Bug#829027: [jw...@debian.org: Re: Bug#829027: libstroke: missing/obsolete coypright information]

[Sean Whitton]

Hello Hamish, Vincent,

On Fri, Jul 01, 2016 at 10:19:48AM +1000, Hamish Moffatt wrote:
> Looking around quickly I think the URL in the copyright file should have
> been www.etla.net/libstroke, which certainly appears to have been valid at
> the time of upload:
> https://web.archive.org/web/20011217134508/http://www.etla.net/libstroke/
> 
> The etla.net home page seems to have stopped mentioning libstroke in early
> 1999, after the first upload of libstroke.
> https://web.archive.org/web/19990208013017/http://www.etla.net/

Thank you for getting back to me so quickly, Hamish.  It seems like we
can fix this bug by just replacing the URL in the copyright file.

On Fri, Jul 01, 2016 at 02:31:20AM +0200, Vincent Lefevre wrote:
> http://www.etla.net/ has a link to http://etla.net/libstroke/ in 1999.
> I suspect that the maintainer forgot to update the URL in the new
> package versions after the link has been removed.

Yes, probably right.

> > No, there's no such requirement.
> 
> This makes the first requirement completely useless: the maintainer
> could have downloaded the sources 10 years before the software is
> Debianized with URLs obsolete for years, so that no-one can check.

If the purpose of the requirement is for FTP-master verification, as I
suggested, I suspect that they would reject something that was no longer
available at the time of upload.  So it's not useless.

If the requirement was that the website remained available so long as
the package is in Debian, the Debian archive would suddenly be beholden
to a lot of random webservers across the Internet staying online.  That
would be counter-productive.

-- 
Sean Whitton

Bug#829027: [jw...@debian.org: Re: Bug#829027: libstroke: missing/obsolete coypright information]

[Hamish Moffatt]

Hi Sean,

I honestly have no recollection of the order of events.

Looking around quickly I think the URL in the copyright file should have 
been www.etla.net/libstroke, which certainly appears to have been valid 
at the time of upload:

https://web.archive.org/web/20011217134508/http://www.etla.net/libstroke/

The etla.net home page seems to have stopped mentioning libstroke in 
early 1999, after the first upload of libstroke.

https://web.archive.org/web/19990208013017/http://www.etla.net/





regards,

Hamish

On 01/07/16 09:50, Sean Whitton wrote:

Dear Hamish,

I'm sorry to bother you about a package you have orphaned, but do you
recall where you downloaded the original sources for libstroke?

In the copyright file you said that you got them from etla.org, but per
the below e-mail, they weren't available from etla.org at the time you
uploaded the package to Debian.  Did you download them in 1999 and then
just not get around to uploading until 2002?

Hopefully we don't have an unfixable RC bug here.

Thanks!

- Forwarded message from Jakub Wilk <jw...@debian.org> -

Date: Fri, 1 Jul 2016 01:19:23 +0200
From: Jakub Wilk <jw...@debian.org>
To: Vincent Lefevre <vinc...@vinc17.net>, 829...@bugs.debian.org
Cc: Sean Whitton <spwhit...@spwhitton.name>
Subject: Re: Bug#829027: libstroke: missing/obsolete coypright information
User-Agent: Mutt/1.5.23.1 (2014-03-12)
Message-ID: <20160630231923.ga2...@jwilk.net>

* Vincent Lefevre <vinc...@vinc17.net>, 2016-06-30, 14:34:

The Debian policy manual says:

"In addition, the copyright file must say where the upstream sources
(if any) were obtained, and should name the original authors."

This clause is made up of two requirements:

1. "the copyright file must say where the upstream sources ... were
obtained"

2. "the copyright file ... should name the original authors"

libstroke does not violate the first requirement: the copyright file
does say where the upstream sources /were/ obtained, even though they
can no longer be obtained there.

According to archive.org, http://www.etla.net/ stopped mentioning libstroke
somewhere between February and March 1999. The current upstream release was
first uploaded in 2002, when the link was already invalid.


I thought that it would still be needed as long as the package is in
Debian (so that users could check too) so that the location should
implicitly still be valid.

No, there's no such requirement.

Bug#829027: libstroke: missing/obsolete coypright information

[Vincent Lefevre]

On 2016-07-01 01:19:23 +0200, Jakub Wilk wrote:
> * Vincent Lefevre , 2016-06-30, 14:34:
> > > > The Debian policy manual says:
> > > > 
> > > > "In addition, the copyright file must say where the upstream
> > > > sources (if any) were obtained, and should name the original
> > > > authors."
> > > 
> > > This clause is made up of two requirements:
> > > 
> > > 1. "the copyright file must say where the upstream sources ... were
> > > obtained"
> > > 
> > > 2. "the copyright file ... should name the original authors"
> > > 
> > > libstroke does not violate the first requirement: the copyright file
> > > does say where the upstream sources /were/ obtained, even though
> > > they can no longer be obtained there.
> 
> According to archive.org, http://www.etla.net/ stopped mentioning libstroke
> somewhere between February and March 1999. The current upstream release was
> first uploaded in 2002, when the link was already invalid.

http://www.etla.net/ has a link to http://etla.net/libstroke/ in 1999.
I suspect that the maintainer forgot to update the URL in the new
package versions after the link has been removed.

