Bug#664611: Source package contains non-free IETF RFC/I-D

[Simon Josefsson]

Severity: serious
Package: asterisk
Version: 1:1.8.10.0~dfsg-1
User: debian-release at lists.debian.org
Usertags: nonfree-doc rfc

Hi!

This source package contains the following files from the IETF under
non-free license terms:

asterisk-1.8.10.0/codecs/ilbc/rfc3951.txt

Further, the iLBC implementation in codecs/ilbc/ is derived from RFC
3951 but I don't see a DFSG compatible license statement covering that
code in debian/copyright.  There is a file codecs/ilbc/LICENSE with some
licensing information that may be relevant, however I have not found the
source code files in asterisk to be part of any WebRTC release.  See
also this bug report which seems related:
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=664606

The license on RFC/I-Ds is not DFSG-free, see:

 * http://wiki.debian.org/NonFreeIETFDocuments
 * http://bugs.debian.org/199810

According to the squeeze/wheezy release policy, source packages must be
DFSG-free, see:

 * http://release.debian.org/squeeze/rc_policy.txt
 * http://release.debian.org/wheezy/rc_policy.txt

The severity is serious, because this violates the Debian policy:

 * http://www.debian.org/doc/debian-policy/ch-archive.html#s-dfsg

There are (at least) three ways to fix this problem.  In order of
preference:

1. Ask the author of the RFC to re-license the RFC under a free
   license.  A template for this e-mail request can be found at
   http://wiki.debian.org/NonFreeIETFDocuments

2. Remove the non-free material from the source, e.g., by re-packaging
   the upstream archive and adding 'dfsg' to the Debian package
   version name.

3. Move the package to non-free.

General discussions are kindly requested to take place on debian-legal
or debian-devel in the thread with Subject: "Non-free IETF RFC/I-Ds in
source packages".

Thanks,
Simon