[Pkg-privacy-maintainers] Do we want to add a fork of utls (ITP #954209)?

[Roger Shimizu]

Hi there,

I see this ticket after I packaged and uploaded an intermediate
upstream of this package:
* https://github.com/refraction-networking/utls
* https://bugs.debian.org/959534

On Fri, Apr 3, 2020 at 10:37 PM Ana Custura <ana at netstat.org.uk> wrote:
>
> Hi Ulrike and Cecylia,
>
> Thank you for looking at this!
>
> On 16/03/2020 18:12, Ulrike Uhlig wrote:
>
> If I understand correctly from a quick look, Yawning distributes his
> changes under GNU GPL, while uTLS upstream has a BSD 3-Clause license
> [https://github.com/refraction-networking/utls/blob/master/LICENSE].
>
> The BSD 3-Clause is in line with the Debian Free Software Guidelines
> (DFSG)[https://wiki.debian.org/DFSGLicenses#The_BSD-3-clause_License].
>
> From my understanding, in Debian packaging, licenses generally apply to
> files but it also seems possible (I never encountered such a case) to
> have several licenses for one file
> [https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/#license-syntax].
> Maybe someone could confirm that this is accepted.

This case is different from dual license.
I ever experienced single license to dual license transition for a few
files in Linux kernel [1].
So I know this need ACK from original author. [2]

[1] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=3e2f2db
[2] http://lists.infradead.org/pipermail/linux-arm-kernel/2016-January/400740.html

I guess Yawning didn't ask upstream for re-license, so license for
this project is suspicious.
Personally I think if it's the case, the project should be considered
using the same license as upstream.

> I'm now unsure to what we referred to previously when saying that there
> might be licensing issues with Yawning's fork. It does not look like
> there are. Or am I missing something crucial here? If I don't, then to move forward, one would need to open an RFP or ITP
> (Intent to Package) bug on the Debian bugtracker and then package this
> fork of uTLS.

Since I already packaged the refraction-networking/utls, maybe you can
simply use this one?
It's still in NEW queue, but you can find the repo in salsa [3]

[3] https://salsa.debian.org/go-team/packages/golang-refraction-networking-utls

I tried to compare both git repos, but I can only git fetch master
branch from yawning/utls.
Is this problem of my local git tool? Can you git fetch all branches /
tags from yawning/utls?

Hope it helps.

Cheers,
-- 
Roger Shimizu, GMT +9 Tokyo
PGP/GPG: 4096R/6C6ACD6417B3ACB1