> > I thought that it would still be needed as long as the package is in
> > Debian (so that users could check too) so that the location should
> > implicitly still be valid.
> 
> No, there's no such requirement.

This makes the first requirement completely useless: the maintainer
could have downloaded the sources 10 years before the software is
Debianized with URLs obsolete for years, so that no-one can check.

-- 
Vincent Lefèvre  - Web: 
100% accessible validated (X)HTML - Blog: 
Work: CR INRIA - computer arithmetic / AriC project (LIP, ENS-Lyon)

Bug#829027: [jw...@debian.org: Re: Bug#829027: libstroke: missing/obsolete coypright information]

[Sean Whitton]

Dear Hamish,

I'm sorry to bother you about a package you have orphaned, but do you
recall where you downloaded the original sources for libstroke?

In the copyright file you said that you got them from etla.org, but per
the below e-mail, they weren't available from etla.org at the time you
uploaded the package to Debian.  Did you download them in 1999 and then
just not get around to uploading until 2002?

Hopefully we don't have an unfixable RC bug here.

Thanks!

- Forwarded message from Jakub Wilk <jw...@debian.org> -

Date: Fri, 1 Jul 2016 01:19:23 +0200
From: Jakub Wilk <jw...@debian.org>
To: Vincent Lefevre <vinc...@vinc17.net>, 829...@bugs.debian.org
Cc: Sean Whitton <spwhit...@spwhitton.name>
Subject: Re: Bug#829027: libstroke: missing/obsolete coypright information
User-Agent: Mutt/1.5.23.1 (2014-03-12)
Message-ID: <20160630231923.ga2...@jwilk.net>

* Vincent Lefevre <vinc...@vinc17.net>, 2016-06-30, 14:34:
>>> The Debian policy manual says:
>>> 
>>> "In addition, the copyright file must say where the upstream sources
>>> (if any) were obtained, and should name the original authors."
>> 
>> This clause is made up of two requirements:
>> 
>> 1. "the copyright file must say where the upstream sources ... were
>> obtained"
>> 
>> 2. "the copyright file ... should name the original authors"
>> 
>> libstroke does not violate the first requirement: the copyright file
>> does say where the upstream sources /were/ obtained, even though they
>> can no longer be obtained there.

According to archive.org, http://www.etla.net/ stopped mentioning libstroke
somewhere between February and March 1999. The current upstream release was
first uploaded in 2002, when the link was already invalid.

> I thought that it would still be needed as long as the package is in
> Debian (so that users could check too) so that the location should
> implicitly still be valid.

No, there's no such requirement.

-- 
Jakub Wilk

- End forwarded message -

-- 
Sean Whitton

Bug#829027: libstroke: missing/obsolete coypright information

[Jakub Wilk]

* Vincent Lefevre , 2016-06-30, 14:34:

The Debian policy manual says:

"In addition, the copyright file must say where the upstream sources 
(if any) were obtained, and should name the original authors."


This clause is made up of two requirements:

1. "the copyright file must say where the upstream sources ... were 
obtained"


2. "the copyright file ... should name the original authors"

libstroke does not violate the first requirement: the copyright file 
does say where the upstream sources /were/ obtained, even though they 
can no longer be obtained there.


According to archive.org, http://www.etla.net/ stopped mentioning 
libstroke somewhere between February and March 1999. The current 
upstream release was first uploaded in 2002, when the link was already 
invalid.


I thought that it would still be needed as long as the package is in 
Debian (so that users could check too) so that the location should 
implicitly still be valid.


No, there's no such requirement.

--
Jakub Wilk

Bug#829027: libstroke: missing/obsolete coypright information

[Vincent Lefevre]

On 2016-06-30 03:22:09 +, Sean Whitton wrote:
> On Wed, Jun 29, 2016 at 10:44:36PM +0200, Vincent Lefevre wrote:
> > The Debian policy manual says:
> > 
> > "In addition, the copyright file must say where the upstream sources
> > (if any) were obtained, and should name the original authors."
> 
> This clause is made up of two requirements:
> 
> 1. "the copyright file must say where the upstream sources ... were obtained"
> 
> 2. "the copyright file ... should name the original authors"
> 
> libstroke does not violate the first requirement: the copyright file
> does say where the upstream sources /were/ obtained, even though they
> can no longer be obtained there.  (I believe that the requirement is for
> FTP-master verification of the copyright status that the copyright file
> claims; since that verification has already taken place, it is not a
> problem that the source is no longer accessible there.)

