Bug#643703: asterisk: SHA-1 code is doesn't allow modification

[Sam Geeraerts]

Package: asterisk
Version: 1:1.6.2.9-2+squeeze3
Severity: serious
Tags: upstream
Justification: Policy 2.1.3
User: gnewsense-dev at nongnu.org
Usertags: gnewsense libreplanet

File main/sha1.c has this license notice:

 *  This document and translations of it may be copied and furnished to
 *  others, and derivative works that comment on or otherwise explain it
 *  or assist in its implementation may be prepared, copied, published
 *  and distributed, in whole or in part, without restriction of any
 *  kind, provided that the above copyright notice and this paragraph are
 *  included on all such copies and derivative works.  However, this
 *  document itself may not be modified in any way, such as by removing
 *  the copyright notice or references to the Internet Society or other
 *  Internet organizations, except as needed for the purpose of
 *  developing Internet standards in which case the procedures for
 *  copyrights defined in the Internet Standards process must be
 *  followed, or as required to translate it into languages other than
 *  English.

To my understanding that means you can extend, but not modify the text/
code in this file. This violates DFSG.

It looks like this code was copied straight from RFC 3174. I found a
discussion [2] on debian-legal from a few years back that says that
RFC texts are non-free (except for the first 1000 or so). A summary
about copyright on RFC Editor [3] says that derivative works are
allowed, but doesn't go into detail.

[1] http://www.rfc-editor.org/rfc/rfc3174.txt
[2] http://lists.debian.org/debian-legal/2006/04/msg00223.html
[3] http://www.rfc-editor.org/copyright.17Feb04.html

-- System Information:
Debian Release: 6.0.2
  APT prefers stable
  APT policy: (500, 'stable')
Architecture: i386 (i686)

Kernel: Linux 2.6.32-5-686 (SMP w/2 CPU cores)
Locale: LANG=nl_BE.UTF-8, LC_CTYPE=nl_BE.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash