ipv6calc: IP address assignments as source code
Hi debian-legal,
I'm planning to adopt the ipv6calc package, a small utility for
manipulating IPv6 addresses. It can do address format conversions and
report information about the address. For the latter functionality,
it contains listings of IPv6, IPv4, and Ethernet address assignments
collected from various sources. These pose a problem I'd like some
input on.
The program is licensed under GPLv2. The address listings are distributed
in the upstream [0] tarball as C header files with an (optional) Makefile
target that regenerates them. The regeneration is done by downloading
the original public address lists from all the RIRs (Regional Internet
Registries, ie. ARIN, RIPE, APNIC etc.), IANA, and IEEE and converting
them with some perl magic.
The original address assignment listings mostly don't have any copyright
or licensing information. See the end of this mail for details.
The ipv6calc upstream tarball database directory contains a README saying:
Because of unknown license issues, the database files aren't
included in source tarball (cleanup by "make distclean"), but
will be retrieved on "make"
Thus my understanding is that
1. The C header files containing the address assignments in the tarball
are not source code in the GPL sense, ie. 'the preferred form of the
work for making modifications'. This means that we're technically
violating the GPL distributing the ipv6calc package in its current form.
2. We're also of course violating the Social Contract by distributing
software without full source.
2. We don't know if all of the real source code for the address listings
is distributable at all.
3. Even if all of it is distributable, if some part of it is under a
GPL-incompatible license, the end result is undistributable
without a license exemption.
Unless somebody tells me I'm wrong somewhere, I'm about to file a
serious bug on the current ipv6calc package because of this.
Now, here are the options I can think of to fix that bug:
1. Drop ipv6calc from Debian completely
2. Repack the source tarball and replace the address assignment database
information with a stub like "NOT-AVAILABLE".
2.1 Move the database functions (without the data) into a separate
"plugin" library that is used by ipv6calc only if it's
installed. Put that into contrib. Make the users download the
data themselves, preferably with help of an installer script.
3. Get explicit copyright and licensing statements from IANA, all the RIRs
and IEEE. (seems unlikely) If all the licensing statements are
GPL-compatible (even more unlikely), be happy.
3.1 If all of the licensing statements are DFSG-free but some are not
GPL-compatible, just get a license exemption from the ipv6calc
upstream author.
3.2 If some the licensing statements are not DFSG-free, but all are
distributable, make the databases a separate library in non-free
and move ipv6calc into contrib. Still need a license exemption
from the upstream author.
3.3 Alternative to 3.2: make the databases a separate "plugin"
library in non-free and use it in ipv6calc only if it's installed.
Maybe need a license exemption (?)
As the address database functions are only a part of the ipv6calc
functionality, I assume that in 2.1 or 3.3 the rest of ipv6calc could
stay in main. Please correct me if I'm wrong.
Realistically, I think 2.1 is the way to go. I don't think it's worth
it unless the changes get integrated upstream, though. I'm not very
optimistic about 3, and prefer 2.1 over 3.2 or 3.3.
I have not discussed this with the upstream author yet, as I wanted to
'check my facts' here first. I'd appreciate if somebody could tell me
if my reasoning is correct or not. Any possible options I have missed
would be welcome :)
Last, some detailed info on the database licenses.
For the IEEE case [1], I suppose the only licensing info available is at
[2], which grants personal use but forbids distribution.
For IANA, the data actually is already in Debian main, in the doc-iana
package. The e-mail correspondence found in the doc-iana debian/copyright
file [3] indicates that the "rfc-copyright-story" document [4] applies
to all IANA documents. This looks DFSG-free to me, but I'm not sure if
the information is still current.
For APNIC, the README.txt on the web site [5] states:
The files are freely available for download and use on the condition
that APNIC will not be held responsible for any loss or damage
arising from the use of the information contained in these reports.
which would seem OK for non-free (but not DFSG-free or GPL-compatible
as such, as there's nothing about modification).
For the rest of the RIRs [6,7,8,9] the best I have found is 'All rights
reserved' on their web sites.
[0] http://www.deepspace6.net/projects/ipv6calc.html
[1] http://standards.ieee.org/regauth/oui/
[2] http://standards.ieee.org/c.html
[3] http://packages.debian.org/changelogs/pool/main/d/doc-iana/doc-iana_20060423-1/copyright
[4] http://www.faqs.org/rfc/rfc-editor/rfc-copyright-story
[5] http://ftp.apnic.net/stats/apnic/README.TXT
[6] ftp://ftp.ripe.net/ripe/stats/
[7] ftp://ftp.arin.net/pub/stats/arin/
[8] ftp://lacnic.net/pub/stats/lacnic/
[9] ftp://ftp.afrinic.net/pub/stats/afrinic/
(Oh my, this all now seems way overkill for such a little package.
But since I started... :)
Cheers,
--
Niko Tyni ntyni@iki.fi
Reply to: