[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Clamav license issue affecting etch

Hi all,

It has recently come to my attention that clamav in etch contains code
that is effectively a port of the unrar-nonfree code base.  This code is
obviously not GPL compatible, and so it looks to me like we are
currently distributing something that we don't have permission to

While it was probably foolish of upstream to do this port and bundle,
and definitely foolish of me not to catch this earlier, I'd rather focus
this discussion on where to go now.

The code is not easily cuttable, as it's intermixed with the rest of the
library.  If someone wants to try removing it all in a clean way,
that's probably the simplest solution, but my first tries have just
gotten me to FTBFS rather quickly.  Probably this could be solved by
replacing all the rar functions with 'return CL_UNKNOWN;' or some other
hack, but I'm not sure I love that solution either.

Other options I see are:
a) removal from the archive 
   not a great solution, since other packages rdepend on it
b) pushing a new version in 
   also not a great solution, since the new release of clamav that does 
   allow for easy cutting of the unrar code also comes with a soname
   transition.  I doubt anyone will be happy with a library transition
   in a stable release.

Suggestions?  Help?
|   ,''`.                                            Stephen Gran |
|  : :' :                                        sgran@debian.org |
|  `. `'                        Debian user, admin, and developer |
|    `-                                     http://www.debian.org |

Attachment: signature.asc
Description: Digital signature

Reply to: