FS#69882 - [deepin-wallpapers][deepin-community-wallpapers]: incorrect license
Attached to Project:
Community Packages
Opened by bill-auger (bill-auger) - Friday, 05 March 2021, 07:59 GMT
Last edited by Buggy McBugFace (bugbot) - Saturday, 25 November 2023, 20:09 GMT
Opened by bill-auger (bill-auger) - Friday, 05 March 2021, 07:59 GMT
Last edited by Buggy McBugFace (bugbot) - Saturday, 25 November 2023, 20:09 GMT
|
Details
the README for the the arch package version (1.7.7), does
not mention any licenses; but there is a GPL license file
included - a GPL license file is meaningless on it's own; so
these images should have been considered to be no-license
the README for the current release (1.7.8) clarifies this, stating that the license for the 'deepin-wallpapers' package should be CC-BY-NC 3.0; and CC-BY-SA 3.0 for the 'deepin-community-wallpapers' package https://github.com/linuxdeepin/deepin-wallpapers/blob/master/README.md the README explains that the GPL covers the source code files; but there is no source code in that repository, other than the debian packaging litter and the trivial commands in the Makefile, which the arch packages exclude anyways |
This task depends upon
Closed by Buggy McBugFace (bugbot)
Saturday, 25 November 2023, 20:09 GMT
Reason for closing: Moved
Additional comments about closing: https://gitlab.archlinux.org/archlinux/p ackaging/packages/deepin-wallpapers/issu es/1
Saturday, 25 November 2023, 20:09 GMT
Reason for closing: Moved
Additional comments about closing: https://gitlab.archlinux.org/archlinux/p ackaging/packages/deepin-wallpapers/issu es/1
i understand the desire to cleanup old stale tickets, needing information from the OP, which was never provided; but that is not the case with this one - the relevant "no response", was that of the package maintainers; but surely that is not a valid reason to close this ticket - it is cause for more concern actually - if the package maintainers can not answer that question ("what is the license of those files?"), then the issue is not resolved - in fact, the package should be pulled, until that legal question has a satisfying answer - that is what we did, two years ago
if the package maintainers have not responded after two years, at least to acknowledge the bug report, then arch has a different, more severe problem, namely: maintainers overlooking unlicensed files or declaring licenses incorrectly, and then failing to respond when questioned about it - discrepancies are understandable (we all make mistakes); but to ignore bug reports against your package, with no acknowledgement, is not
thanks for re-opening - i will look into this again; because as a downstream, it is also our problem
from the the .reuse/dep5 file:
Files: README.md README.zh_CN.md CHANGELOG.md
License: CC-BY-4.0
Files: Makefile blur_image.sh
License: GPL-3.0-or-later
Files: .github/* .obs/workflows.yml
License: CC0-1.0
Files: debian/* rpm/* archlinux/*
License: CC0-1.0
Files: deepin/*.jpg
CC-BY-3.0
the upstream VCS also has in it, packaging recipes for arch and debian - the upstream PKGBUILD, like the arch PKGBUILD, declares 'GPL', which is incorrect - 'GPL' indicates the 'GPLv2-or-later' license, per arch policy - if the README is taken to be canonical, the PKGBUILD license should be 'GPL3' - if the .reuse/dep5 file is taken to be as canonical, there are several licenses to account for in the PKGBUILD, depending on which files arch actually distributes - in any case, none of those justifies the 'GPL' in the current PKGBUILD - the only license file which was ever in that VCS, was a stray/orphan GPLv3, which was arguably invalid anyways, until very recently
the debian/copyright file does not mention any upstream license, as it should - it is apparently declaring 'CC-zero' on the debian packaging files themselves, which is not the purpose of that file; so no help there either
as the most recent changes were to the .reuse/dep5 file, and it appears to be comprehensive, i would be satisfied to take that file as the canonical license declaration - it does effectively close this ticket (as Toolybird correctly assumed); but only if and when the arch package is upgraded to include that file - currently, the arch packaging does not account for _any_ of the licenses declared upstream - therefore this ticket is still relevant, and no progress has been made in arch, although the package was rebuilt a few weeks ago
all of the above was WRT the 'deepin-wallpapers' package - the 'deepin-community-wallpapers' package is another issue - the upstream has apparently moved all of those images into a new separate repo, denoting them as "non-free"[2][3] - i did not investigate those; but this does suggest strongly, that the images in the existing arch package(s) were never licensed under any version of the GPL
[1]: https://github.com/linuxdeepin/deepin-wallpapers/commit/31091de668f10a5580232859f5271449843a4519#diff-b335630551682c19a781afebcf4d07bf978fb1f8ac04c6bf87428ed5106870f5
[2]: https://github.com/linuxdeepin/deepin-wallpapers/pull/19/files
[3]: https://github.com/linuxdeepin/deepin-wallpapers/commit/4602006574c9b3b737f352f981b08a26208dab5a
this is probably none of my business, but although the upstream clarified the licensing, i still would not close this ticket yet - for two reasons:
1) the current the arch package licensing is still incorrect
2) the package maintainers have yet to even acknowledge the existence of this ticket
at the least, i would try to contact them on some other channel(s), to ensure that they are indeed aware of this ticket, before closing it
myself, i would not close the ticket until the problem is actually fixed in the binary repos; though arch often does that