[Pkg-rust-maintainers] rust-compiler-builtins_0.1.19-1_amd64.changes REJECTED

[Ximin Luo]

Hi,

Through some research on #debian-release we determined that this crate (or rather the lack of it) is what is blocking a crap ton of rust crates from migrating to Testing, because it is a dependency of some newer versions of crates that are themselves trying to migrate.

This crate has a muddy licensing situation, indicated by these two bugs:

1. https://github.com/rust-lang/compiler-builtins/issues/307
2. https://github.com/rust-lang/libm/issues/215

I have replied to both of those bug reports with what I believe is the correct and up-to-date situation.

The basic point for Debian is that original works copyright holders, do *not* in general [*] automatically hold copyright in the derivative work. So we don't need to mention them in the Copyright: field. This is the case even though they might appear in notices that *look like copyright notices*, but are actually just informational references about the original work of a derivative.

[*] in the absence of specific wording that assigns copyright, e.g. a CLA

In direct to your previous comments Thorsten:

Thorsten Alteholz:
> 
> Hi,
> 
> please also mention the BSD license of some files in your debian/coypright.
> 

This is the license of compiler-rt from the LLVM project, from which this this project is based. However, as I explained in https://github.com/rust-lang/compiler-builtins/issues/307#issuecomment-570820788

"the files in src/** are all rust translations that do not appear in the original compiler-rt work, therefore it is a derivative work, which has been authorised by the license of compiler-rt at the time of derivation. Since it is a derivative work, the new copyright holders are free to chose a license for it, according to the restrictions of the original work (in this case there are no restrictions, either in NCSA/MIT/Apache), it does not have to be a copy of the old license. So it is fine to relicense as Apache/MIT."

In other words, the presence of LICENSE.TXT is a historical anomaly and is not the actual license of this compiler_builtins project, which is Apache/MIT as Cargo.toml (and the file headers in src/**) say. The LLVM project copyright holders, do *not* hold copyright in this derivative.

I have advised upstream to delete or reformulate LICENSE.TXT to avoid this confusion in the future.

> The license text from Sun does not really look like the MIT license, so should be mentioned as well.
> 

Similarly, the license text from Sun applies to the original work, which is C source code from FreeBSD. However, none of that remains in compiler_builtins, which is a rust translation, i.e. a derivative work with a new copyright holder.

The copyright notice has to remain, according to the conditions of the original license, but this does not mean that Sun Microsystems is the *copyright holder*. The implied reading of the notice is "this work is based on an original work, the copyright holder of that work is Sun Microsystems". Not "the copyright holder of this work is Sun Microsystems".

I have asked upstream to clarify the notices so they better communicate the point that Sun Microsystems is *not* the copyright holder.

Summary
=======

I think the current debian/copyright file of this crate is correct and we do not need to make the changes you requested. Actually we do need to make one change - we should *remove* "1993-2004 Sun Microsystems, Inc." from the Copyright: field because they do not own copyright on this derivative work.

Do you agree?

Best,

Ximin

-- 
GPG: ed25519/56034877E1F87C35
GPG: rsa4096/1318EFAC5FBBDBCE
https://github.com/infinity0/pubkeys.git