Bug#883731: audacious: Debian packaging has incorrect license

Tue Dec 12 21:39:28 UTC 2017

Hi Ian, Francesco, John, and everyone else reading this,

On Mon, Dec 11, 2017 at 12:28:43AM -0500, John Lindgren wrote:
> On 12/10/2017 06:12 PM, Nicholas D Steeves wrote:
> > In particular I'm concerned about lines like this from
> > d/copyright:
> > 
> > "po/uk.po" is © 2005 Mykola Lynnyk and is distributed under the terms of the
> >  GPL.
> > 
> > Where the new po/uk.po is GPL-incompatible 2-clause BSD:
> 
> The line "Copyright (C) 2005 Mykola Lynnyk <...>" appears to have been
> lost accidentally in commit 1a013156d209b, when we switched over to
> Transifex.  I'll see about restoring it.
> 
> As far as our Git history goes back (to October 2005), uk.po had no
> license declaration and was assumed to be under the same license as the
> source files it translated (which at the time was GPLv2+). At the time
> of the BSD relicense, we took the liberty of assuming that such
> translations would automatically switch to the new license along with
> the source files they translated.  No one (to my knowledge) has
> contacted us in the five years since to clarify that their translations
> were intended to be forever GPL-only, but I suppose that to take a more
> cautious approach, Debian could still distribute the package as GPL in
> total.

For Debian Legal Team: With respect to the translations, I now suspect
they can probably be transitioned to BSD without issue, because
copyright is also assigned to the Audacious Translators.  eg, in the
last GPL-2+ release 3.2.4:
    Copyright (C) Audacious translators

Would you please confirm?  It would be nice to be able to simplify the
issue of relicensing for the translations :-)  Also, would you please
confirm or deny the necessity of the work outlined in the second half
of this email?

John, I removed the offending patch in git for the user-visible
license provided by the Audacious GUI.  Then I went ahead and did a
historical relicensing review, in spite of the potential for other
missing copyright holders due to the Transifex switch.  I am a bit
concerned about what looks to be a politic of "silence is consent" wrt
relicensing, and hope that I am wrong, or that I was sloppy in my
review.  Was the discussing conducted informally off the record?

By the way, I definitely support every author's right to choose a
preferred license, so I'm not troubled with a transition to BSD
licensing ;-) This is one of the reasons the FSF demands copyright
assignment for their projects...they want to be able to relicense at
any point in the future without having to contact and document consent
from all contributors.

Would you please take a look at the following (Ian's reply) for an
example of how to provide a record of all copyright holder's consent?
tldr; documented confirmation (eg: via copies of emails or a download
of a bug report/issue/forum thread) for all contributors who did not
assign copyright to the Audacious Team in the headers of the files
they contributed to.  I would be happy to generate such a file[s] if
you can point me in the right direction[s].

On Mon, Dec 11, 2017 at 03:03:09PM +0000, Ian Jackson wrote:
> Nicholas D Steeves writes ("Re: Bug#883731: audacious: Debian packaging has incorrect license"):
> > Will I also need to provide formal copies in debian/COPYING.emails or
> > would a README.copyright or similar pointing to the bug report
> > suffice?  In particular I'm concerned about lines like this from
> > d/copyright:
> 
> Please put all the necessary information in the source package.
> 
> COPYING.emails is only one filename you might choose to use.  If you
> want to download multiple pages, or something, you can put them in
> separate files.  It's probably a good idea to download them with w3m
> -dump or something.  That produces a human-readable file which doesn't
> depend on any external HTML assets.
> 
> This is much better than simply urls, because (sadly), urls often rot.
> The lifetime of the contents in debian/ is controlled by Debian and
> often exceeds, by large factors, the lifetime of upstream source
> repositories, bug trackers, etc.
> 
> It would be a best praqctice to record the contents _and also_ the url
> you got it from, and the date you downloaded it.  That way the
> information you give is verifiable while the url is still active; and
> if the url rots, the information (attribution, etc.) is not lost.
> 
> So in summary, I would 
>   w3m -dump https://bugtracker/whatever > debian/COPYING.issue4391.txt
> and make an overview file (COPYING.emails maybe) referring to
> these other files.

Specific commits I couldn't find documented consent for, and which
didn't have have copyright assigned to the Audacious Team in the last
stable GPL-2+ release (3.2.4).  From the git history I see it was a
lot of work to transition to BSD!  Here are a couple examples
copyright holders that I believe Audacious will need explicit consent
from (see above) for relicensing to BSD:

42cbe57307962e65acc2db24dbe99249453c6aac
b308c892f47a55c63ef2675f9b6cf016be037f4c
31ea4ad1adb84f37ce8fff5b4868df247bd6d913
df1165d2fdd8470b2fd45d2e87cac5373055b55e
9a979a5af95eb663435ef99d3b7b5c79b94855be
33b58d4d8ba18fcbcc36af5c650414e173e22396
  * Do you have consent on file to move to BSD license for all
    contributors to XMMS and BMP?

bc295976816358f9512f99a78e933e6594cce121
853f96f54bbca608f0c95b5e8bf3fd2146607bdd
3d2ca792a02973fb5e2f33d6273aac825d4f3a55
a0655119b4e2b54c7879bd3dccdbc244ba07c318
  * Do you have consent on file to move to BSD license for all
    contributors to XMMS and BMP?

One can infer William Pitcock's consent to switch to BSD licensing
here, especially because he authored and commited other patches to
switch his code to BSD license, so I've omitted commits from others
that affected files where he alone was/is the copyright holder:
419176b6a4876daaca55a95b60ce51b786534961

320ffbb1a063c69f769683b0afc2726a3c87c89f
788fb88b010f1267c8de9b3f5e4216605064eac8
b58af7e570f893be4585cc924435a947146b3b04
63a743a785c79013c7a47fcd94a79ca14cac7688
aff7adac8e8f5e2143cd2654edeadfb37f033a43
1d699bdbde6151db05ccd83c8c857bd33e6660bb
0284a462e096a6d98233681e6c94cd3256bb7445

List of GPL-2+ copyright holders from last stable GPL release (3.2.4):
https://github.com/audacious-media-player/audacious/blob/audacious-3.2.4/AUTHORS

And debian/copyright (gpl-2+ licensed document) that hasn't seen
significant updates since audacious-2.3; however, I'm linking to it in
the hopes that it will help you track down anything lost in the
Transifex switch:
https://anonscm.debian.org/git/pkg-multimedia/audacious.git/tree/debian/copyright

It's a PITA, and a lot of work, but I believe that it's necessary for
Debian to confirm the successful relicensing of Audacious from GPL-2+
to BSD 2-clause.  I brought in debial-legal as early as possible so
that they could step in and shout "wait a second, that's pedantic busy
work!" if ever that was the case.

Kind regards,
Nicholas
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: not available
URL: <http://lists.alioth.debian.org/pipermail/pkg-multimedia-maintainers/attachments/20171212/b98b7116/attachment.sig>