Bug#883731: audacious: Debian packaging has incorrect license

[Nicholas D Steeves]

Hi John,

On Wed, Dec 06, 2017 at 05:08:56PM -0500, John Lindgren wrote:
> 
> Per Debian policy 2.3:
> 
> "Every package must be accompanied by a verbatim copy of its copyright
> information and distribution license in the file /usr/share/doc/package/copyright
> (see Copyright information for further details)."
> 
> The file /usr/share/doc/audacious/copyright shipped in the Debian package
> is out of date and does not match the current Audacious license (GPL3 vs.
> BSD 2-clause).
> 
> Worse, the Debian package patches out[1] the upstream license file which
> is normally installed under /usr/share/audacious/COPYING and visible in
> the "About" window when running Audacious.
> 
> You are currently distributing Audacious in violation both of our license
> and of Debian's own policy.  Please include the original upstream license,
> verbatim, in the Debian package, or stop distributing Audacious.
> 
> Thank you,
> 
> John Lindgren
> Audacious maintainer

I'm not the maintainer of Audacious' Debian package, but I am part of
the Multimedia team, so I took a look at the Debian and upstream
source, because I agree that license problems must be fixed asap.

On this topic, would you please update contrib/audacious.appdata.xml
to reflect the current Audacious license (GPL3)?  It claims the
project_license is BSD-2-Clause.

http://redmine.audacious-media-player.org/projects/audacious/repository/revisions/master/changes/contrib/audacious.appdata.xml

And when I looked up upstream audacious/COPYING here:
http://redmine.audacious-media-player.org/projects/audacious/repository/revisions/master/changes/COPYING

I found this, which also looks like BSD-2-Clause:

LICENSE

Copyright © 2001-2017 Audacious developers and others

(A list of the copyright holders is provided in the AUTHORS file.)

    Redistribution and use in source and binary forms, with or without
    modification, are permitted provided that the following conditions are met:

    1. Redistributions of source code must retain the above copyright notice,
       this list of conditions, and the following disclaimer.

    2. Redistributions in binary form must reproduce the above copyright notice,
       this list of conditions, and the following disclaimer in the
       documentation provided with the distribution.

    This software is provided “as is” and without any warranty, express or
    implied.  In no event shall the authors be liable for any damages arising
    from the use of this software.
--
However, shouldn't it say the following if Audacious' project license
is GPL-3+ (drop the "any later version" clause for GPL-3 only) ?:

    Audacious, an Advanced Audio Player
    Copyright (C) 2001-2017 Audacious developers and others

    This program is free software: you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
    the Free Software Foundation, either version 3 of the License, or
    (at your option) any later version.

    This program is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    GNU General Public License for more details.

    You should have received a copy of the GNU General Public License
    along with this program.  If not, see <http://www.gnu.org/licenses/>.
--

Also, I found BSD-2-clause here: src/libaudcore/hook.cc,
src/libaudcore/hook.h, src/libaudcore/output.cc, et al.

Conversely, what I found in debian/copyright was a project license of
GPL-3, with notable exceptions. eg: are really translations GPL-1+?
Because the project license seems to be BSD-2-Clause, and the
translations have "This file is distributed under the same license as
the Audacious package" I wonder if they're actually BSD-2-Clause.
Would you please provide a citation for the upstream project's
relicensing to GPL-3?

Finally, from what I understand about combining licenses I think the
BSD-2-clause project license (please provide evidence that this isn't
the case), the src/libguess/* BSD-3-clause and the GPL bits can all be
used to produce a GPL-3 binary, so long as the BSD copyright notices
are preserved.

To my eyes it looks like the upstream project license needs to be
clarified and disambiguated, debian/copyright needs work, and finally
that deduplication patch can be dropped.

I'd be happy to take care of the Debian side of things over the
weekend.

Thank you,
Nicholas
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: not available
URL: <http://lists.alioth.debian.org/pipermail/pkg-multimedia-maintainers/attachments/20171207/0ba904ef/attachment.sig>