Re: How to properly handle contradicting licenses in a single file (aclocal.m4)

--=-=-=
Content-Type: text/plain

Daniel Hakimi <[email protected]> writes:

> This generally shouldn't come up that often

Do you have some metrics on that?

I believe the example with aclocal.m4 comes up VERY often.  It is just
that most maintainers ignore the license complexity of build-system
files like that , and we've collectively turned a blind eye towards it,
even encoding that practice into some policies.

Ignoring the license complexity of aclocal.m4 may be a low-risk
decision, but the supply-chain vulnerability in relying in pre-built
non-source aclocal.m4 is problematic.  It is a perfect target for
xz-style attacks.

Thus, I think ignoring license complexity (or encoding that into policy)
for non-source files is a bad idea.

In most situations, the best solution is to use upstream git as the
Debian source, and make sure that upstream don't put non-source
artifacts like aclocal.m4 into git.  Then the licensing situation
becomes more clear for both maintainer and end-user.

/Simon

> , and in the tricky cases, you can always check with us.
>
> There are several charts about license compatibility online, but I
> generally wouldn't recommend any of them for legal advice, more just a
> starting point for your curiosity.
>
> The simplified way to look at it is: the first license is very permissive,
> you can do almost whatever you want with that code. The third license says
> "you can use this under the terms of the GPLv2 or later." 2 or later
> includes 3 or later. The second license is 3 or later. That's the most
> restrictive, the others allow you to use those terms instead, it's fine.
>
> There are some trickier issues -- the Apache license is permissive but its
> patent terms create minor compatibility issues with some GPL-family
> licenses--but again, this is a rare issue you usually won't need to worry
> about.
>
> Regards,
>
> Daniel J. Hakimi
> B.S. Philosophy, RPI 2012
> B.S. Computer Science, RPI 2012
> J.D. Cardozo Law 2015
>
> On Wed, Jun 3, 2026, 08:15 Marc Haber <[email protected]> wrote:
>
>> On Wed, Jun 03, 2026 at 01:50:29PM +0200, Santiago Vila wrote:
>> >In your example:
>> >
>> >permissive  +  GPL 2 or later  +  GPL 3 or later  =  GPL 3 or later
>>
>> Do we have documented which licenses include others? Or do I need to
>> have a doctorate in international copyright law to be a Debian
>> Developer?
>>
>> Greetings
>> Marc
>>
>> --
>>
>> -----------------------------------------------------------------------------
>> Marc Haber         | "I don't trust Computers. They | Mailadresse im Header
>> Leimen, Germany    |  lose things."    Winona Ryder | Fon: *49 6224 1600402
>> Nordisch by Nature |  How to make an American Quilt | Fax: *49 6224 1600421
>>
>>

--=-=-=
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQNoBAEWCgMQFiEEo8ychwudMQq61M8vUXIrCP5HRaIFAmogPoAUHHNpbW9uQGpv
c2Vmc3Nvbi5vcmfCHCYAmDMEXJLOtBYJKwYBBAHaRw8BAQdACIcrZIvhrxDBkK9f
V+QlTmXxo2naObDuGtw58YaxlOu0JVNpbW9uIEpvc2Vmc3NvbiA8c2ltb25Aam9z
ZWZzc29uLm9yZz6IlgQTFggAPgIbAwULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgBYh
BLHSvRN1vst4TPT4xNc89jjFPAa+BQJp4fWRBQkOa+rdAAoJENc89jjFPAa+hWIA
/1lQvrJeGlQq50lP6tm99D1zDy7J1tQ3ha4x0Jx7rkFTAP9hpUKuTvm6m1fXyiZV
YZlu2+Id/Dq3CIAZvNF+XEr2BLgzBFySz4EWCSsGAQQB2kcPAQEHQOxTCIOaeXAx
I2hIX4HK9bQTpNVei708oNr1Klm8qCGKiPUEGBYIACYCGwIWIQSx0r0Tdb7LeEz0
+MTXPPY4xTwGvgUCaeCW1wUJDmqLVgCBdiAEGRYIAB0WIQSjzJyHC50xCrrUzy9R
cisI/kdFogUCXJLPgQAKCRBRcisI/kdFoqdMAQCgH45aseZgIrwKOvUOA9QfsmeE
8GZHYNuFHmM9FEQS6AD6A4x5aYvoY6lo98pgtw2HPDhmcCXFItjXCrV4A0GmJA4J
ENc89jjFPAa+s7AA+gIIHpBApDpcDj1sKhzDngmpvwQf0VkHme6s+EG7qSgpAQDe
/XMrU0c0Pa3ji85cMqZhvzJOFI/soe662lzL0QY3Bbg4BFySz2oSCisGAQQBl1UB
BQEBB0AxlRumDW6nZY7A+VCfek9VpEx6PJmdJyYPt3lNHMd6HAMBCAeIfgQYFggA
JgIbDBYhBLHSvRN1vst4TPT4xNc89jjFPAa+BQJp4JbXBQkOaottAAoJENc89jjF
PAa+RNUA/2faQO/nFT06E+MlhlQdo/0chlQXC5TZMPTVvVBFwoLOAP9xLJK0ow5E
jTzYJB4K810AL/Iv6PEOAEgA4cPTHVlbCQAKCRBRcisI/kdFojDFAQDFLjQbkTQs
208ZpFEFOatMikWM9nFo2br1kreXJ/2KHQD/bK+jxxUKWYoh/38W4GIRAB515Drt
By4ukyBf1H+gbgI=
=DKzU
-----END PGP SIGNATURE-----
--=-=-=--