Fwd: kiax_0.8.4-3_i386.changes REJECTED

[George Danchev]

On Monday 03 October 2005 01:21, Mark Purcell wrote:
> On Sunday 02 October 2005 20:26, George Danchev wrote:
> > Sorry for replying to myself, but I would like to get some advices of how
> > to proceed from now on. The kiax 0.8.4 [1] issues read:
>
> George. Thanks for your continued work on this. Please keep it up!
>
> > 1) lib/iLBC - lisenced under Global IP Sound iLBC Public License, v2.0 -
> > IETF Version which is non-free [2] - will be tricky, but doable I think.
>
> I think it needs to be removed from any dfsg archive.  We are allowed to
> remove non-free components from the .orig.tar.gz in order to achieve this.
>
> The iaxclient README seems to have it right. iaxclient can be built and
> peforms well with either/ both libspeex and iLBC. iLBC is potentially
> non-free, thus iaxclient is only distributed with libspeex. (Note there is
> a patch required from the upstream libspeex for iaxclient support)

Yes. iLBC is horrible non-free piece as said by ftpmaster and seconded by 
-legal. 

> We can do the same with kiax, only distribute with libspeex.  Although
> ideally kiax should be setup to just use the shared libraries provided by
> libiaxclient-dev.

I see. I also sent a patch to upstream yesterday sanitisizing kiax tarball's 
lib directory and fixing the ilbc mess in 0.8.4. Got replies from them and 
seems they respect my arguments and the next new upstream version of kiax 
will we be clean..., will see. The shared library approach is a little bit 
hindered by these libraries not haiving versioning upstream. In fact kiax cvs 
code is meant to compile without any lib/ directory and linking with the 
iaxclient library already installed, but I dont want to go for cvs-dated 
source packages for the time being. We will keep working to deal with all 
these issues upstream as much as possible in the next release / at least we 
share the same native home language upstream ;-)/

> > 2)  populate debian/copyright with all copyright holders and licenses
> > including  the Speex Licences. But if we go for educating kiax of using
> > system libraries provided by already existing packages then we do not
> > need that -  that's also kind of tricky part since iaxclient also
> > provides libspeex  library itself.
>
> Correct. We actually also need to update debian/copyright for iaxclient as
> well, as it doesn't detail the copyright for libspeex either and it also
> distributes it.  I have just filed a severity serious bug report.
>
> I have also filed a bug against iaxclient to remind ourselves to use the
> shared libspeex when we can. (Encorporation of iaxclient patch)

I'll try to approach kiax using existing speex also.

> > 3) README.Debian - easy.
>
> Great!
>
> > Now my question is does something like above will save 1) in a reasonable
> > way ? I think that the program will be still useable when built against
> > such 'sanitisized' lib. So the kiax's lib/ (as found in dfsg.orig.tar.gz)
> > should be sanitisized to the lib/ found in iaxclient-0.0+cvs20050725
> > source package.
>
> Yes stripping out the lib/ to only include dfsg and renaming the tarball
> to .dfsg is is a perfectly reasonable approach, and would appear to be
> workable.

I see. This was the way to go before getting a notion of the new and clean, 
possibly all-free upstream prospective release from kiax's authors. I prefer 
to deal that upstream when possible.

> > > > Does this affect Asterisk?
>
> Having a look yes it does!
>
> asterisk does distribute codecs/ilbc, but debian/copyright doesn't list the
> copyright holder :-(
>
> So at least debian/copyright needs to be updated, but potentially
> codecs/ilbc needs to be removed from the asterisk-xxx.dfsg.tar.gz. I have
> just filed another severity serious bug against asterisk.

Well yesterday I was told that having ilbc bits in asterisk have been the very 
reason for the kiax's upstream getting it in their tarball. Seems we can work 
out that with the kiax authors soon... I'll keep'em close and feed with 
patches if necessary. Hope the same will happaned esily to the asterisk 
upstream.

> > > Well I think it is DFSG-compliant since at least the tarball name
> > > suggests that like dfsg.X.orig.tar.gz, although there should be a note
> > > about removed non-free files in copyright file or README.Debian I'm
> > > missing here ?
>
> Hmm, the dfsg. name doesn't mean we removed all non-free software, just
> some of it. In particular the non-free music-on-hold. Perhaps we need to do
> an audit against all the asterisk code base, although upstream are claiming
> the .tar is GPL compliant!

I see. Sometimes upstream are terribly wrong.

> > > That is what I think to do for  kiax-0.8.4 - to remove the
> > > bits not found in iaxclient-0.0+cvs20050725/lib.
>
> Sounds great.  Can you work in svn.debian.org now?

Yes, I added libiaxclient-dev as a build-depends of kiax yesterday. Will try 
to convince upstream to convert of using the system-installed libspeex and 
not distributing it with kiax tarball.

> > > I'll review the diff soon and to get a clue what will be stripped in
> > > fact and produce kiax_0.8.4.dfsg.1.orig.tar.gz.
> > >
> > > Any objections for doing so ?
> >
> > I reviewed the diff the whole iLBC thing should possibly be handle by
> > libspeex library.
>
> Great!
>
> > I sent two mails to two of the upstream developers explaning the above
> > issues in length three days ago, but no feedback yet (they possibly live
> > in my home city - shame ;-)
> >
> > Comments and alternative approaches greatly appreciated.
>
> I think you have the situation pretty well documented and we just need to
> take this approach forward.

Right ! But the good news from upstream make me wait for the next version of 
kiax. If we still have issues they will be handled by our packaging.

Thanks for your support.

-- 
pub 4096R/0E4BD0AB 2003-03-18 <people.fccf.net/danchev/key pgp.mit.edu>
fingerprint 1AE7 7C66 0A26 5BFF DF22 5D55 1C57 0C89 0E4B D0AB