Hi, Robert Luberda <rob...@debian.org> writes: > Ansgar Burchardt wrote: >>> The source for upx itself is provided on the upstream website (and >>> upx-ucl package is built from it), source for NRV is not available. >> >> http://www.gnu.org/licenses/gpl-faq.html#UnchangedJustBinary > > The source for upx is distributed in upx-ucl source package, isn't this > enough?
There's nothing that guarantees the versions of both packages stay in sync or upx-ucl could get removed while upx-nrv stays in the archive, so this is no good solution (also I did not even see it mentioned in the upx-nrv source package). >> Sure, but nobody else can redistribute the resulting binaries unless >> they do get special permission (the GPL doesn't allow this, see above). > > Quoting http://upx.sourceforge.net: > > All Rights Reserved. This program may be used freely, and you > are welcome to redistribute and/or modify it under certain > conditions. And the 'certain conditions' seem refer to the GPL-2 according to [1] which is referenced in the next paragraph: | This program is distributed in the hope that it will be useful, but | WITHOUT ANY WARRANTY; without even the implied warranty of | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the UPX | License Agreement for more details. If there are other conditions under which upx (or upx-nrv) may be distributed, I missed them. [1] <http://upx.sourceforge.net/upx-license.html> > there were some discussions regarding upx licensing in the past. It > seems however all of them refer to the ucl version. I cannot find any > clues if the conclusions are applicable to the nrv version or not, but > there is one thing I'm pretty sure - the upx license hasn't changed at > all since upx-nrv was allowed into Debian 12 years ago. I cannot > understand why we still have issue with it, and moreover I have no idea > how to solve the issue once and forever. I did not find anything with a quick search either, but it might well be that nobody noticed in the last decade. In any case the problem could be solved if upstream a, makes available headers and object files for nrv and adds an exception to the UPX license to link against nrv and distribute the resulting binaries similar to exceptions that allow linking GPL code with other GPL-incompatible libraries such as OpenSSL, or b, releases the binaries for upx-nrv under a license that allows distribution w/o providing corresponding source code (or other problematic requirements). It might also need to allow distributing the "modified" binaries obtained by running upx -d in debian/rules as well. Of course the license for nrv must also allow this. Regards, Ansgar -- To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org
