Bug#1135097: Bug#885698: What licenses should be included in /usr/share/common-licenses?

* Sean Whitton <[email protected]> [260428 12:26]:
>Really we need to hear from the people who are trying to make the
>minimal install of Debian small.  That's not me.

I have a mild interest in keeping small installs small, but I'm 
certainly not an expert. I've however done some poking.

Looking at the copyright files of packages installed by `mmdebstrap 
forky /dev/null` - IOW a set of packages that can be expected that 
every 'normal' install of Debian has (excluding container and 
embedded usecases which can and will apply hacks) - yields a few 
interesting things:

1) libc, sed have "Boost Software License - Version 1.0 - August 
17th, 2003" in their copyright files. Adding this to common-licenses 
seems a net positive and could IMO be done immediately without any 
negative effects.

2) mawk, libunistring5 use CC-BY-SA 3.0
These packages can be uninstalled. However curl depends on 
libunistring5, so once your install wants to talk to the Internet it 
probably has to stay.

3) nftables uses CC-BY-SA 4.0
This package can be uninstalled, but again once you want network 
connectivity, ...

4) AGPLv3 is NOT present

5) Deduplicating copyright files might be a meaningful disk space 
saving, if we actually care about disk space savings.
The install per above has:

* 10 binary packages from src:util-linux adding 30KB copyright per binary
* 6 binary packages from src:systemd adding 13KB copyright per binary
* 5 binary packages from src:e2fsprogs adding 20KB copyright per binary
* 4 binary packages from src:pam adding 10KB copyright per binary
* 4 binary packages from src:krb5 adding 63KB copyright per binary
ff.

I haven't done a full calculation but it seems we could save 1MB in 
such an install just by deduplicating the copyright files. Someone 
else may be interested in running the same analysis on different 
install scenarios, say Live ISOs, Desktop installs, etc.

With my src:util-linux maintainer hat on, I'd welcome tooling and a 
corresponding policy change towards copyright file deduplication.

And/or compression might also be of interest.

6) Even in this install scenario we still have some packages not using 
https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/ :

   debian-archive-keyring
   gcc-16-base
   libcrypt1
   libgcc-s1
   libgssapi-krb5-2
   libk5crypto3
   libkrb5-3
   libkrb5support0
   libstdc++6


Best,
Chris