On Tuesday, November 3, 2026 5:26:29 PM Mountain Standard Time Juan Manuel Méndez Rey wrote: > Thanks a lot, Daniel, that was really helpful. > > A related question for the list, about syft > (https://bugs.debian.org/1124819, now in NEW). The tests for its binary > detection use small snippets cut out of real binaries, basically the bytes > around the version string. Most come from free software, but 15 don't: > four from Oracle Java 8 (120 bytes each) and eleven from Elastic's > filebeat, metricbeat and friends (100 bytes each). > > Are those fine in main, or should they go? And if they can stay, what > would you put in debian/copyright for them? Naming Oracle and Elastic with > their own licences feels wrong for main.
To me, that sounds like it falls squarely under the purview of Fair Use (which does not need a license or other permission from the copyright holder). As such, I would just add a comment in debian/copyright stating what you did above and that these files are included under Fair Use, and thus are suitable for inclusion in main. -- Soren Stoutner [email protected]
signature.asc
Description: This is a digitally signed message part.
