Re: How to properly handle contradicting licenses in a single file (aclocal.m4)

--=-=-=
Content-Type: text/plain; charset=iso-8859-1
Content-Transfer-Encoding: quoted-printable

Marc Haber <[email protected]> writes:

> Hi,
>
> aclocal.m4 is obviously built by autotools by concatting segments that
> might have contradicting licenses.

Two answers:

1) Did you consider rebuilding aclocal.m4 from source, and therefor use
upstream source code either directly from git (assuming they don't store
aclocal.m4 in git, which is the norm) or by removing that file from
Debian's source code through Files-Excluded?  At least manually verify
that aclocal.m4 can be rebuilt at all (sometimes upstream forgot to
include all necessary *.m4 files or use outdated versions).

2) If I find conflicting licenses in the same file, and if the scope for
each license statements isn't clear, I ask upstream to clarify what the
intention is.  In the case of aclocal.m4, I think the intent is normally
clear since we know how the file is normally built (which needs to be
confirmed, either manually or mechanically by re-generating it) by
concatenating other files: each license text in the file corresponds to
the snippet it is associated with.  In this case, I would a 'License:
FSFUL and GPLv2+ and GPLv3+' and add a Comment: explaining the
situation.  But I would try to avoid writing debian/copyright lines for
generated non-source content first.

I recently ended up in case 2) for aclocal.m4 from 'sigsum-c' because
upstream does not use automake to generate the file, and they even
modified the original upstream *.m4 source snippets before including in
aclocal.m4, before putting the code into aclocal.m4.  So rebuilding the
file from real source wasn't an option, their aclocal.m4 was the real
source.  I now realize I did not follow my own suggestion to use a
Comment to explain this, probably because I discussed back and forth
with upstream and though the resulting situation would be clear and low
risk for Debian -- suggested improvements to d/copyright for a situation
like this is most welcome.

https://salsa.debian.org/debian/sigsum-c/-/blob/debian/latest/debian/copyri=
ght

https://salsa.debian.org/debian/sigsum-c/-/blob/debian/latest/aclocal.m4

https://git.glasklar.is/sigsum/core/sigsum-c/-/merge_requests/31

/Simon

> For example, the aclocal.m4 of the aide package has AT LEAST the
> following copyright statements in different points of the SAME file:
>
> -----
> # Copyright (C) 1996-2025 Free Software Foundation, Inc.
>
> # This file is free software; the Free Software Foundation
> # gives unlimited permission to copy and/or distribute it,
> # with or without modifications, as long as this notice is preserved.
>
> # This program is distributed in the hope that it will be useful,
> # but WITHOUT ANY WARRANTY, to the extent permitted by law; without
> # even the implied warranty of MERCHANTABILITY or FITNESS FOR A
> # PARTICULAR PURPOSE.
> -----
> #   Copyright (c) 2008 Steven G. Johnson <[email protected]>
> #   Copyright (c) 2011 Daniel Richard G. <[email protected]>
> #   Copyright (c) 2019 Marc Stevens <[email protected]>
> #
> #   This program is free software: you can redistribute it and/or modify =
it
> #   under the terms of the GNU General Public License as published by the
> #   Free Software Foundation, either version 3 of the License, or (at your
> #   option) any later version.
> #
> #   This program is distributed in the hope that it will be useful, but
> #   WITHOUT ANY WARRANTY; without even the implied warranty of
> #   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Gene=
ral
> #   Public License for more details.
> -----
> dnl Copyright =A9 2004 Scott James Remnant <[email protected]>.
> dnl Copyright =A9 2012-2015 Dan Nicholson <[email protected]>
> dnl
> dnl This program is free software; you can redistribute it and/or modify
> dnl it under the terms of the GNU General Public License as published by
> dnl the Free Software Foundation; either version 2 of the License, or
> dnl (at your option) any later version.
> dnl
> dnl This program is distributed in the hope that it will be useful, but
> dnl WITHOUT ANY WARRANTY; without even the implied warranty of
> dnl MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
> dnl General Public License for more details.
> -----
>
> What is the way to write this in debian/copyright?
>
> Greetings
> Marc
>

--=-=-=
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQNoBAEWCgMQFiEEo8ychwudMQq61M8vUXIrCP5HRaIFAmogGJAUHHNpbW9uQGpv
c2Vmc3Nvbi5vcmfCHCYAmDMEXJLOtBYJKwYBBAHaRw8BAQdACIcrZIvhrxDBkK9f
V+QlTmXxo2naObDuGtw58YaxlOu0JVNpbW9uIEpvc2Vmc3NvbiA8c2ltb25Aam9z
ZWZzc29uLm9yZz6IlgQTFggAPgIbAwULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgBYh
BLHSvRN1vst4TPT4xNc89jjFPAa+BQJp4fWRBQkOa+rdAAoJENc89jjFPAa+hWIA
/1lQvrJeGlQq50lP6tm99D1zDy7J1tQ3ha4x0Jx7rkFTAP9hpUKuTvm6m1fXyiZV
YZlu2+Id/Dq3CIAZvNF+XEr2BLgzBFySz4EWCSsGAQQB2kcPAQEHQOxTCIOaeXAx
I2hIX4HK9bQTpNVei708oNr1Klm8qCGKiPUEGBYIACYCGwIWIQSx0r0Tdb7LeEz0
+MTXPPY4xTwGvgUCaeCW1wUJDmqLVgCBdiAEGRYIAB0WIQSjzJyHC50xCrrUzy9R
cisI/kdFogUCXJLPgQAKCRBRcisI/kdFoqdMAQCgH45aseZgIrwKOvUOA9QfsmeE
8GZHYNuFHmM9FEQS6AD6A4x5aYvoY6lo98pgtw2HPDhmcCXFItjXCrV4A0GmJA4J
ENc89jjFPAa+s7AA+gIIHpBApDpcDj1sKhzDngmpvwQf0VkHme6s+EG7qSgpAQDe
/XMrU0c0Pa3ji85cMqZhvzJOFI/soe662lzL0QY3Bbg4BFySz2oSCisGAQQBl1UB
BQEBB0AxlRumDW6nZY7A+VCfek9VpEx6PJmdJyYPt3lNHMd6HAMBCAeIfgQYFggA
JgIbDBYhBLHSvRN1vst4TPT4xNc89jjFPAa+BQJp4JbXBQkOaottAAoJENc89jjF
PAa+RNUA/2faQO/nFT06E+MlhlQdo/0chlQXC5TZMPTVvVBFwoLOAP9xLJK0ow5E
jTzYJB4K810AL/Iv6PEOAEgA4cPTHVlbCQAKCRBRcisI/kdFovcwAP4hhZD4SC7P
c7C092wVelROerCL/aHrAkBycRjzTHWCOAEAk8UhdaZ8Rz/PyefhSk1+AeYbGn8+
B7A7X/FbnICemQ8=
=LWWo
-----END PGP SIGNATURE-----
--=-=-=--