Linux Archive

Linux Archive (http://www.linux-archive.org/)
-   Debian Development (http://www.linux-archive.org/debian-development/)
-   -   Libreadline6 is GPLv3: incompatible with GPLv2-only software (http://www.linux-archive.org/debian-development/363264-libreadline6-gplv3-incompatible-gplv2-only-software.html)

James Y Knight 04-28-2010 03:32 PM

Libreadline6 is GPLv3: incompatible with GPLv2-only software
 
I noticed that there's a bunch of bugs filed to transition packages depending on libreadline5-dev to libreadline-dev so that they can transition to using libreadline6. [1].

One of those (#553741) was filed against CLisp, which is licensed under GPLv2-only. Unfortunately, readline is under the GPLv3+ as of version 6, so making that change is impossible to do legally.

Luckily, nothing had been done to clisp yet, (and I left a comment there noting the problem). I noticed that the ruby maintainer also wontfix'd the bug filed against ruby, as ruby is also not available under the GPLv3.

However, seeing this made me wonder if perhaps some of the already-resolved bugs in that list might be in packages licensed under GPLv2 whose maintainers *didn't* notice the issue (easy to miss, since the transition bug didn't mention the significant change in license terms for readline.)

After checking a scattering of random packages, I happened across one example of this already in Debian testing: socat. It is GPLv2-only, and is linked against GPLv3 libreadline6 in testing. (filed bug 579494).

I haven't done a search through the package list (and don't really know how I'd go about doing that in an efficient/automated fashion), so I don't know of any other license violating packages. But where there's one, there's probably more (or else I was just extremely lucky), so I thought I'd drop a note here about the issue to help raise awareness of the problem again.

James

[1]*http://bugs.debian.org/cgi-bin/pkgreport.cgi?tag=readline6;users=doko@debian.org

Samuel Thibault 04-28-2010 04:41 PM

Libreadline6 is GPLv3: incompatible with GPLv2-only software
 
James Y Knight, le Wed 28 Apr 2010 11:32:36 -0400, a écrit :
> After checking a scattering of random packages, I happened across one example
> of this already in Debian testing: socat. It is GPLv2-only, and is linked
> against GPLv3 libreadline6 in testing. (filed bug 579494).

Worse than that: a program A under GPL2 using lib B under GPL2+, itself
using libreadline, now GPL3, does not respect the GPL3. So not only
Depends, but basically anything that used libreadline6 as a pulled
dependency at link time has the issue.

Samuel


--
To UNSUBSCRIBE, email to debian-devel-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org
Archive: 20100428164125.GV4653@const.famille.thibault.fr">h ttp://lists.debian.org/20100428164125.GV4653@const.famille.thibault.fr

Jakub Wilk 04-28-2010 04:46 PM

Libreadline6 is GPLv3: incompatible with GPLv2-only software
 
* James Y Knight <foom@fuhm.net>, 2010-04-28, 11:32:
One of those (#553741) was filed against CLisp, which is licensed
under GPLv2-only. Unfortunately, readline is under the GPLv3+ as of
version 6, so making that change is impossible to do legally.


It's not the first time license change in a library triggers an
incompatibility: http://bugs.debian.org/512776

--
Jakub Wilk

Neil Williams 04-28-2010 04:48 PM

Libreadline6 is GPLv3: incompatible with GPLv2-only software
 
On Wed, 28 Apr 2010 11:32:36 -0400
James Y Knight <foom@fuhm.net> wrote:

> After checking a scattering of random packages, I happened across
> one example of this already in Debian testing: socat. It is
> GPLv2-only, and is linked against GPLv3 libreadline6 in testing.
> (filed bug 579494).

Umm:

http://packages.debian.org/changelogs/pool/main/s/socat/current/copyright

This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 2 of the License, or (at
your option) any later version.

I'm not saying other packages might not still be affected but this one
is OK.

The README you mention only describes "GNU GPL":
http://www.dest-unreach.org/socat/doc/README

Tests for this kind of thing are quite a lot of work because you need
to download the entire source and run something like licensecheck or
check the COPYING file in the source - which is GPLv2 or (at your
option) any later version.

I think 579494 should be closed.

--


Neil Williams
=============
http://www.data-freedom.org/
http://www.linux.codehelp.co.uk/
http://e-mail.is-not-s.ms/

Jakub Wilk 04-28-2010 05:07 PM

Libreadline6 is GPLv3: incompatible with GPLv2-only software
 
* Neil Williams <codehelp@debian.org>, 2010-04-28, 17:48:

After checking a scattering of random packages, I happened across
one example of this already in Debian testing: socat. It is
GPLv2-only, and is linked against GPLv3 libreadline6 in testing.
(filed bug 579494).


Umm:

http://packages.debian.org/changelogs/pool/main/s/socat/current/copyright

This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 2 of the License, or (at
your option) any later version.


I would assume that's rather a mistake in debian/copyright. README is
very clear:


| This program is free software; you can redistribute it and/or modify
| it under the terms of the GNU General Public License as published by
| the Free Software Foundation, version 2 of the License

--
Jakub Wilk

Neil Williams 04-28-2010 05:27 PM

Libreadline6 is GPLv3: incompatible with GPLv2-only software
 
On Wed, 28 Apr 2010 19:07:56 +0200
Jakub Wilk <jwilk@debian.org> wrote:

> * Neil Williams <codehelp@debian.org>, 2010-04-28, 17:48:
> >> After checking a scattering of random packages, I happened across
> >> one example of this already in Debian testing: socat. It is
> >> GPLv2-only, and is linked against GPLv3 libreadline6 in testing.
> >> (filed bug 579494).
> >
> >Umm:
> >
> >http://packages.debian.org/changelogs/pool/main/s/socat/current/copyright
> >
> > This program is free software; you can redistribute it and/or
> > modify
> >it under the terms of the GNU General Public License as published by
> >the Free Software Foundation; either version 2 of the License, or (at
> >your option) any later version.
>
> I would assume that's rather a mistake in debian/copyright. README is
> very clear:

Why assume an error? The COPYING file in the source is GPLv2 or later
*and* the source code refers to COPYING, not README.

/* source: xiowrite.c */
/* Copyright Gerhard Rieger 2001-2008 */
/* Published under the GNU General Public License V.2, see file COPYING
*/

That isn't a full licence declaration, those seeking a full declaration
are explicitly referred to COPYING and COPYING says GPLv2 or later.

neil@dwarf:socat-1.7.1.2$ grep COPYING *.c|wc -l
65

The Debian maintainer knows the package best and debian/copyright is
the expression of the maintainer. I'm just offering my view of the
source that it would appear to be GPLv2 or later.

> | This program
is free software; you can redistribute it and/or modify
> | it under the terms of the GNU General Public License as published by
> | the Free Software Foundation, version 2 of the License

I would argue that this is an inadvertent abbreviation in a document
not intended to be the authoritative licence document - the source code
itself refers to COPYING as that file.

It could be clarified, of course - I'd suggest that if the bug is left
open it should be downgraded to wishlist or at most minor and then
forwarded upstream so that the licence information can be specified
clearly in the source code files themselves.

--


Neil Williams
=============
http://www.data-freedom.org/
http://www.linux.codehelp.co.uk/
http://e-mail.is-not-s.ms/

