Bug#664611: Source package contains non-free IETF RFC/I-D

[Simon Josefsson]

clone 664611 -1 -2
retitle -1 Source package contains non-free IETF RFC/I-D
severity -1 serious
retitle -2 asterisk: private copy of libilbc (license issue)
thanks

Tzafrir Cohen <tzafrir.cohen at xorcom.com> writes:

>> Hi!
>> 
>> This source package contains the following files from the IETF under
>> non-free license terms:
>> 
>> asterisk-1.8.10.0/codecs/ilbc/rfc3951.txt
>
> As mentioned elsewhere, it is now free. In fact, Upstream removed it in
> previous versions, and re-acepted it in 1.8.10 due to the proper
> license.
>
> Keeping the bug open as the iLBC code is a private library.

I'm cloning this bug into two to help clarify that we are discussing two
separate issues that will need their own separate solutions:

1) The license of the RFC.  This is most likely non-free, see this page:
<http://wiki.debian.org/NonFreeIETFDocuments>.  If that is the case, it
must be removed from the Debian package.  This is a serious bug since it
violates the Debian policy.  The RFC was written by several people, and
not all of them were from Global IP Sound.  Every author needs to grant
a DFSG free license on the RFC for it to be usable in Debian.  Having
Google re-license the iLBC library is not sufficient to get a free
license on the RFC.

2) The license of the code derived from RFC 3951.  This has the
potential of being free after Google's purchase, however I do not recall
that anyone has so far pointed to any copyright license statement that
applies to the software in RFC 3951.  The WebRTC code that was pointed
to is substantially different from the RFC code.  The patent license
that was pointed to earlier is not a DFSG-free software license.  I
believe this bug is serious as well (without a DFSG-free license it
violates Debian policy).  To resolve this, we could try to reach out to
the Google people involved in the relicensing to ask them to publish the
reference implementation under a free license?  Does anyone know whom to
talk to?  Given that Google publish WebRTC, there is chance this could
be resolved in a good way.  The alternative is of course that Asterisk
uses the code from WebRTC which definitely is DFSG free.  There is even
a Debian package of it: https://github.com/dekkers/libilbc

/Simon