[Pkg-openldap-devel] Bug#393404: Source package contains non-free IETF RFC/I-D's

[Simon Josefsson]

Package: openldap2.3
Version: 2.3.25-1
Severity: serious

Hi!

This bug has been filed on multiple packages, and general discussions
are kindly requested to take place on debian-legal or debian-devel in
the thread with Subject: "Non-free IETF RFC/I-Ds in source packages".

It seems this source package contains the following files from the
IETF under non-free license terms:

openldap-2.3.25/doc/rfc/rfc1274.txt 
openldap-2.3.25/doc/rfc/rfc2079.txt 
openldap-2.3.25/doc/rfc/rfc2247.txt 
openldap-2.3.25/doc/rfc/rfc2251.txt 
openldap-2.3.25/doc/rfc/rfc2252.txt 
openldap-2.3.25/doc/rfc/rfc2253.txt 
openldap-2.3.25/doc/rfc/rfc2254.txt 
openldap-2.3.25/doc/rfc/rfc2255.txt 
openldap-2.3.25/doc/rfc/rfc2256.txt 
openldap-2.3.25/doc/rfc/rfc2293.txt 
openldap-2.3.25/doc/rfc/rfc2294.txt 
openldap-2.3.25/doc/rfc/rfc2307.txt 
openldap-2.3.25/doc/rfc/rfc2377.txt 
openldap-2.3.25/doc/rfc/rfc2587.txt 
openldap-2.3.25/doc/rfc/rfc2589.txt 
openldap-2.3.25/doc/rfc/rfc2649.txt 
openldap-2.3.25/doc/rfc/rfc2696.txt 
openldap-2.3.25/doc/rfc/rfc2713.txt 
openldap-2.3.25/doc/rfc/rfc2714.txt 
openldap-2.3.25/doc/rfc/rfc2798.txt 
openldap-2.3.25/doc/rfc/rfc2829.txt 
openldap-2.3.25/doc/rfc/rfc2830.txt 
openldap-2.3.25/doc/rfc/rfc2849.txt 
openldap-2.3.25/doc/rfc/rfc2891.txt 
openldap-2.3.25/doc/rfc/rfc2926.txt 
openldap-2.3.25/doc/rfc/rfc3045.txt 
openldap-2.3.25/doc/rfc/rfc3062.txt 
openldap-2.3.25/doc/rfc/rfc3088.txt 
openldap-2.3.25/doc/rfc/rfc3112.txt 
openldap-2.3.25/doc/rfc/rfc3296.txt 
openldap-2.3.25/doc/rfc/rfc3377.txt 
openldap-2.3.25/doc/rfc/rfc3383.txt 
openldap-2.3.25/doc/rfc/rfc3663.txt 
openldap-2.3.25/doc/rfc/rfc3671.txt 
openldap-2.3.25/doc/rfc/rfc3672.txt 
openldap-2.3.25/doc/rfc/rfc3673.txt 
openldap-2.3.25/doc/rfc/rfc3674.txt 
openldap-2.3.25/doc/rfc/rfc3687.txt 
openldap-2.3.25/doc/rfc/rfc3698.txt 
openldap-2.3.25/doc/rfc/rfc3703.txt 
openldap-2.3.25/doc/rfc/rfc3712.txt 
openldap-2.3.25/doc/rfc/rfc3727.txt 
openldap-2.3.25/doc/rfc/rfc3771.txt 
openldap-2.3.25/doc/rfc/rfc3829.txt 
openldap-2.3.25/doc/rfc/rfc3866.txt 
openldap-2.3.25/doc/rfc/rfc3876.txt 
openldap-2.3.25/doc/rfc/rfc3909.txt 
openldap-2.3.25/doc/rfc/rfc3928.txt 
openldap-2.3.25/doc/rfc/rfc4013.txt 
openldap-2.3.25/doc/rfc/rfc4370.txt 
openldap-2.3.25/doc/rfc/rfc4373.txt 
openldap-2.3.25/doc/rfc/rfc4403.txt 

The license on RFC/I-Ds is not DFSG-free, see:
 * http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=199810
 * http://release.debian.org/removing-non-free-documentation
 * http://wiki.debian.org/NonFreeIETFDocuments

The etch release policy says binary and source packages must each be free:
 * http://release.debian.org/etch_rc_policy.txt

The severity is serious, because this violates the Debian policy:
 * http://www.debian.org/doc/debian-policy/ch-archive.html#s-dfsg

There are (at least) three ways to fix this problem.  In order of
preference:

1. Ask the author of the RFC to re-license the RFC under a free
   license.  A template for this e-mail request can be found at
   http://wiki.debian.org/NonFreeIETFDocuments

2. Remove the non-free material from the source, e.g., by re-packaging
   the upstream archive and adding a 'dfsg' version name to it.

3. Move the package to non-free.

I went over many packages looking for names of likely non-free files,
and there may be false positives.  If this is the case for your
package, I'm sorry for the noise.  I'll modify the scripts to take
into account false positives when I learn of them, and publish the
list of exceptions under "Known exceptions" at
<http://wiki.debian.org/NonFreeIETFDocuments>.

Thanks,
Simon