[Reproducible-builds] Bug#795057: python-xlib: Embedded code copy with missing copyright

[Maria Valentina Marin]

Source: python-xlib
Version: 0.14+20091101-2
Severity: serious
Justification: Policy 4.5
User: reproducible-builds at lists.alioth.debian.org
Usertags: timestamps
X-Debbugs-Cc: reproducible-builds at lists.alioth.debian.org

Hi,

Your packages contains an embedded code copy of texi2html which is
copyright Lionel Cons and others and is licensed under the GPL and
Creative Commons Attribution-ShareAlike license. This information is
missing from debian/copyright of python-xlib and is thus a violation of
policy §4.5.

I found this bug while working on the reproducible builds project [1] to
make texi2html produce reproducible output.

From that point of view there are two options:

 1. remove the embedded code copy [2] and build-depend on texi2html
    (this would also make policy §4.13 happy). I would prefer this
    solution and would supply you with a patch if you want.     	
    The package would not become immediately reproducible with this
    solution though because it does not use dh in debian/rules but
    instead classic debhelper. Because of that $SOURCE_DATE_EPOCH has
    to be exported in debian/rules [3]

 2. keep the embedded code copy and amend your debian/copyright. In this
    case I would open another bug so that your embedded copy of
    texi2html is patched to produce reproducible output.


Kind regards,
akira

[1] https://wiki.debian.org/ReproducibleBuilds/About
[2] https://wiki.debian.org/EmbeddedCodeCopies
[3] https://wiki.debian.org/ReproducibleBuilds/TimestampsProposal

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: OpenPGP digital signature
URL: <http://lists.alioth.debian.org/pipermail/reproducible-builds/attachments/20150810/a72adc09/attachment.sig>