[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

ipv6calc: IP address assignments as source code

Hi debian-legal,

I'm planning to adopt the ipv6calc package, a small utility for
manipulating IPv6 addresses. It can do address format conversions and
report information about the address. For the latter functionality,
it contains listings of IPv6, IPv4, and Ethernet address assignments
collected from various sources. These pose a problem I'd like some
input on.

The program is licensed under GPLv2. The address listings are distributed
in the upstream [0] tarball as C header files with an (optional) Makefile
target that regenerates them. The regeneration is done by downloading
the original public address lists from all the RIRs (Regional Internet
Registries, ie. ARIN, RIPE, APNIC etc.), IANA, and IEEE and converting
them with some perl magic.

The original address assignment listings mostly don't have any copyright
or licensing information. See the end of this mail for details.

The ipv6calc upstream tarball database directory contains a README saying:

 Because of unknown license issues, the database files aren't
 included in source tarball (cleanup by "make distclean"), but
 will be retrieved on "make"

Thus my understanding is that 

1. The C header files containing the address assignments in the tarball
   are not source code in the GPL sense, ie. 'the preferred form of the
   work for making modifications'. This means that we're technically
   violating the GPL distributing the ipv6calc package in its current form.

2. We're also of course violating the Social Contract by distributing
   software without full source.

2. We don't know if all of the real source code for the address listings
   is distributable at all.

3. Even if all of it is distributable, if some part of it is under a
   GPL-incompatible license, the end result is undistributable
   without a license exemption.

Unless somebody tells me I'm wrong somewhere, I'm about to file a
serious bug on the current ipv6calc package because of this.

Now, here are the options I can think of to fix that bug:

1. Drop ipv6calc from Debian completely

2. Repack the source tarball and replace the address assignment database 
   information with a stub like "NOT-AVAILABLE".

   2.1 Move the database functions (without the data) into a separate
       "plugin" library that is used by ipv6calc only if it's
       installed. Put that into contrib. Make the users download the
       data themselves, preferably with help of an installer script.

3. Get explicit copyright and licensing statements from IANA, all the RIRs
   and IEEE. (seems unlikely) If all the licensing statements are
   GPL-compatible (even more unlikely), be happy.

   3.1 If all of the licensing statements are DFSG-free but some are not
       GPL-compatible, just get a license exemption from the ipv6calc
       upstream author.

   3.2 If some the licensing statements are not DFSG-free, but all are
       distributable, make the databases a separate library in non-free
       and move ipv6calc into contrib. Still need a license exemption
       from the upstream author.

   3.3 Alternative to 3.2: make the databases a separate "plugin"
       library in non-free and use it in ipv6calc only if it's installed.
       Maybe need a license exemption (?)

As the address database functions are only a part of the ipv6calc
functionality, I assume that in 2.1 or 3.3 the rest of ipv6calc could
stay in main. Please correct me if I'm wrong.

Realistically, I think 2.1 is the way to go. I don't think it's worth
it unless the changes get integrated upstream, though.  I'm not very
optimistic about 3, and prefer 2.1 over 3.2 or 3.3.

I have not discussed this with the upstream author yet, as I wanted to
'check my facts' here first. I'd appreciate if somebody could tell me
if my reasoning is correct or not. Any possible options I have missed
would be welcome :)

Last, some detailed info on the database licenses.

For the IEEE case [1], I suppose the only licensing info available is at
[2], which grants personal use but forbids distribution.

For IANA, the data actually is already in Debian main, in the doc-iana
package.  The e-mail correspondence found in the doc-iana debian/copyright
file [3] indicates that the "rfc-copyright-story" document [4] applies
to all IANA documents.  This looks DFSG-free to me, but I'm not sure if
the information is still current.

For APNIC, the README.txt on the web site [5] states:

 The files are freely available for download and use on the condition 
 that APNIC will not be held responsible for any loss or damage 
 arising from the use of the information contained in these reports.

which would seem OK for non-free (but not DFSG-free or GPL-compatible
as such, as there's nothing about modification).

For the rest of the RIRs [6,7,8,9] the best I have found is 'All rights
reserved' on their web sites.

[0] http://www.deepspace6.net/projects/ipv6calc.html
[1] http://standards.ieee.org/regauth/oui/
[2] http://standards.ieee.org/c.html
[3] http://packages.debian.org/changelogs/pool/main/d/doc-iana/doc-iana_20060423-1/copyright
[4] http://www.faqs.org/rfc/rfc-editor/rfc-copyright-story
[5] http://ftp.apnic.net/stats/apnic/README.TXT
[6] ftp://ftp.ripe.net/ripe/stats/
[7] ftp://ftp.arin.net/pub/stats/arin/
[8] ftp://lacnic.net/pub/stats/lacnic/
[9] ftp://ftp.afrinic.net/pub/stats/afrinic/

(Oh my, this all now seems way overkill for such a little package.
 But since I started... :)

Niko Tyni	ntyni@iki.fi

Reply to: