On 1/2/21 6:49 PM, Bastian Germann wrote:
Package: nftables
Severity: important
This package depends on libreadline8 which is GPL-3+ licensed. According to
debian/copyright parts of your package are GPL-2-only licensed. If that is also
(transitively) the case for the binaries that link with libreadline.so.8 it
might be legally problematic (see
https://www.gnu.org/licenses/gpl-faq.html#AllCompatibility).
There is an easy solution to the problem: Replacing the build dependency
libreadline-dev with libreadline-gplv2-dev links with the GPL-2+ licensed older
version. However, that is orphaned in Debian, so libeditreadline-dev should be
preferred, which does not compile with your package without any patch. It links
with the BSD-licensed libedit library which is a readline replacement.
Thanks for the heads up.
I started a conversation upstream, let's see what happens there first.