Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 615460 - net-im/gitter-bin-3.1.0: missing license
Summary: net-im/gitter-bin-3.1.0: missing license
Status: RESOLVED FIXED
Alias: None
Product: Gentoo Linux
Classification: Unclassified
Component: Current packages (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Vladimir Pavljuchenkov (SpiderX)
URL:
Whiteboard:
Keywords:
Depends on:
Blocks: 615456
  Show dependency tree
 
Reported: 2017-04-13 16:41 UTC by Ulrich Müller
Modified: 2017-05-07 17:39 UTC (History)
3 users (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Ulrich Müller gentoo-dev 2017-04-13 16:41:53 UTC
- The "no-source-code" license label is redundant if the license itself is not in the @FREE license group. See the tracker bug 615456 for a longer explanation.

- licenses/gitter is not a license. It looks like terms of service for their platform.

- The ebuild is missing bindist restriction.
Comment 1 Göktürk Yüksek archtester gentoo-dev 2017-04-13 17:19:17 UTC
@ulm, no-source-code contains:

"""
The "no-source-code" license label must never be used on its own, but
only along with the license under which the package is distributed.
"""

which is a bit misleading. Is it possible to clarify it better wrt. to bug 615456?

As for the license, the debian package has this:

"""
Package: gitter
Version: 3.1.0
License: unknown
"""

Given that, the ToS seemed like the best option. There's this in the ToS:

"""
2. In consideration of you agreeing to abide by the terms of this agreement, we hereby grant to you a non-exclusive, non-transferable, licence to use Gitter on the terms of this agreement.
"""

and as for bindist, there's this:

"""
6. Your indemnities and undertakings
[...]
3. Except as expressly set out in this agreement or as permitted by any local law, you undertake:
[...]
e. to include our copyright notice on all entire and partial copies of Gitter in any form; or
f. not to provide, or otherwise make available, Gitter in any form, in whole or in part (including, but not limited to, program listings, object and source program listings, object code and source code) to any person without prior written consent from us, except those parts of Gitter that are published under open-source licences.
"""

Doesn't it suggest that as long as the copyright notice is retained, it can be distributed. Note that this is a binary package already.
Comment 2 Ulrich Müller gentoo-dev 2017-04-13 17:45:38 UTC
(In reply to Göktürk Yüksek from comment #1)
> Is it possible to clarify it better wrt. to bug 615456?

See bug 615456 comment 1.

> As for the license, the debian package has this:
> 
> """
> Package: gitter
> Version: 3.1.0
> License: unknown
> """
> 
> Given that, the ToS seemed like the best option.

Maybe upstream could be asked for clarification under what terms the package is distributed?

> Doesn't it suggest that as long as the copyright notice is retained, it can
> be distributed. Note that this is a binary package already.

This is not how copyright works. The software cannot be distributed, unless the license explicitly grants that right. Also the ebuild has mirror restriction already, which for a binary package has almost the same meaning as the bindist restriction.
Comment 3 Vladimir Pavljuchenkov (SpiderX) 2017-04-13 20:21:29 UTC
So, I have to:
 - remove "no-source-code" as redundant. But, should I left gitter license, becasue you have mentioned that licenses/gitter is not a license?
 - add bindist USE-flag. Should this flag do something?
Comment 4 Göktürk Yüksek archtester gentoo-dev 2017-04-13 20:44:57 UTC
(In reply to Vladimir Pavljuchenkov (SpiderX) from comment #3)
> So, I have to:
>  - remove "no-source-code" as redundant. But, should I left gitter license,
> becasue you have mentioned that licenses/gitter is not a license?
>  - add bindist USE-flag. Should this flag do something?

bindist is for RESTRICT, see ebuild(5). We will remove no-source-code but also need to contact upstream and ask them to clarify the license of the distributed binary. In other words, an End User License Agreement would be better than a Terms of Service Agreement.
Comment 5 Göktürk Yüksek archtester gentoo-dev 2017-04-13 20:47:22 UTC
(In reply to Ulrich Müller from comment #2)
> (In reply to Göktürk Yüksek from comment #1)
> > Is it possible to clarify it better wrt. to bug 615456?
> 
> See bug 615456 comment 1.
> 
> > As for the license, the debian package has this:
> > 
> > """
> > Package: gitter
> > Version: 3.1.0
> > License: unknown
> > """
> > 
> > Given that, the ToS seemed like the best option.
> 
> Maybe upstream could be asked for clarification under what terms the package
> is distributed?
> 
> > Doesn't it suggest that as long as the copyright notice is retained, it can
> > be distributed. Note that this is a binary package already.
> 
> This is not how copyright works. The software cannot be distributed, unless
> the license explicitly grants that right. Also the ebuild has mirror
> restriction already, which for a binary package has almost the same meaning
> as the bindist restriction.

My bad, I read the ToS wrongly. My initial impression was that you can EITHER retain the copyright notice OR not distribute. Now that I read it again, they actually require both.
Comment 6 Vladimir Pavljuchenkov (SpiderX) 2017-04-15 07:56:08 UTC
I wrote a mail to upstream and waiting for their reply.
Comment 7 Vladimir Pavljuchenkov (SpiderX) 2017-04-20 10:30:31 UTC
I got a reply:

> Hello,

> There is a downstream bug you probably should be aware:
> https://bugs.gentoo.org/show_bug.cgi?id=615460

> Could you clarify under what terms the package is distributed?


> Eric Eastwood (Gitter)
> Apr 19, 05:20 WEST

> Hey there,

> I assume it would be licensed under MIT, see https://github.com/gitterHQ/desktop/blob/b2c0288f90cc9813648505f9e999ecbaa02657d2/package.json#L31

> Are you putting the linux app on a package registry? We currently only distribute through our site and don't have infrastructure in place to update the different linux registries for easier updating.


So, we should remove licenses/gitter and replace gitter license with MIT and keep no-source-codes. Correct?
Comment 8 Vladimir Pavljuchenkov (SpiderX) 2017-04-28 06:55:45 UTC
Any news on this?
Do I have to do something more with this issue?
Comment 9 Ulrich Müller gentoo-dev 2017-04-28 10:32:55 UTC
(In reply to Vladimir Pavljuchenkov (SpiderX) from comment #8)
> Any news on this?
> Do I have to do something more with this issue?

If the statement quoted in comment 7 is representative of upstream, then the following is indeed the way to go:

> So, we should remove licenses/gitter and replace gitter license with MIT and
> keep no-source-codes. Correct?
Comment 10 Vladimir Pavljuchenkov (SpiderX) 2017-04-28 10:57:03 UTC
Should I create Pull Request on GitHub?
Comment 11 Vladimir Pavljuchenkov (SpiderX) 2017-05-02 16:38:40 UTC
Created - https://github.com/gentoo/gentoo/pull/4534.