On 3/29/25 3:00 PM, Mike Gabriel wrote:
Hi Pirate Praveen, On Sa 29 Mär 2025 09:34:49 CET, Pirate Praveen wrote:Package: fusiondirectory Severity: importantFollow up for https://bugs.debian.org/cgi-bin/bugreport.cgi? bug=1016029 (this bug is archived, but I think my comments should be recorded somewhere)On Mon, 25 Jul 2022 16:05:53 +0200 Mike Gabriel <mike.gabriel@das- netzwerkteam.de> wrote:Package: ftp.debian.org Severity: normal The fusiondirectory src:package has been maintained by myself and upstream in the past. As fusiondirectory does not come with a build system, we implemented the build system in debian/*.install in the past.Upstream has recently chosen to hide their debian/* packaging from the publicand chosen to make the DEB packaging an asset. From now on you can only receive latest DEB packages of fusiondirectory via a subscription.They do provide new versions from their public repositories without subscription, but they don't provide source packages, only binary .deb packages [1].Actually, they cannot withhold the packaging files, as it would violate the terms of GPL 2.0 - debian packaging is a derivative work of fusion directory, which is under GPL 2.0. They can do that only if they hold copyright to the whole codebase or get permission from every single copyright holder. Since they forked Gosa, it is unlikely they rewrote the code or took permission from all external contributors.I have asked them to publish the source packages as they are required to do it under GPL as they won't be able distribute the code from external contributors without following GPL [2].Any copyright holder / contributor can enforce this. Mike, they are violating your copyright for debian/* files at least.I don't think we should let them get away with clear GPL violation this easily (just removing the package).I am aware of the potential copyright infringement, however, iirc, I mostly cherry-picked packaging changes from their upstream DEB packaging. On the other hand, they started off from packaging work by GONICUS GmbH (Cajus Pollmeier) and myself as found in the gosa DEB packaging.However, I must admit I am to no extent interested in FusionDirectory anymore. Upgrades broke the installation I had regularly (i.e. too often), because required LDAP changes (expected by the new FD version) were not handled gracefully as part of their update procedure but all LDAP changes required I had to apply myself. That said, these days I totally disrecommend running/using FusionDirectory.
ok thanks for that feedback.
Instead, I currently invest my time in improving GOsa² on the upstream side and as an Open Source project. GONICUS currently is step-by-step- adding PHP composer support to their plugins + the core, so there is activity again in GOsa² upstream. In fact, we (GONICUS and my company) have quite a big customer who is running a deployment of recent GOsa² successfully as their IDM (many thousand users on it).
I'd be interested to migrate to Gosa as well, if there is some documentation / migration tool.
I opened this for such support https://github.com/gosa-project/gosa-core/issues/66 but it was turned into a licensing discussion by Fusion Directory folks.
Sorry, but for me personally, hunting FD developers for close-sourcing my few lines of DEB packaging with lawyers is not something I am willing to invest time in.
Ok makes sense. I think there would also be other contributors to fusion directory itself or original contributors to Gosa who don't want to let Fusion Directory violate their copyright, since derivative works (including packaging) also needs to be under GPL. I will see if there is any other contributors who wants to pursue it legally.
But if they violate GPL, they lose their ability to distribute itself, as GPL is the only legal permission that allows them to distribute other people's works..
Greets, Mike
OpenPGP_0x8F53E0193B294B75.asc
Description: OpenPGP public key
OpenPGP_signature.asc
Description: OpenPGP digital signature
