Re: Bug#937234: pam-python: Python2 removal in sid/bullseye
On 9/5/21 6:08 am, Mike Gabriel wrote:
That is not the point. E.g., if we spot a security issue with a
package, maybe you as the maintainer / upstream developer (afaik, you
are upstream and downstream for pam-python, Russel, right?) but also
maybe someone in the security team (or any other third person) might
apply a fix to the package and do an e.g. stable-security upload.
Yes, OK. I hadn't thought of that perspective. So far pam-python's
one security release was done by myself, and it was done upstream
beforehand.
No, see my previous mail for more details. Debian offers a very
standardized way of obtaining the exact source code that the
libpam-python bin:pkg has been built from. Period. Done. License
compliance accomplished.
It's pretty clear Debian does an exemplary job of source distribution.
It was just the "prominent notice" bit.
Commercial products (eg, the phones), in some ways do this better(!)
than Debian does. They collect them all in an About page, which is easy
to find. If the commercial products added a "and you can download the
source from here..." link, it would be job done for the AGPL.
Debian does a much better job of all the hard parts: collecting those
licences, organising them into a database and ensuring they always
present on the machine, providing working downloads links - but making
it all findable by a normal GUI user - not so good. It needs an easily
findable GUI clicky thingy that displays them. Having that would put
the "AGPL prominent notice" requirement to bed for good.
Even just adding a copyright and download pages to Synaptic might
suffice. For a CLI user a "apt-get licence" would do the job.
Furthermore, I agree with Nik, that AGPL for a non-web project (as
that's where AGPL really makes sense) is disputable and you don't
loose anything if you switch over to GPL-3+ instead of AGPL-3+.
That's correct. It's just laziness on my part. It's easier to copy &
paste the same licence into all my projects. As the exception clause
illustrates I put some thought into choosing one that seemed to fit
best. I guess I could add another exception that changes "prominent
notice" to something like "easily discoverable notice", if people have
an issue with the word prominent.
The reason I use the AGPL is it seems to me software as a service
reduces copyleft licences to something about of strong as MIT licences.
If I was happy with a MIT licence that is what I would have used, but
I'm not.
Reply to: