FS#69882 - [deepin-wallpapers][deepin-community-wallpapers]: incorrect license

Attached to Project: Community Packages
Opened by bill-auger (bill-auger) - Friday, 05 March 2021, 07:59 GMT
Last edited by Buggy McBugFace (bugbot) - Saturday, 25 November 2023, 20:09 GMT
Task Type General Gripe
Category Packages
Status Closed
Assigned To Felix Yan (felixonmars)
Filipe Laíns (FFY00)
Architecture All
Severity Low
Priority Normal
Reported Version
Due in Version Undecided
Due Date Undecided
Percent Complete 100%
Votes 0
Private No

Details

the README for the the arch package version (1.7.7), does not mention any licenses; but there is a GPL license file included - a GPL license file is meaningless on it's own; so these images should have been considered to be no-license

the README for the current release (1.7.8) clarifies this, stating that the license for the 'deepin-wallpapers' package should be CC-BY-NC 3.0; and CC-BY-SA 3.0 for the 'deepin-community-wallpapers' package

https://github.com/linuxdeepin/deepin-wallpapers/blob/master/README.md

the README explains that the GPL covers the source code files; but there is no source code in that repository, other than the debian packaging litter and the trivial commands in the Makefile, which the arch packages exclude anyways

This task depends upon

Closed by  Buggy McBugFace (bugbot)
Saturday, 25 November 2023, 20:09 GMT
Reason for closing:  Moved
Additional comments about closing:  https://gitlab.archlinux.org/archlinux/p ackaging/packages/deepin-wallpapers/issu es/1
Comment by Toolybird (Toolybird) - Tuesday, 02 May 2023, 08:15 GMT
Upstream have apparently changed the license since this ticket was created. Where does it stand now and do we need to do anything?
Comment by bill-auger (bill-auger) - Friday, 02 June 2023, 06:19 GMT
  • Field changed: Percent Complete (100% → 0%)
the problem still exists and the package maintainers never addressed the issue, nor even so much as responded to the BR - to close this ticket now, is only to ignore the problem - please re-open - i will do the research
Comment by bill-auger (bill-auger) - Friday, 02 June 2023, 06:27 GMT
thanks, i dont believe that "no response" was a valid reason to close this ticket - if the expected response was from me, i apologize - i dont remember getting notice of the previous comment, only the recent closing event - but this ticket does not require any additional information from the OP - the issue here is purely objective, namely: "what is the license of those files?" - there is nothing more that i could add, without doing the research which was the packager's responsibility in the first place

i understand the desire to cleanup old stale tickets, needing information from the OP, which was never provided; but that is not the case with this one - the relevant "no response", was that of the package maintainers; but surely that is not a valid reason to close this ticket - it is cause for more concern actually - if the package maintainers can not answer that question ("what is the license of those files?"), then the issue is not resolved - in fact, the package should be pulled, until that legal question has a satisfying answer - that is what we did, two years ago

if the package maintainers have not responded after two years, at least to acknowledge the bug report, then arch has a different, more severe problem, namely: maintainers overlooking unlicensed files or declaring licenses incorrectly, and then failing to respond when questioned about it - discrepancies are understandable (we all make mistakes); but to ignore bug reports against your package, with no acknowledgement, is not

thanks for re-opening - i will look into this again; because as a downstream, it is also our problem
Comment by bill-auger (bill-auger) - Friday, 02 June 2023, 06:38 GMT
ok, to answer the "where does this stand now?" and "do we need to do anything?" questions - just recently, several CC licenses were added to the LICENSES/ directory; and a licensing metadata file: .reuse/dep5 was added[1] - however, the README still explicitly states that the entire project is 'GPLv3-or-later', contrary to the new 'reuse' file - the upstream is still rather confusing (or themselves confused) about the licensing - the wallpaper images themselves are now denoted as 'CC-BY-3.0'

from the the .reuse/dep5 file:

Files: README.md README.zh_CN.md CHANGELOG.md
License: CC-BY-4.0

Files: Makefile blur_image.sh
License: GPL-3.0-or-later

Files: .github/* .obs/workflows.yml
License: CC0-1.0

Files: debian/* rpm/* archlinux/*
License: CC0-1.0

Files: deepin/*.jpg
CC-BY-3.0

the upstream VCS also has in it, packaging recipes for arch and debian - the upstream PKGBUILD, like the arch PKGBUILD, declares 'GPL', which is incorrect - 'GPL' indicates the 'GPLv2-or-later' license, per arch policy - if the README is taken to be canonical, the PKGBUILD license should be 'GPL3' - if the .reuse/dep5 file is taken to be as canonical, there are several licenses to account for in the PKGBUILD, depending on which files arch actually distributes - in any case, none of those justifies the 'GPL' in the current PKGBUILD - the only license file which was ever in that VCS, was a stray/orphan GPLv3, which was arguably invalid anyways, until very recently

the debian/copyright file does not mention any upstream license, as it should - it is apparently declaring 'CC-zero' on the debian packaging files themselves, which is not the purpose of that file; so no help there either

as the most recent changes were to the .reuse/dep5 file, and it appears to be comprehensive, i would be satisfied to take that file as the canonical license declaration - it does effectively close this ticket (as Toolybird correctly assumed); but only if and when the arch package is upgraded to include that file - currently, the arch packaging does not account for _any_ of the licenses declared upstream - therefore this ticket is still relevant, and no progress has been made in arch, although the package was rebuilt a few weeks ago

all of the above was WRT the 'deepin-wallpapers' package - the 'deepin-community-wallpapers' package is another issue - the upstream has apparently moved all of those images into a new separate repo, denoting them as "non-free"[2][3] - i did not investigate those; but this does suggest strongly, that the images in the existing arch package(s) were never licensed under any version of the GPL


[1]: https://github.com/linuxdeepin/deepin-wallpapers/commit/31091de668f10a5580232859f5271449843a4519#diff-b335630551682c19a781afebcf4d07bf978fb1f8ac04c6bf87428ed5106870f5
[2]: https://github.com/linuxdeepin/deepin-wallpapers/pull/19/files
[3]: https://github.com/linuxdeepin/deepin-wallpapers/commit/4602006574c9b3b737f352f981b08a26208dab5a
Comment by bill-auger (bill-auger) - Friday, 02 June 2023, 08:16 GMT
i asked the upstream to clarify the README https://github.com/linuxdeepin/developer-center/issues/4617
Comment by bill-auger (bill-auger) - Tuesday, 27 June 2023, 16:11 GMT
the upstream has clarified the licensing - the VCS is still a mixed bag, but the GPL is now clearly _not_ the license of any images - the images are all CC-BY-4.0 now - i suppose that should be the PKGBUILD license for the next release

Comment by bill-auger (bill-auger) - Tuesday, 27 June 2023, 16:27 GMT
just a note to patrollers (eg: Toolybird)

this is probably none of my business, but although the upstream clarified the licensing, i still would not close this ticket yet - for two reasons:

1) the current the arch package licensing is still incorrect
2) the package maintainers have yet to even acknowledge the existence of this ticket

at the least, i would try to contact them on some other channel(s), to ensure that they are indeed aware of this ticket, before closing it

myself, i would not close the ticket until the problem is actually fixed in the binary repos; though arch often does that
Comment by Buggy McBugFace (bugbot) - Tuesday, 08 August 2023, 19:11 GMT
This is an automated comment as this bug is open for more then 2 years. Please reply if you still experience this bug otherwise this issue will be closed after 1 month.

Loading...