Ben Hutchings 04-28-2010 05:41 PM

Libreadline6 is GPLv3: incompatible with GPLv2-only software
 
On Wed, Apr 28, 2010 at 06:27:35PM +0100, Neil Williams wrote:
> On Wed, 28 Apr 2010 19:07:56 +0200
> Jakub Wilk <jwilk@debian.org> wrote:
>
> > * Neil Williams <codehelp@debian.org>, 2010-04-28, 17:48:
> > >> After checking a scattering of random packages, I happened across
> > >> one example of this already in Debian testing: socat. It is
> > >> GPLv2-only, and is linked against GPLv3 libreadline6 in testing.
> > >> (filed bug 579494).
> > >
> > >Umm:
> > >
> > >http://packages.debian.org/changelogs/pool/main/s/socat/current/copyright
> > >
> > > This program is free software; you can redistribute it and/or
> > > modify
> > >it under the terms of the GNU General Public License as published by
> > >the Free Software Foundation; either version 2 of the License, or (at
> > >your option) any later version.
> >
> > I would assume that's rather a mistake in debian/copyright. README is
> > very clear:
>
> Why assume an error? The COPYING file in the source is GPLv2 or later
> *and* the source code refers to COPYING, not README.
>
> /* source: xiowrite.c */
> /* Copyright Gerhard Rieger 2001-2008 */
> /* Published under the GNU General Public License V.2, see file COPYING
> */
>
> That isn't a full licence declaration, those seeking a full declaration
> are explicitly referred to COPYING and COPYING says GPLv2 or later.
[...]

COPYING contains the standard preamble and the recommendation to licence
your software under 'GPLv2 or later', but these are not the licence. The
work itself (the source code) specifies v2, and no amount of wishful
thinking is going to change this.

Ben.

--
Ben Hutchings
We get into the habit of living before acquiring the habit of thinking.
- Albert Camus


--
To UNSUBSCRIBE, email to debian-devel-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org
Archive: 20100428174139.GN16821@decadent.org.uk">http://lists.debian.org/20100428174139.GN16821@decadent.org.uk

James Y Knight 04-28-2010 06:09 PM

Libreadline6 is GPLv3: incompatible with GPLv2-only software
 
On Apr 28, 2010, at 11:32 AM, James Y Knight wrote:
After checking a scattering of random packages, I happened across
one example of this already in Debian testing: socat. It is GPLv2-
only, and is linked against GPLv3 libreadline6 in testing. (filed
bug 579494).


One further note: Fedora seems to have already run across this issue
and fixed their socat package to build against compat-readline5-devel:

http://article.gmane.org/gmane.linux.redhat.fedora.package.announce/34983

I guess it's probably easier to check these sorts of things in Fedora
since RPM has a license field in the metadata.


James


--
To UNSUBSCRIBE, email to debian-devel-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org
Archive: 55AFCBF6-2068-451E-80F6-78937712B0C9@fuhm.net">http://lists.debian.org/55AFCBF6-2068-451E-80F6-78937712B0C9@fuhm.net

Bastien ROUCARIES 04-29-2010 07:47 AM

Libreadline6 is GPLv3: incompatible with GPLv2-only software
 
On Wed, Apr 28, 2010 at 8:09 PM, James Y Knight <foom@fuhm.net> wrote:
>
> On Apr 28, 2010, at 11:32 AM, James Y Knight wrote:
>>
>> After checking a scattering of random packages, I happened across one example of this already in Debian testing: socat. It is GPLv2-only, and is linked against GPLv3 libreadline6 in testing. (filed bug 579494).
>
> One further note: Fedora seems to have already run across this issue and fixed their socat package to build against compat-readline5-devel:
> http://article.gmane.org/gmane.linux.redhat.fedora.package.announce/34983
>
> I guess it's probably easier to check these sorts of things in Fedora since RPM has a license field in the metadata.
>

Why not using http://www.thrysoee.dk/editline/ already included in
debian and that seems to be source compatible.

Bastien


--
To UNSUBSCRIBE, email to debian-devel-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org
Archive: s2g195c7a901004290047n6998837bxad412ee26d149817@ma il.gmail.com">http://lists.debian.org/s2g195c7a901004290047n6998837bxad412ee26d149817@ma il.gmail.com


All times are GMT. The time now is 03:41 AM.

VBulletin, Copyright ©2000 - 2014, Jelsoft Enterprises Ltd.
Content Relevant URLs by vBSEO ©2007, Crawlability, Inc.