Package: lintian
Version: 2.115.3
Severity: wishlist

Debian has recently started requesting that graphical programs install 
AppStream metainfo.xml files.

https://appstream.debian.org/sid/main/issues/electrum.html

The AppStream specification has a very restricted listed of possible licenses 
for the metainfo.xml file.

FSFAP

MIT

0BSD

CC0-1.0

CC-BY-3.0

CC-BY-4.0

CC-BY-SA-3.0

CC-BY-SA-4.0

GFDL-1.1

GFDL-1.2

GFDL-1.3

BSL-1.0

FTL

FSFUL

https://www.freedesktop.org/software/appstream/docs/chap-Metadata.html#tag-metadata_license

No specific text is given for what they mean by the MIT license.  The MIT 
license is a bit problematic because there are more than one license that has 
been called the MIT license over the years.

https://en.wikipedia.org/wiki/MIT_License#Ambiguity_and_variants

https://www.gnu.org/licenses/license-list.en.html#Expat

When most people say MIT they mean Expat, so it is standard in the industry to 
assume that when no specific text is given MIT == Expat.

Debian prefers the Expat name to the MIT name for this reason.

https://www.debian.org/legal/licenses/mit

The documentation for the Debian machine-readable copyright file says the 
following.

"There are many versions of the MIT license. Please use Expat instead, when it 
matches."

https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/#license-short-name

The Electrum package, which is licensed upstream as MIT, is listed as Expat in 
debian/copyright according to the instructions in the copyright format and 
because the upstream MIT license matches exactly the Debian legal Expat example.

Because the AppStream metainfo.xml file does not allow the use of the Expat 
name, or it will fail validation with appstreamcli, I licensed the metainfo.xml 
file as MIT.  This made it easy to submit it upstream, which has already 
accepted it for the next release.

In the meantime, I included the metadata.xml file in the debian directory for 
the current release.  However, Lintian complained that Expat != MIT.

I considered creating a override, but according to the instruction at 
https://lintian.debian.org/manual/index.html#overrides it seemed more 
appropriate to file a bug against Lintian, as every time there is an AppStream 
file with a MIT license this will create a false positive if matched against 
Expat.

To work around this, I currently created a duplicate section in 
debian/copyright, which doesn't seem like an efficient long-term solution.

https://salsa.debian.org/sorenstoutner/electrum/-/blob/master/debian/copyright

I personally wish that those creating licenses had been more careful about the 
naming thereof.  Secondarily, I wish that AppStream had followed best practices 
and allowed the use of the Expat name.  However, given that neither of those 
things are within my control, the next best option is to make Lintian smart 
enough to work around this specific situation.

This was originally discussed at 
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1002053 but was moved to this 
separate bug report because it didn't end up being the same root problem.

Reply via email to