Re: Upstream GPL-3+ vs debian/* GPL-2+
On 22/08/14 14:25, Eriberto Mota wrote:
> So, I am thinking that is because Debian
> distributes, separately, the upstream code (orig.tar.gz) and
> debian.tar.xz. Is this? But, the .deb is a product of the junction of
> these files. So, I am confused. Can you clarify me this issue?
The key thing here is that each copyright holder can give you permission
to do things that would normally infringe their copyright, but they
cannot give you permission to do things that would normally infringe
someone else's copyright.
The upstream source code is a copyright-covered work owned by the
upstream developers[1]. They have given permission to copy it under some
license, in this case GPL-3+.
The packaging is another copyright-covered work. It might be legally a
derivative of the upstream source code, or it might not, depending
what's in it and how you made it.
If the packaging is *not* a derived work of the upstream source code,
then its copyright holder is whoever did the packaging[1] and they have
given permission to copy the packaging under GPL-2+.
If it *is* a derived work of the upstream source code, then its
copyright holders are the upstream developers *and* the packager. The
upstream developers have given permission to copy "their bit" under
GPL-3+, and the packager has given permission to copy "their bit" under
GPL-2+. To copy it without copyright infringement[2], you must comply
with both licenses simultaneously. In this case that effectively means
GPL-3+, because you do not have the upstream developers' permission to
do anything with "their bit" that the GPL-2 would allow but the GPL-3+
would not. However, if you are able to extract a smaller part of the
packaging that is not derived from the upstream source - the
README.Debian written by the packager might not be a derived work, for
instance - then you can still copy that smaller part under GPL-2+.
The resulting binary (the .deb) is a third copyright-covered work,
distinct from both the upstream source code and the packaging. It is
likely to be[3] a derivative work of both the upstream source code and
the packaging, so again, both the upstream developer and the packager
have a copyright interest in it, and when you copy the .deb you must
comply with both their licenses simultaneously. In this case that
effectively means GPL-3+ again.
The fact that Debian puts the orig.tar.gz and the debian.tar.gz into
separate files is not relevant here. Whether the packaging is a
derivative work of the upstream source is a property of the content, not
the distribution mechanism: you can put them in the same file and split
that file apart again, and their legal status (whatever it was in the
first place) is not changed by that process.
S
[1] or their employer/school/university/whatever
[2] assuming that fair use / fair dealing does not already allow what
you're doing
[3] there are probably obscure situations in which the .deb somehow
manages to not be a derived work, but the safe assumption is that it is
Reply to: