binary_ files shipped by the _binary_ package libavcodec-extra-*

> 
> The effective license of a binary package is that license among the many 
> many licenses involved in that binary work which is compatible with all 
> the other ones.  This not only involves the source parts of that same 
> project, but also the parts linking in during build.

Fully agreed.

> So even if you 
> cannot find a single GPL-3+ licensed piece anywhere in this project, the 
> very purpose of libavcodec-extra-* (as compared to libavcodec-*) is to 
> link against GPL-licensed parts.

This is the part that's not clear.
Where is this stated?
The comment does clarifies this subtlety.
And I cannot see it documented in the binary package description,
either: http://packages.debian.org/experimental/libavcodec-extra-54

Unless I start digging into the debian/copyright files of all the
dependencies, and find out that

  * libx264-123 is under GPL-2+
  * libxvidcore4 is also under GPL-2+
  * a small part of libmp3lame0 is under GPL-1+

Is this (together with the linking with Apache-2.0 libraries) the
reason why the _binary_ package libavcodec-extra-* is effectively under
GPL-3+, rather than "GPL-3+ or LGPL-2.1+ (excluding GPL-2)" ?

If this is the case, then I think the comment should be clarified (and
also the binary package description).

> 
> ...and even if none of those _other_ GPL-licensed parts are explicitly 
> GPL-3+, ome parts are Apache-2.0 which is incompatible with GPL-2, 
> rendering GPL-2+ licensed parts essentially equal to GPL-3+.
> 
> Whew.  Hope that whole pile made sense. :-)

Maybe (assuming I understood you correctly...).
But the comment is far too short to explain all this!

> 
> 
> 
> > If this is really the case, then, although it's true that Apache-2.0 
> > is not compatible with GPL-2, I don't think it's accurate to say that 
> > Apache-2.0 is not compatible with LGPL...
> 
> Correct.  One need to check the long description and build-dependencies 
> of libavcodec-extra-* to get an epiphany here.

If one has to dig into all the dependencies anyway, then the comment
does not seem to be too useful...

[...]
> > This seems to imply that I cannot distribute a program under a 
> > GPL-3-incompatible license (for instance, BSD-4-clause) linked with 
> > libavcodec-extra-*: I don't see any reason why such a program should 
> > be considered as legally undistributable...
> 
> Not sure what you are trying to say here.
> 
> It is legal to distribute libavcodec-extra-* and it is legal to 
> distribute GPL-3-incompatible code.

Not if one wants to distribute the two together, linked with each
other, though.
At least, this is what is said by the FSF legal theory of linking...

> 
> Purpose of that comment is to make (developer) users aware that despite 
> Licenses listed in this copyright file, that binary package (and the 
> -dbg package) has been "infested" with strong copyleft licenses.
> 
> 
> > Please clarify the situation, and let's see whether we can find a 
> > clearer formulation for the above-quoted comment.
> 
> I don't mind us discussing it here, but do find this a different matter 
> than the issue you filed this bugreport about.

You are right that I should have filed a separate bug report.
Sorry about my laziness...   :-(
I can do that, if you want me to do so. Just tell me!

Anyway, let's see whether you think that the following re-formulation
is accurate:

| Comment:
|  Because the libavcodec-extra-* package links against libraries
|  licensed under GPL-2+ and (since libavcodec-extra-54) against libraries
|  under Apache-2.0 (compatible with GPL-3, but not with GPL-2), effective
|  license of that package and libav-dbg is GPL-3+ (rather than LGPL-2.1+).

A similar clarification may be applied to the description of the
libavcodec-extra-* binary package.

I hope I clarified what I meant.

-- 
 http://www.inventati.org/frx/frx-gpg-key-transition-2010.txt
 New GnuPG key, see the transition document!
..................................................... Francesco Poli .
 GnuPG key fpr == CA01 1147 9CD2 EFDF FB82  3925 3E1C 27E1 1F69 BFFE
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 836 bytes
Desc: not available
URL: <http://lists.alioth.debian.org/pipermail/pkg-multimedia-maintainers/attachments/20130109/73ff0e90/attachment.pgp>