Comments regarding nvidia-cuda-toolkit_10.1.105-1_amd64.changes

[Chris Lamb]

Hi Maintainer,

Please see the suggested notes that I am forwarding from an ftptrainee; please
add them in your CC.

   -- Chris Lamb <lamby at debian.org>  Tue, 07 May 2019 19:00:30 +0000

§

REJECT

This is clearly a non-free license, but certain points in the license text are
particularly concerning. For starters, the Nvidia SDK stipulates the age of the
person that's permitted to download/install/use the software. [1]

The CUDA Toolkit Supplement (#2) lists a limited number of files that may be
distributed. This source package does not exist in that list. [2]. Any other
distribution is prohibited. I believe just uploading this source package was
a violation of these terms.

I also noticed that certain components, licensed under GPL, require contacting
Nvidia via email and they expire their offer to obtain that source after three
years.

If I'm correct on these concerns, then this seems like a package that is not
suitable for even non-free and should be removed.


[1]
"""
 Important Notice--Read before downloading, installing,
 copying or using the licensed software:
 -------------------------------------------------------
 .
 This license agreement, including exhibits attached
 ("Agreement") is a legal agreement between you and NVIDIA
 Corporation ("NVIDIA") and governs your use of a NVIDIA
 software development kit ("SDK").
 .
 [...]
 This Agreement can be accepted only by an adult of legal age
 of majority in the country in which the SDK is used.
"""

[2]
"""
 1.1.2. Distribution Requirements
 .
 These are the distribution requirements for you to exercise
 the distribution grant:
 [...]
 .
   1. Your application must have material additional
     functionality, beyond the included portions of the SDK.
 [...]
 .
   4. Unless a developer tool is identified in this Agreement
     as distributable, it is delivered for your internal use
     only.
"""

=====

REJECT

Apparently the previous absurdities are acceptable in non-free. However, distribution
requirements are not met because the administrator installing the package must accept
the license terms before receiving the software.

The way package installation works prevents this, but there should at least be a
confirmation required via debconf to confirm that the person installing is legally
able to accept the license terms they are agreeing to prior to installation of
these files.