I thought that it would still be needed as long as the package is
in Debian (so that users could check too) so that the location
should implicitly still be valid.

> I'm not sure whether libstroke violates the second requirement.  The
> original author is, arguably, the company called "ETLA", and one could
> argue that the URL included in the copyright file names them.  You are
> correct that it could be much clearer, and the next upload of libstroke
> ought to correct this.

This is not exactly ETLA. The upstream COPYRIGHT file says:
"Mark F. Willey, ETLA Technical".

> Someone has contributed a patch fixing the autoconf problem.  You are
> encouraged to prepare a QA upload applying it (and also fixing this
> bug): .

I might have some time to look at this next week (otherwise after
July 16).

-- 
Vincent Lefèvre  - Web: 
100% accessible validated (X)HTML - Blog: 
Work: CR INRIA - computer arithmetic / AriC project (LIP, ENS-Lyon)

Processed: Re: Bug#829027: libstroke: missing/obsolete coypright information

[Debian Bug Tracking System]

Processing control commands:

> severity -1 normal
Bug #829027 [src:libstroke] libstroke: missing/obsolete coypright information
Severity set to 'normal' from 'serious'

-- 
829027: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=829027
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems

Bug#829027: libstroke: missing/obsolete coypright information

[Sean Whitton]

control: severity -1 normal

Dear Vincent,

Thank you for your bug report.

On Wed, Jun 29, 2016 at 10:44:36PM +0200, Vincent Lefevre wrote:
> The Debian policy manual says:
> 
> "In addition, the copyright file must say where the upstream sources
> (if any) were obtained, and should name the original authors."

This clause is made up of two requirements:

1. "the copyright file must say where the upstream sources ... were obtained"

2. "the copyright file ... should name the original authors"

libstroke does not violate the first requirement: the copyright file
does say where the upstream sources /were/ obtained, even though they
can no longer be obtained there.  (I believe that the requirement is for
FTP-master verification of the copyright status that the copyright file
claims; since that verification has already taken place, it is not a
problem that the source is no longer accessible there.)

I'm not sure whether libstroke violates the second requirement.  The
original author is, arguably, the company called "ETLA", and one could
argue that the URL included in the copyright file names them.  You are
correct that it could be much clearer, and the next upload of libstroke
ought to correct this.

Only the first of the two requirements is a severe violation of Debian
policy.  As per the bug severity definitions, a serious bug is one that
"violates a 'must' or 'required' directive," and 'should' is much weaker
than 'must' and 'required'.  So I'm lowering the severity.

> Now, this library is dead upstream (latest version in 2001, with an
> autoconf incompatibility since 2002, affecting the build of other
> software, still not fixed). Perhaps it would be better to remove it
> from Debian, and make packages no longer depend on libstroke.

Someone has contributed a patch fixing the autoconf problem.  You are
encouraged to prepare a QA upload applying it (and also fixing this
bug): .

-- 
Sean Whitton

Bug#829027: libstroke: missing/obsolete coypright information

[Vincent Lefevre]

Source: libstroke
Version: 0.5.1-7
Severity: serious
Justification: Policy 12.5

The Debian policy manual says:

"In addition, the copyright file must say where the upstream sources
(if any) were obtained, and should name the original authors."

but the libstroke copyright file just says:


This is the debian package of libstroke. The gEDA sources were downloaded
from http://www.etla.net/. The package was created by Hamish
Moffatt, March 1, 1999.

This software is released under the GNU General Public License,
version 2; please see /usr/share/common-licenses/GPL on your Debian
system. libgeda is released under the GNU Library General Public License
(LGPL), /usr/share/common-licenses/LGPL.


First, the URL is incorrect (http://www.etla.net/ is an almost empty
web page with no links, without any mention of libstroke). Moreover,
the original authors are not named.

Concerning the URL, it might be changed to:

  http://etla.net/libstroke/

but this page is obsolete (in particular, the contact link leads to
a 403 Forbidden error).

Now, this library is dead upstream (latest version in 2001, with an
autoconf incompatibility since 2002, affecting the build of other
software, still not fixed). Perhaps it would be better to remove it
from Debian, and make packages no longer depend on libstroke.

-- System Information:
Debian Release: stretch/sid
  APT prefers unstable-debug
  APT policy: (500, 'unstable-debug'), (500, 'stable-updates'), (500, 
'unstable'), (500, 'testing'), (500, 'stable'), (1, 'experimental')
Architecture: amd64 (x86_64)

Kernel: Linux 4.6.0-1-amd64 (SMP w/8 CPU cores)
Locale: LANG=POSIX, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)