Bug#1034358: libvncclient1: license conflict with libsasl2

2023-08-01 Thread Bastian Germann

Control: severity -1 important

The RSA-MD license is gone from cyrus-sasl's binaries now, so derivative works 
can ignore it.
For BSD-3-Clause-Attribution, the incompatibility case is not as strong, so I 
am lowering the severity.



Bug#1034358: libvncclient1: license conflict with libsasl2

2023-05-21 Thread Bastian Germann

Am 21.05.23 um 21:48 schrieb Mike Gabriel:

Let me know if this works for you that this gets fixed only for trixie.


As nobody cared about it in the past: sure.



Bug#1034358: libvncclient1: license conflict with libsasl2

2023-05-21 Thread Mike Gabriel

Control: forwarded -1  https://github.com/LibVNC/libvncserver/issues/583
Control: tag -1 bookworm-ignore

Hi Bastian,

On  Do 13 Apr 2023 15:42:59 CEST, Bastian Germann wrote:


Package: libvncclient1
Version: 0.9.14+dfsg-1
Severity: serious

Hi,

libvncclient1 depends on libsasl2-2, which is licensed under CMU's  
BSD-3-Clause-Attribution license and covered by the RSA-MD license.  
They have clauses in place, which are known to be incompatible with  
GPL (libvncclient1's license).

There are several possible solutions to this problem:

1) Build without SASL support. The affected symbols  
GetTLSCipherBits, HandleSASLAuth, and ReadFromSASL are not used by  
any of the reverse dependencies.


2) Support my request at #996892.

3) Ask upstream to add a license exception for libsasl2-2, similar  
to the one that was required by Debian for OpenSSL

for a long time.

Thanks for your consideration,
Bastian


I have now (sorry for the delay) forwarded this issue upstream and  
suggested to them adding the license exception as proposed under (3).


I'd suggest ignoring this for the bookworm release as I presume that  
Christian Beier (upstream author/maintainer of src:libvncserver) will  
be cooperative on this issue. Let me know if this works for you that  
this gets fixed only for trixie.


Greets,
Mike
--

DAS-NETZWERKTEAM
c\o Technik- und Ökologiezentrum Eckernförde
Mike Gabriel, Marienthaler Str. 17, 24340 Eckernförde
mobile: +49 (1520) 1976 148
landline: +49 (4351) 850 8940

GnuPG Fingerprint: 9BFB AEE8 6C0A A5FF BF22  0782 9AF4 6B30 2577 1B31
mail: mike.gabr...@das-netzwerkteam.de, http://das-netzwerkteam.de



pgpoGA8qXn7Gv.pgp
Description: Digitale PGP-Signatur


Bug#1034358: libvncclient1: license conflict with libsasl2

2023-04-13 Thread Bastian Germann

Package: libvncclient1
Version: 0.9.14+dfsg-1
Severity: serious

Hi,

libvncclient1 depends on libsasl2-2, which is licensed under CMU's BSD-3-Clause-Attribution license and covered by the 
RSA-MD license. They have clauses in place, which are known to be incompatible with GPL (libvncclient1's license).

There are several possible solutions to this problem:

1) Build without SASL support. The affected symbols GetTLSCipherBits, HandleSASLAuth, and ReadFromSASL are not used by 
any of the reverse dependencies.


2) Support my request at #996892.

3) Ask upstream to add a license exception for libsasl2-2, similar to the one 
that was required by Debian for OpenSSL
for a long time.

Thanks for your consideration,
Bastian