Bug#566220: [PATCH] Clarify "verbatim copy of its copyright and distribution license"

[Jonathan Nieder <jrnieder@gmail.com>]

Hi,

Just wanted to clarify a few points from your message, out of order.
No patch is attached to this message.  I will probably download the
policy sources and write one soon, if no one beats me to it.

First a point you made towards the end:

Steve M. Robbins wrote:
> On Mon, Feb 01, 2010 at 11:50:25AM -0800, Russ Allbery wrote:

>> I think this is a better wording for the existing situation.  However...
[One would still, by what Policy has historically said, need to find
and accumulate the copyright notices if upstream hasn't already done
that.]

> I was under the impression that Policy is more descriptive (of
> existing practices) than prescriptive.  For example, I believe that
> archive-wide changes generally must achieve consensus by having the
> changes done, tested, etc, before being enshrined in policy.

I think your impression is mistaken here.  Part of making good policy
involves allowing for the kind of experimentation you talk about
where possible.  Still, the policy is AFAICT meant to be prescriptive,
and making changes within Debian that are forbidden by policy without
changing the policy is considered a serious bug.  

Just because many copyright files, package descriptions, and
debian/control files are inadequate (and they are!) does not mean that
the policy should not require otherwise.

> Agreed.  The license for using and distributing the files in the
> BINARY package is useful and necessary.

I don’t think the distinction you imply has precedent in Debian.

Including authorship information in debian/copyright for source
packages is IMHO useful to distributors and a matter of basic respect
to the authors.

> But I can't imagine that many
> binary package users would need the hundreds of copyright statements
> from multi-author works like the kernel, gcc, libc, etc.  A summary
> should be fine and for those who really want the details the source
> package exists.

GCC, though a multi-author work, has only one copyright holder AFAIK.
glibc has very few.

Just to be clear, I would like to emphasize that I do not think a
summary of the license information is fine at all.  On the other hand,
as you say, summary information about the copyright holders seems
appropriate, but it is not part of the scope of this bug, which is
about clarifying that the current policy really does require copyright
information in the debian/copyright file.

> In this light, I don't understand the motivation for "clarifying"
> the policy to something that manifestly we're not following.
>
> I'd suggest instead to clarify to the current policy on the ground.

A change that explains such points as:

 - Copyright information for the license documents themselves can be
   omitted;
 - Similarly, copyright and license information for autotools-
   generated files is generally not included;
 - Copyright notices are generally not copied verbatim: the copyright
   symbol is often changed, multiple notices combined and the years
   sorted into a single list, and so on.
 - Copyright for files written as part of a large multi-author work
   is often summarized by “Copyright © <dates>, <original author> and
   many others”.

would be welcome, but I do not think it is in scope for this bug.
Instead, first let’s make it clear that

 1. Copyright information in debian/copyright _is_ currently required
    by policy.
 2. Verbatim copies of all copyright notices are not.

That done, we would be better prepared to discuss larger changes...

Let me consider again the other multi-author example.  I mentioned
before that the current linux-2.6 copyright file is inadequate.  The
upstream COPYING file says:

   NOTE! This copyright does *not* cover user programs that use kernel
 services by normal system calls - this is merely considered normal use
 of the kernel, and does *not* fall under the heading of "derived work".
 Also note that the GPL below is copyrighted by the Free Software
 Foundation, but the instance of code that it refers to (the Linux
 kernel) is copyrighted by me and others who actually wrote it.

and goes on to explain that Linux can be distributed under the terms
of the GPL, version 2.  One could summarize this by:

   Copyright:

      Copyright © 1991-2010 Linus Torvalds
      and many others

   License:

      This package is free software; you can redistribute it and/or modify
      it under the terms of the GNU General Public License version 2 as
      published by the Free Software Foundation.

plus further information about where to find the GPL-2 on Debian
systems, and maybe a note about the lack of warranty.

And yes, those who really want full details can look at the source.

But there is a problem: that license does not actually apply to the
entire kernel source:

 - some files use some other license (GPL-2+, LGPL, BSD-like licenses,
   X11-style licenses, GFDL)

 - some files upstream used licenses not acceptable for Debian and have
   been removed from the repacked source package

To write a useful copyright file, the package maintainers really would
need to look over the copyright notices throughout the kernel.  A
naive summary is not enough.  On the other hand, dumping the output of
“git grep '[Cc]opyright|MODULE_LICENSE'” into debian/copyright would
benefit no one.  So what should they do?

Jonathan