Bug#1029055: lintian: Lintian does not recognize the AppStream's metainfo.xml MIT license is the same as Debian's Expat license
Package: lintian
Version: 2.115.3
Severity: wishlist
Debian has recently started requesting that graphical programs install AppStream metainfo.xml files.
https://appstream.debian.org/sid/main/issues/electrum.html
The AppStream specification has a very restricted listed of possible licenses for the metainfo.xml file.
FSFAP
MIT
0BSD
CC0-1.0
CC-BY-3.0
CC-BY-4.0
CC-BY-SA-3.0
CC-BY-SA-4.0
GFDL-1.1
GFDL-1.2
GFDL-1.3
BSL-1.0
FTL
FSFUL
https://www.freedesktop.org/software/appstream/docs/chap-Metadata.html#tag-metadata_license
No specific text is given for what they mean by the MIT license. The MIT license is a bit problematic because there are more than one license that has been called the MIT license over the years.
https://en.wikipedia.org/wiki/MIT_License#Ambiguity_and_variants
https://www.gnu.org/licenses/license-list.en.html#Expat
When most people say MIT they mean Expat, so it is standard in the industry to assume that when no specific text is given MIT == Expat.
Debian prefers the Expat name to the MIT name for this reason.
https://www.debian.org/legal/licenses/mit
The documentation for the Debian machine-readable copyright file says the following.
"There are many versions of the MIT license. Please use Expat instead, when it matches."
https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/#license-short-name
The Electrum package, which is licensed upstream as MIT, is listed as Expat in debian/copyright according to the instructions in the copyright format and because the upstream MIT license matches exactly the Debian legal Expat example.
Because the AppStream metainfo.xml file does not allow the use of the Expat name, or it will fail validation with appstreamcli, I licensed the metainfo.xml file as MIT. This made it easy to submit it upstream, which has already accepted it for the next release.
In the meantime, I included the metadata.xml file in the debian directory for the current release. However, Lintian complained that Expat != MIT.
I considered creating a override, but according to the instruction at https://lintian.debian.org/manual/index.html#overrides it seemed more appropriate to file a bug against Lintian, as every time there is an AppStream file with a MIT license this will create a false positive if matched against Expat.
To work around this, I currently created a duplicate section in debian/copyright, which doesn't seem like an efficient long-term solution.
https://salsa.debian.org/sorenstoutner/electrum/-/blob/master/debian/copyright
I personally wish that those creating licenses had been more careful about the naming thereof. Secondarily, I wish that AppStream had followed best practices and allowed the use of the Expat name. However, given that neither of those things are within my control, the next best option is to make Lintian smart enough to work around this specific situation.
This was originally discussed at https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1002053 but was moved to this separate bug report because it didn't end up being the same root problem.
Reply to: