licensing / debian packaging #977790

[alexmyczko]

lintian complains about this file:
utils/src/ConvertUTF.c

details: https://lintian.debian.org/tags/license-problem-convert-utf-code.html

anything you want to do about that?

i also get these:

E: far2l: embedded-library usr/lib/far2l/Plugins/colorer/plug/colorer.far-plug-wide: zlib
N:    The given ELF object appears to have been statically linked to a
N:    library. Doing this is strongly discouraged due to the extra work needed
N:    by the security team to fix all the extra embedded copies or trigger the
N:    package rebuilds, as appropriate.
N:    
N:    If the package uses a modified version of the given library it is highly
N:    recommended to coordinate with the library's maintainer to include the
N:    changes on the system version of the library.
N:    
N:    Refer to Debian Policy Manual section 4.13 (Convenience copies of code)
N:    for details.
N:    
N:    Severity: error
N:    
N:    Check: binaries

E: far2l: embedded-library usr/lib/far2l/Plugins/multiarc/plug/multiarc.far-plug-mb: pcre3

E: far2l source: license-problem-convert-utf-code utils/src/ConvertUTF.c (above description)

E: far2l: possible-gpl-code-linked-with-openssl
N:    This package appears to be covered by the GNU GPL but depends on the
N:    OpenSSL libssl package and does not mention a license exemption or
N:    exception for OpenSSL in its copyright file. The GPL (including version
N:    3) is incompatible with some terms of the OpenSSL license, and therefore
N:    Debian does not allow GPL-licensed code linked with OpenSSL libraries
N:    unless there is a license exception explicitly permitting this.
N:    
N:    If only the Debian packaging, or some other part of the package not
N:    linked with OpenSSL, is covered by the GNU GPL, please add a Lintian
N:    override for this tag. Lintian currently has no good way of
N:    distinguishing between that case and problematic packages.
N:    
N:    Severity: error
N:    
N:    Check: debian/copyright

also these:

I: far2l: spelling-error-in-binary usr/bin/far2l Nam Name
I: far2l: spelling-error-in-binary usr/bin/far2l wihout without
I: far2l: spelling-error-in-binary usr/lib/far2l/Plugins/NetRocks/plug/NetRocks-FTP.broker responce response
I: far2l: spelling-error-in-binary usr/lib/far2l/Plugins/NetRocks/plug/NetRocks-SFTP.broker authentification authentication
I: far2l: spelling-error-in-binary usr/lib/far2l/Plugins/colorer/plug/colorer.far-plug-wide Qoute Quote
I: far2l: spelling-error-in-manpage usr/share/man/man1/far2l.1.gz "Allows to" "Allows one to"

[elfmz]

License of ConvertUTF.cpp is on top of that file https://github.com/elfmz/far2l/blob/master/utils/src/ConvertUTF.c and its fully compatible with GPL: https://en.wikipedia.org/wiki/University_of_Illinois/NCSA_Open_Source_License

[elfmz]

regarding embedded zip library - its obviously need to be converted to be not statically linked-in and its not something unknown, however colorer by itself requires deep refactoring to be updated to recent DB that caused posponing all suchproblems

[elfmz]

Regarding openssl problem - its unclear for me what should i do to resolve that? i found that link https://people.gnome.org/~markmc/openssl-and-the-gpl
and there suggested following:

One recommended way around this GPL incompatibility is to add an OpenSSL exemption when you license your code under the GPL. See this mail from debian-legal to a developer which suggests the following wording for the exemption:

• In addition, as a special exception, the copyright holders give
• permission to link the code of portions of this program with the
• OpenSSL library under certain conditions as described in each
• individual source file, and distribute linked combinations
• including the two.
• You must obey the GNU General Public License in all respects
• for all of the code used other than OpenSSL. If you modify
• file(s) with this exception, you may extend this exception to your
• version of the file(s), but you are not obligated to do so. If you
• do not wish to do so, delete this exception statement from your
• version. If you delete this exception statement from all source
• files in the program, then also delete it here.

so i should just copy above into end of LICENSE.txt and that will resolve issue?

[unxed]

Ура, все используемые far2l общеизвестные либы теперь динамически линкуются? :)

Ну, кроме UCD, который, как я понял, используется для угадывания кодировки файлов, и для которого, похоже, нет распространенных готовых пакетов. А, хм, вижу в multiarc'е кусочки p7zip и unrar ещё.

[elfmz]

Added required paragraph to license by commit b4b94ea
However have to acknowledge all contributors about this, if someone need to tell something against this change, please speak now (so in this case likely will need to revert this change and will think how to get rid of OpenSSL), or forever hold your peace :)
@svost @invy @lieff @techtonik @sxored @anteo @singalen @Alter-1 @m32 @unxed @russiandesman @yurikoles @rampitec @randolf @cycleg @dstogov @thinkingerrol @ZOleg73 @dvlom @iliakonnov @akozlins @MikeMirzayanov @j2969719 @corporateshark @michaellukashov @vodek3 @igorklopov @sev- @pg83 @miotio @Gravityzwell @colier @itspec-ru @hypersw @vasilievip @developerxyzw @Devoter @tsunamaru @movsw @trexinc @denis-adamchuk

[sev-]

Ack, no objections. Debian strikes again...

[techtonik]

OpenSSL is a good stuff that keeps internets secure, so I no objections from my side.

[tsunamaru]

No objections.

[yurikoles]

No objections from me either.

[itspec-ru]

No objections.

[akozlins]

ack

[russiandesman]

ack

[m32]

No objections.

[denis-adamchuk]

ack

[hypersw]

ack

[unxed]

No objections.

[dvlom99]

No objections.

[rampitec]

No objections.

[alexmyczko]

only problem left is convertutf, which can be fixed with a later version/updated license too: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=864729#26

current state: https://mentors.debian.net/package/far2l/
(once that last thing above is fixed, it can be in debian and ubuntu, and people can just run apt install far2l)

[invy]

No objections

[unxed]

only problem left is convertutf

@elfmz can't we just implement wrappers around WinPort charset conversion routines as replacement?

[elfmz]

There're C++-own features: https://www.inf.pucrs.br/~flash/lapro2ec/cppreference/w/cpp/locale/wstring_convert.html
Some problem that in few cases need to use CalcSpaceUTF* functions (added by me) that don't do conversions but just calculate needed space to hold result, so performance may be degraded in that cases. And in overall need to estimate performance of native C++ convertions against this code. If it will be good then there will be no problems to get rid of this code, otherwise may consider to re-implement it or borrow some another code/library equally fast.
Another question is how it behaves on semi-broken sequences

[unxed]

WinPort's functions already behave relatively fast (at least, comparing to iconv), support semi-broken sequences well (AFAIK) and support space calculation also. Why not just use them?

[elfmz]

cuz its able to convert to/from UTF16 (as Windows has) but not UTF32 (as *nix have). For supported by it codepages UTF16 codepoints are UCS-2 and directly mapped into UCS-4 thus its wchars can be just typecasted into native ones. But its not so for some other sequences, and better to have UTF8<->UTF32 convertion without surprises.

[unxed]

Does the rest of far2l code already work fine with UTF-32 and 4-byte characters so it make sense to worry about it right now? ;-)

[unxed]

Btw, what about this version? Is it licence-compatible with Debian? @alexmyczko
https://github.com/bro/bro/blob/master/src/ConvertUTF.c

Can we just use it as replacement?

and to make copies of this file in any form for internal or external distribution as long as this notice remains attached

[unxed]

Another possible replacement:
silnrsi/teckit@3e24aa0

[akruphi]

@elfmz may be bumping version to 2.5.2 and after it ask @alexmyczko to maintain in Debian debs with @ramok's suggestions https://salsa.debian.org/debian/far2l/-/merge_requests/1 and may be additional remove htop & chafa from hard dependences to soft suggestions?

After #1712 criticism I think it may take a few iterations before Debian package will be prepare perfectly. But in Ubuntu Mantic August 17 is Debian Import Freeze.

[alexmyczko]

is it possible you are on irc or element/matrix?

[unxed]

@alexmyczko spdlog is not required as a dependency any more

[alexmyczko]

@unxed new release tag?

[unxed]

@unxed new release tag?

@elfmz ?

[alexmyczko]

https://ftp-master.debian.org/backports-new.html

[unxed]

m4 and awk are also not needed any more.

[akruphi]

🎯 Today is 3 weeks before the 17 August: the Ubuntu Mantic deadline Debian Import Freeze.

@alexmyczko how many days do you need to make new deb-packages taking into account good suggestions from ramok with separate far2l-tiny, far2l, far2l-wx, far2l-nox? And how many days after it need by Debian procedures to accept these debs to unstable & testing?

Can @alexmyczko give advice to @elfmz about deadline his bumping to new release tag that Debian version will be guaranteed prepare before 17 August?

[alexmyczko]

for just new version few days before August 11 should be fine.

for the splitted packaging, thanks for the MR but when i try it fails i try to find a way of communication but fail: i am on irc as well as matrix. sorry anything else will not work for me. but if the splitting would work i would upload. will retry tomorrow. changing binary pkg number means a new round of debian new queue (google it) to see how long it takes can be 0-150 days. with debian not much of a problem as backports exist. for ubuntu it would need to land in a ppa. i would say 23.10 is not as important as 22.04. but then probably a lot more will go the debian way (i do)

[akruphi]

@alexmyczko If you have problems with splitting packages, may be using https://github.com/elfmz/far2l/tree/master/packaging/suse as a baseline will help you? This is the most fine version of all the specs posted in the far2l repository.

[akruphi]

for just new version few days before August 11 should be fine.

@elfmz maybe it's time to bump the version

[ramok]

https://ftp-master.debian.org/backports-new.html

for just new version few days before August 11 should be fine.

for the splitted packaging, thanks for the MR but when i try it fails i try to find a way of communication but fail: i am on irc as well as matrix. sorry anything else will not work for me. but if the splitting would work i would upload. will retry tomorrow. changing binary pkg number means a new round of debian new queue (google it) to see how long it takes can be 0-150 days. with debian not much of a problem as backports exist. for ubuntu it would need to land in a ppa. i would say 23.10 is not as important as 22.04. but then probably a lot more will go the debian way (i do)

you try https://salsa.debian.org/debian/far2l/-/merge_requests/1 and it fails? strange. how I can find you in IRC?

[alexmyczko]

tarzeau in #debian-bananas but i will be offline in 1h for some days but i read backlog

[akruphi]

@alexmyczko, @ramok: I hope now the splitted packages were successfully done or you have still problems?

@alexmyczko Maybe without waiting for a new tag from @elfmz make in Debian current version 2.5.1~beta+git20230814 (because only 1-1.5 days before Ubuntu Mantic deadline Debian Import Freeze)?

[elfmz]

uh, missed this discussion, tag created (release page etc will create bit later today)

[unxed]

@alexmyczko could you please move chafa, htop, imagemagic from dependent to recommended packages? Currently far2l needs about 150 Mb of dependencies on x11-less servers. Thats probably not ok.

[alexmyczko]

@elfmz took me a while but it was updated now. @unxed chafa/htop moved to recommends:

[unxed]

Thanks a lot!

[unxed]

@alexmyczko can you please update the package?
545754a

[alexmyczko]

sure 2.5.3, will do

[alexmyczko]

Any plan to drop beta from the releases?

[akruphi]

According to Ubuntu 24.04 LTS Schedule https://discourse.ubuntu.com/t/noble-numbat-release-schedule/35649
February 29 Feature Freeze, Debian Import Freeze

@alexmyczko please confirm that for prepare and put deb in Debian you need approximately week and we should ask @elfmz make new release not later then February 20.

[elfmz]

@elfmz make new release not later then February 20.

🫡 done

[akruphi]

@alexmyczko @elfmz: about updating far2l with Wayland bug-fixes in Ubuntu 24.04 LTS after Import Freeze deadline advice from my friend:

1. Make release in Debian

2. If release has not only bug-fixes, but has significant new features he recommends to request a freeze exception in Ubuntu via https://wiki.ubuntu.com/FreezeExceptionProcess#FeatureFreeze_for_new_upstream_versions (it may be processed by Ubuntu team 7-10 days).

3. In 12 hours after release is done in Debian, anyone with Launchpad account can start requestsync/syncpackage:

   • syncpackage if maintainer has permissions to write to Ubuntu
   • requestsync if maintainer has no Ubuntu permissions

My friend can help in Launchpad stage.

[unxed]

@elfmz to promote new release fixing input delays to Ubuntu 24.04 we need to make a new release just now.

[elfmz]

ops, better next time open new issue for that instead of writing comments to closed one. Created tag

[unxed]

Colleagues, in Debian we have 2.6.3 with a bunch of glitches under WSL/WT, isn't it time to release 2.6.4?

[unxed]

Touch #2419