Bug#1150704: Contains code licensed under CeCILL-C which is not dfsg-free

[Xavier]

Le 12/10/2026 à 18:16, Mechtilde Stehmann a écrit :
> Package: licensecheck
> Version: 3.3.9-1
> Severity: serious
> Tags: upstream
> X-Debbugs-Cc: mechtilde at debian.org
> 
> Hello
> 
> studying how licensecheck works I found this file
> 
> t/exception/Cecill/tv_implementpoly.reference
> 
> which is under the
> 
> CeCILL-C with Sollya-4.1 exception
> 
> The license CeCILL is not compliant with the DFSG because of § 13.2
> 
> 
>      Mandatory Choice of Venue (Article 13.2)
> 
>      The Clause: "Failing an amicable solution... disagreements or
>      disputes shall be referred to the Paris Courts having jurisdiction..."
>      DFSG Conflict: This is considered a "Choice of Venue" clause,
>      which the debian-legal community almost universally rejects as
>      non-free. By forcing any user or contributor—whether they live in
>      New Zealand, Argentina, or Japan—to travel to Paris and navigate
>      the French legal system to defend themselves, the license imposes
>      an unreasonable, prohibitive burden. Debian considers this a
>      restriction on the core freedoms to use, modify, and distribute
>      the software (acting essentially as a fee or restriction,
>      violating the spirit of DFSG #1: Free Redistribution).
> 
>      Discrimination Against Amateurs/Beginners (Preamble & Article 9.1)
> 
>      The Clause: The text states that the software's "use is reserved
>      for developers and experienced professionals having in-depth computer
>      knowledge."
>      DFSG Conflict: This directly conflicts with DFSG #5: No Discrimination
>      Against Persons or Groups. A free software license cannot say that a
>      tool is only for experts, businesses, or researchers. If this text is
>      interpreted legally as a usage restriction (rather than just a
>      poorly-worded warranty disclaimer), it prevents students, amateurs,
>      and beginners from exercising their right to use the software.
> 
>      The Obnoxious UI Advertising Requirement (Article 6.4)
> 
>      The Clause: The licensee must "ensure that use of the Software, its
>      intellectual property notices and the fact that it is governed by the
>      Agreement is indicated in a text that is easily accessible, 
> specifically
>      from the interface of any Derivative Software."
>      DFSG Conflict: This clause acts as an overly aggressive "advertising
>      clause." While preserving copyright notices in source files is 
> required
>      and DFSG-compliant, forcing developers to alter the user interface of
>      any derivative software restricts how developers can build and design
>      their own tools. This conflicts with DFSG #3: Derived Works, which 
> requires
>      that developers have the freedom to modify the software and create
>      derivatives without arbitrary restrictions on how those derivatives 
> must
>      function or be displayed (for example, if you make a headless, 
> command-
>      line, or embedded derivative, surfacing text in an "interface" is
>      practically impossible).
> 
>      Over-Restrictive Notice Preservation (Article 6.4)
> 
>      The Clause: The licensee undertakes "to reproduce said notices, in an
>      identical manner, in the copies of the Software modified or not".
>      DFSG Conflict: While DFSG #4 allows licenses to require the integrity
>      of the author's source code and copyright notices, demanding that 
> notices
>      be preserved in an "identical manner" without allowing any format
>      modifications can be a minor friction point for DFSG freeness. If a 
> Debian
>      packager needs to convert documentation formats or refactor code
>      structures, absolute identical reproduction of notice blocks can 
> create
>      technical/legal hurdles.
> 
> Kind regards
> 
> Mechtilde

Hello Mechtilde,

Thanks for looking at licensecheck and for taking the time to report 
this. However, I don't think there is an issue here: the CeCILL licenses 
(v2 and later, including the CeCILL-B and CeCILL-C variants) are 
considered free software licenses, and they are accepted in Debian main:

  * The FSF lists CeCILL as a free software license, compatible with
    the GNU GPL (article 5.3.4 explicitly allows relicensing under the
    GPL).
  * The OSI has approved CeCILL-2.1.
  * The ftp-masters have accepted CeCILL-licensed software in main for
    many years. For example, sollya itself (the origin of the
    "Sollya-4.1" exception found in this test file) and scotch are both
    distributed in main under CeCILL-C.

The concerns raised on debian-legal back in 2004-2005 were about CeCILL
v1. They were addressed in v2, notably by making the English version
authoritative and adding the GPL compatibility clause.

About the points you raised:

  * Choice of venue (article 13.2): such clauses do not restrict use,
    modification or redistribution, and they are not a fee in the
    sense of DFSG #1. Other licenses accepted in main contain similar
    clauses, for example MPL 1.1 (section 11) and CDDL (section 9).

  * "reserved for developers and experienced professionals": this
    sentence is part of the preamble's warning about the risks of using
    the software, as a justification for the absence of warranty. It is
    not an operative clause restricting who may use the software, so
    DFSG #5 is not affected.

  * Notice in the interface (article 6.4): "specifically" translates the
    French "notamment" ("in particular"), so the interface is given as
    an example, not as an exclusive requirement. This is comparable to
    the GPL-2 section 2(c) interactive notice or the GPL-3 "Appropriate
    Legal Notices"; software without an interface can meet it through
    its documentation. This is fine under DFSG #3.

  * Notices reproduced "in an identical manner": this is the usual
    requirement to keep copyright and license notices intact, as in
    the BSD licenses ("retain the above copyright notice"). DFSG #4
    explicitly allows it.

Finally, t/exception/Cecill/tv_implementpoly.reference is test data. It
exists precisely to check that licensecheck correctly detects this 
license and its exception.

For these reasons I suggest to close this bug. If you think the status 
of CeCILL in Debian should be reconsidered in general, the right place 
to discuss it would be debian-legal or the ftp-masters, rather than a 
bug against licensecheck.

Kind regards,
Xavier