Re: Does a python library that requires a python-openssl to function need an OpenSSL exception?

2014-05-05 Thread Riley Baird
On 05/05/14 11:18, Simon Fondrie-Teitler wrote:
 Hi,
 
 I'm working on packaging pypump, which is licensed under the GPL-3. The
 package reviewer noticed it requires python-openssl to function. Does
 this mean that pypump needs an OpenSSL exception in order to be included
 in Debian?
 
 Thanks,
 Simon
 

Yes; I think you do. Debian takes the position that GPL software linking
to OpenSSL - whether static or dynamic - requires the exception.


-- 
To UNSUBSCRIBE, email to debian-legal-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Archive: https://lists.debian.org/536730c3.3040...@bitmessage.ch



Re: copyright years in the copyright file

2014-05-05 Thread Simon McVittie
On 01/05/14 11:16, Riley Baird wrote:
 I still didn't get the problem. What is the copyright year for? What is
 the difference if a software is (c) 1999 or (c) 2014?
 
 All copyrighted materials enter the public domain after a certain number
 of years. To be able to work out whether something is in the public
 domain, the year has to be known.

I am unconvinced by this argument, because I don't think
debian/copyright on its own is ever a going to be a sufficient source
for determining whether a work has passed into the public domain.

What matters for Debian is that the work is under DFSG-acceptable terms,
that we're complying with those terms (e.g. reproducing copyright
notices in accompanying documentation where required), that every
copyright holder has allowed the work to be released under those terms
(although in practice the closest that's ever going to be feasible for
that is we couldn't find any evidence that any copyright holder
*didn't* allow the work to be released under those terms, because we're
not omniscient), and that the work's terms are compatible with those of
other works that we want to combine with it (e.g. avoiding GPL vs.
obnoxious advertising clause). The rest is secondary

It is common for authors to contribute patches to
collaboratively-developed software without also adding themselves to
that file's copyright notice, and it isn't necessarily even clear to
non-lawyers (or even to lawyers) whether any given contribution is
eligible for copyright protection, or whether it is too small/trivial.
As long as that contribution is offered under the same license as the
work itself, the set of copyright holders doesn't usually matter a great
deal for Debian, and the set of copyright years certainly doesn't
(particularly not until the first Unix-related copyright terms start
expiring in a couple of decades, assuming copyright terms haven't been
retroactively extended by media-cartel-sponsored laws by then).

The situations where the copyright year really matters are those where
you want to claim that the work is now in the public domain:

* you want to use the work in a way not consistent with its license,
  e.g. taking a GPL work proprietary, or combining proprietary works
  with GPL'd works

* you want to relicense the work (which could be considered to be a
  special case of using it in a way not consistent with its current
  license)

and in either of those cases you need more information: for instance,
many jurisdictions have copyright terms of the form author's lifetime +
N years for at least some works, so now you need to know which authors
have or haven't died.

When relicensing, it is wise to err on the side of caution. For
instance, when we tried to relicense D-Bus from its GPL-2+/AFL-2.1
dual-license to the Expat license, Ryan Lortie used the copyright
headers, revision control history and ChangeLog to contact everyone who
*might* have been a copyright holder, because that was easier than
seeking legal advice on whether specific maybe-copyright-holders
actually held copyright. (We still couldn't relicense in the end,
because one early copyright holder had gone bankrupt, so tracing the
recipient of their copyright was difficult.)

The conservative assumption for copyright years is that a particular
version of a work (for instance, libfoo 1.2.3, not just libfoo) is
copyright [earliest copyright notice or release date]-[release date of
that version] by each copyright holder, unless you can find very good
evidence to the contrary.

Similarly, debian/copyright is a best-effort summary of copyright
holders, but if you actually want to track down the complete set of
copyright holders for relicensing or whatever, the conservative
assumption should be that you should use all available public
information (revision control, ChangeLog, *and* copyright headers) to
find everyone who *might* be a copyright holder.

S


-- 
To UNSUBSCRIBE, email to debian-legal-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Archive: https://lists.debian.org/53677228.3020...@debian.org



Re: copyright years in the copyright file

2014-05-05 Thread Riley Baird
 Similarly, debian/copyright is a best-effort summary of copyright
 holders, but if you actually want to track down the complete set of
 copyright holders for relicensing or whatever, the conservative
 assumption should be that you should use all available public
 information (revision control, ChangeLog, *and* copyright headers) to
 find everyone who *might* be a copyright holder.

Okay, I think that you're right. It is unwise to trust debian/copyright
entirely. If anyone were actually seriously considering using it in the
public domain, they would have to do much more checking anyway. Also, by
the time it expires, the copyright holder will probably update the year
of their copyrights.


-- 
To UNSUBSCRIBE, email to debian-legal-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Archive: https://lists.debian.org/5367faa6.6020...@bitmessage.ch