Bug#885698: Bug#1135097: Bug#885698: What licenses should be included in /usr/share/common-licenses?

Mechtilde Stehmann <[email protected]> Thu, 30 Apr 2026 13:43:09 +0200

Newsgroups	gmane.linux.debian.devel.policy
Message-ID	<d39dd664-ad62-44e4-8a97-faa1a1633b0d__4873.40413253463$1777549653$gmane$org@debian.org>

Hello all,

Am 30.04.26 um 11:35 schrieb Sean Whitton:
> Chris Hofstaedtler [28/Apr  1:11pm +02] wrote:
>> * Sean Whitton <[email protected]> [260428 12:26]:
>>> Really we need to hear from the people who are trying to make the
>>> minimal install of Debian small.  That's not me.
>>
>> I have a mild interest in keeping small installs small, but I'm
>> certainly not an expert. I've however done some poking.
>>
>> Looking at the copyright files of packages installed by `mmdebstrap
>> forky /dev/null` - IOW a set of packages that can be expected that
>> every 'normal' install of Debian has (excluding container and
>> embedded usecases which can and will apply hacks) - yields a few
>> interesting things:
>>
>> 1) libc, sed have "Boost Software License - Version 1.0 - August
>> 17th, 2003" in their copyright files. Adding this to common-licenses
>> seems a net positive and could IMO be done immediately without any
>> negative effects.
>>
>> 2) mawk, libunistring5 use CC-BY-SA 3.0
>> These packages can be uninstalled. However curl depends on
>> libunistring5, so once your install wants to talk to the Internet it
>> probably has to stay.
>>
>> 3) nftables uses CC-BY-SA 4.0
>> This package can be uninstalled, but again once you want network
>> connectivity, ...
>>
>> 4) AGPLv3 is NOT present
>>
>> 5) Deduplicating copyright files might be a meaningful disk space
>> saving, if we actually care about disk space savings.
>> The install per above has:
>>
>> * 10 binary packages from src:util-linux adding 30KB copyright per binary
>> * 6 binary packages from src:systemd adding 13KB copyright per binary
>> * 5 binary packages from src:e2fsprogs adding 20KB copyright per binary
>> * 4 binary packages from src:pam adding 10KB copyright per binary
>> * 4 binary packages from src:krb5 adding 63KB copyright per binary
>> ff.
>>
>> I haven't done a full calculation but it seems we could save 1MB in
>> such an install just by deduplicating the copyright files. Someone
>> else may be interested in running the same analysis on different
>> install scenarios, say Live ISOs, Desktop installs, etc.
>>
>> With my src:util-linux maintainer hat on, I'd welcome tooling and a
>> corresponding policy change towards copyright file deduplication.
> 
> Thank you for the feedback.  Seems to me we can prioritise developer
> time by adding more licenses to common-licenses, then, with the possible
> exception of the AGPL.
> 

This exception of the AGPL means we will only add 120 KB instead of 150 
KB to /usr/share/common-licenses ?


Kind regards
-- 
Mechtilde Stehmann

## PGP encryption welcome
## F0E3 7F3D C87A 4998 2899  39E7 F287 7BBA 141A AD7F

OpenPGP_signature.asc (application/pgp-signature, 833 B)