Bug#1025650: ftp.debian.org: Nmap Public Source License Version 0.94 - Is it DFSG-compliant?

Sven Geuer <[email protected]> Thu, 16 Jul 2026 15:54:57 +0200

Newsgroups	gmane.linux.debian.devel.general
Message-ID	<33714c84e288432ec112d5da8e27d97df7022676.camel__27288.5198400886$1784210250$gmane$org@debian.org>

Hello DFSG Team,

as the FTP Team is not involved in DFSG compliance anymore, may I ask
you to have a look at the issue brought up below and help resolving it?

Regards,
Sven

On Tue, 6 Dec 2022 21:59:18 +0000 Samuel Henrique <[email protected]> wrote:
> Package: ftp.debian.org
> X-Debbugs-Cc: [email protected]
> Severity: serious
> Justification: Policy 2.1
> 
> Hello ftp-master team,
> 
> I'm opening this bug to request an official position of the team on
> whether the NPSL license meets the DFSG requirements or not.
> 
> There's some divergence of opinions on the matter and I think the only
> next step is to get an evaluation from the ftp-master team. FWIW I'm
> currently on the opinion that the license should be considered free
> due to its similarity with GPL2 (and copyleft licenses in general) but
> Hilko (the other maintainer) is on the side of considering it non-free
> due to a contamination issue. Sorry if I'm oversimplifying here,
> Hilko. Both mine and Hilko's points are better written in the
> references below.
> 
> Related discussions:
> Thread on d-legal:
> https://lists.debian.org/debian-legal/2022/09/msg00000.html
> Upstream discussion:
> https://github.com/nmap/nmap/issues/2199
> 
> Please consider that upstream is usually quite responsive in that
> Github issue and so we can make follow-up questions.
> 
> We need to make a decision to understand if the current nmap we are
> shipping (in all our supported releases[0]) is DFSG-free or not. This
> decision should be done ideally before the freeze so we can take any
> required actions.
> 
> Thank you,
> 
> [0] At least one issue that I've seen raised is present in all
> versions of nmap we ship (since the first iteration of NPSL), which
> would mean even our package in oldstable and stable is non-free.
> 
> -- 
> Samuel Henrique <samueloph>
> 
> 

-- 
GPG Fingerprint
3DF5 E8AA 43FC 9FDF D086 F195 ADF5 0EDA F8AD D585

signature.asc (application/pgp-signature, 854 B)