Re: ansible-runner: guidance requested on possible Apache-2.0/GPL-3.0 incompatibility

Soren Stoutner <[email protected]> Sat, 14 Mar 2026 11:05:24 -0700
Newsgroups	gmane.linux.debian.devel.legal
Organization	Debian
Message-ID	<3717875.NG923GbCHz@soren-desktop>
On Saturday, March 14, 2026 3:15:31 AM Mountain Standard Time Sakirnth 
Nagarasa wrote:
> Hello
> 
> While reviewing ansible-runner for the new version I noticed that the
> file src/ansible_runner/display_callback/callback/awx_display.py and the
> directory
> test/fixtures/projects/collection_role/collections/ansible_collections/
groovy
> are licensed under GPL-3.0-or-later, while the project is licensed with
> Apache-2.0.
> 
> These files were therefore removed from the source package. However this
> breaks the package and I forwarded the bug them to consider to
> re-license [1]. The upstream already consulted internally and responded
> that there is no licensing incompatibility problem [2].
> 
> Their argument is that the GPL file in question is not actually used by
> the project code. According to them this means the file is a "aggregate"
> under GPLv3, and that distributing it alongside Apache-2.0 code in the
> same repository is fine.
> 
> Would it be acceptable for Debian to ship these GPL-3.0-or-later files
> inside an otherwise Apache-2.0 project if they are not used by the main
> code? Can this be considered a aggregation when everything is
> distributed in the same source package and in binary package?
> 
> Any guidance would be appreciated.
> 
> [1] https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1130233
> [2]
> https://github.com/ansible/ansible-runner/issues/
1217#issuecomment-1505601824

Based on the fact that removing these files causes all functionality to break, 
that would indicate that the file in question *is* used by the project code 
and is not an "aggregate work”.  “Aggregate work” are two separate projects 
that don’t interact with each other but are distributed on the same media.  An 
example would be a Debian installation disk that includes all of the Debian 
packages.  Just because one package is GPL-3+, that doesn’t prevent other 
packages from being Apache-2.0 because *they don’t depend or interact with 
each other*.

However, it is perfectly acceptable to combine Apache-2.0 code with GPL-3+ 
into one project.  When doing so, the license of the combined work is GPL-3+.

If it were me I would simply add a comment to the main “Files: *” stanza in 
debian/copyright stating that because the project incorporates GPL-3+ code, 
the package as a whole is distributed under the GPL-3+, making it explicit to 
users what they are getting.

I would also pass this information along to the upstream project.  They don’t 
need to relicense their code.  Other people are free to copy or modify the 
Apache-2.0 portion of their code under the Apache-2.0 if they like.  But the 
upstream project should probably be explicit about the fact that if users take 
advantage of the project as a whole as it is currently distributed, the 
effective license is GPL-3+.

-- 
Soren Stoutner
[email protected]
signature.asc (application/pgp-signature, 833 B)