Bug#879123: glee: source for configure is missing

[Markus Koschany]

Am 20.10.2017 um 06:42 schrieb Helmut Grohne:
> On Thu, Oct 19, 2017 at 10:52:41PM +0200, Markus Koschany wrote:
>> I am quoting:
>>
>> https://sources.debian.net/src/glee/5.4.0-2/configure/
>>
>> The license is very liberal. You can argue that it should be mentioned
>> in debian/copyright but that does not make the file non-free or
>> unsuitable for Debian main.
> 
> The license is a lie. It is clear that there is some source file that
> was used to generate configure. Thus configure is a derivative work of
> that file. As Adrian pointed out, very likely the FSF isn't the
> copyright holder for that source file and very likely this permissive
> "you can do anything" license does not apply to the source file.

How do you determine that this license is a "lie" without contacting the
copyright holder or upstream? Even without this information we can
faithfully assume that the FSF as the copyright holder of GNU Autoconf
are aware of any potential licensing issues with their software. They
have even created the "Autoconf Configure Script Exception". [1] Simply
put the upstream developer of glee is allowed to integrate this
configure script in any way he sees fit.

This is not a license issue.

> Saying that a generated configure script is free software is kinda
> stupid. The essence of free software is to provide users with the
> ability to modify it and this freedom is lost when all they have is the
> generated file.

It is stupid to say that you are unable to make modifications to the
package when you were the one who discovered that you don't even need
this file to build the package. How does the mere existence of a text
file impair your freedom in this case?

> 
>> This is not true. The configure file is human readable and the preferred
>> source of modification in this case. Please also note that the author of
>> glee licensed his work under the more liberal BSD-2-clause license. You
>> cannot compare two very distinct issues like minified JS files and
>> automake files and claim consensus has been reached already.
> 
> I have worked with *lots* of configure scripts and I can say that I
> never preferred modifying the generated script. Since configure scripts
> don't have reasonable indentation, the program structure is completely
> lost. Looking at them feels a lot like reading a binary disassembly. I
> contend that "human readable" is not a reasonable assessment either.
> 
>> Again quoted out of context and not relevant in this case. The source is
>> the configure script. Period. Please feel free to discuss this on
>> debian-devel or move it to the CTTE. I am willing to oppose this
>> nonsense and harmful misinterpretation of Debian's Policy whenever and
>> wherever I can.
> 
> If you insist on disucssing this in a larger scope, chances are a ftp
> master will notice and remove glee from stable (given Ximin's findings)
> as it is not clear whether glee is distributable at all.
> 
> Do you realize that my original motivation in reporting this bug was
> that I found a build issue with glee and wanted to write a patch? The
> absence of source makes that difficult and makes DFSG#3 rather
> theoretical. Why does DFGS#3 assure a "right to modify" when
> modification is often impratical? I start to wonder whether we should
> start a GR to clarify DFSG#3 that modification should be practical.
> 
> Helmut

I don't understand your technical problems at the moment. But I
understand that you have filed a serious bug against glee with the
justification that the configure script is not source. I have worked
with even more configure scripts and I also prefer modifying something
else. That does not mean it is not possible. I had to patch countless
configure files directly because dh-autoreconf or other means did not
work for me. Does that mean those packages have release critical bugs
now? I am not only disagreeing with you, I can prove you wrong. When I
can modify a configure file, you should be able to do it too.

Looking forward: I appreciate if you work on glee. If you remove the
file in this process and create your own build system, so be it. However
I cannot accept the severity and justification of this bug without
seeing the bigger picture because glee is not the only package which
contains such a file. There are packages which cannot recreate this file
out-of-the-box right now. If this is an RC bug, then all other affected
packages which are not auto-reconfigured at build time are RC too. That
would definitely need a clarification on debian-devel. I dispute your
assessment that shipping this file is a violation of DFSG 3 because

 a) the license grants you all the required freedoms. It is free
    software.
 b) the file is sufficiently modifiable but not needed at all for
    building the package

In consequence this is a minor issue at best. If you insist on severity
serious for such a problem, then bug reports with the same severity
should be filed against packages

 a) that do not recreate their build system at build time
 b) all packages that contain a prebuilt object without corresponding
    source, even when they are not used to build the package, or used at
    runtime (like .dll and .exe files)

Let's do it right or we should all learn to use severity levels correctly.

Regards,

Markus

[1] https://www.gnu.org/licenses/autoconf-exception-3.0

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 963 bytes
Desc: OpenPGP digital signature
URL: <http://lists.alioth.debian.org/pipermail/pkg-games-devel/attachments/20171020/34eadf02/attachment.sig>