Re: How to package Nuxeo DM, a Java EE application, in Debian

[Scott Howard <showard314@gmail.com>]

This is an interesting problem, there are great open source Java
projects out there that, but no fault of their own, are using
libraries from a repo that Debian can't access (no copyright notice
and no license makes it a non-starter). Add the library versioning/API
breakage potential on top of that, and it's even harder. If only
maven's repos had their source code and license available, I can
imagine some script to scrape their repo and make policy compliant
.debs from them...

I think Stefane picked a great example of how Debian packages are made
policy compliant (and the work needed for every java library)

On Wed, Feb 9, 2011 at 6:25 AM, Stefane Fermigier <sf@nuxeo.com> wrote:
> What I was trying to say is that projects created by or through foundations or responsible companies tend to obey a certain legal and quality process, not that there are more important that other projects.

I have no doubt that those foundations follow their legal
responsibilities, It's just that when Debian hosts the code, it's now
Debian's legal responsibility to follow whatever license whomever
holds the copyright has assigned to us.

>
> BTW, here's what geogebra's download page (http://www.geogebra.org/cms/en/download) says: "You are free to copy, distribute and transmit GeoGebra for non-commercial purposes".
>
> Isn't this a flagrant violation of the DFSG (Item 6, "No Discrimination Against Fields of Endeavor") ?

That is a perfect example of how Debian does a "value add" to their
packages. The full license is at:
http://www.geogebra.org/download/license.txt
and the debian copyright is:
http://packages.debian.org/changelogs/pool/main/g/geogebra/geogebra_3.2.46.0+dfsg1-1/geogebra.copyright

Only the installer is CC-BY-SA-NC (which is not DFSG free), so the
debian maintainer removed the -NC code so the remaining files are all
GPL-2+ and CC-BY-SA. You can see the +dfsg in the package version,
indicating that someone did work to make it dfsg. That's why we'd need
the source code and license for each jar, but situations like that are
very common.

Cheers,
Scott