Sent message incorrectly to debian-mentors-request instead of debian-mentors.
Correcting.
-------- Forwarded Message --------ref_
Subject: Copyright in LGPL projects
Date: Mon, 4 Mar 2024 11:10:58 +0530
From: Alan M Varghese <[email protected]>
To: [email protected]
CC: Matthias Geiger <[email protected]>, SmartList <[email protected]>
Hello Mentors,
I have been working on packaging Hyprland window manager.
hyprlang[0] (with a 'g') is a new dependency for this project. This project (hyprlang) is licensed under LGPL.
But, the project authors haven't included a copyright notice anywhere in the project. It turns out that the authors are not sure if this is required for an LGPL project[1].
From a Debian perspective, what is the recommendation regarding this? Do we require projects to include the copyright information along with LGPL?
If the copyright *has* to be included, is it enough to include it in a COPYRIGHT file? I couldn't find an example of a project that does this. Most projects seem to include a copyright line along with a short form of LGPL in each file. (I think it may be more appealing to upstream authors if we don't have to include the copyright in every file).
For example, libplacebo[2] is a library I found installed on my system that uses LGPL. This project does not have a common copyright file, but there are copyright notices in some source files[3]. While some other source files in this project do not have a copyright notice[4][5][6].
Note: my doubts are specifically regarding the LGPL license. For other licenses like BSD, I see both practices of including a COPYRIGHT file as well as a short copyright notice in each file, or a combination of the two.
Thanks,
Alan M Varghese
[0] https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1065352
[1] https://github.com/hyprwm/hyprlang/issues/28
[2] https://code.videolan.org/videolan/libplacebo
[3]
https://code.videolan.org/videolan/libplacebo/-/blob/master/src/dither.c?
type=heads [4] https://code.videolan.org/videolan/libplacebo/-/blob/master/src/dummy.c?ref_t
ype=heads [5] https://code.videolan.org/videolan/libplacebo/-/blob/master/src/cache.c?ref_t
ype=heads [6] https://code.videolan.org/videolan/libplacebo/-/blob/master/src/colorspace.c?
ref_type=heads
Alan,
These are good questions.
1. Yes, there must be a copyright statement. Only the person, people, group,
or organization that holds the copyright can issue a license for other people to use the work. So, you must have someone claiming a copyright or they do not have the legal ability to release the work to others under the LGPL.
2. No, it is not required that each individual file contain a copyright statement or the header of the LGPL at the top. The FSF recommends such as a best practice, and I would agree that it is desirable, but it is not required.
My recommendation would be that you communicate to the upstream project that they need to include the copyright and licensing information in the root of their repository, preferably all in one file, as a minimum requirement for you
to be willing to package their project in Debian.
Soren
On Sunday, March 3, 2024 11:06:30 PM MST Alan M Varghese wrote:
Sent message incorrectly to debian-mentors-request instead of debian-mentors.
Correcting.ref_
-------- Forwarded Message --------
Subject: Copyright in LGPL projects
Date: Mon, 4 Mar 2024 11:10:58 +0530
From: Alan M Varghese <[email protected]>
To: [email protected]
CC: Matthias Geiger <[email protected]>, SmartList
<[email protected]>
Hello Mentors,
I have been working on packaging Hyprland window manager.
hyprlang[0] (with a 'g') is a new dependency for this project. This project >> (hyprlang) is licensed under LGPL.
But, the project authors haven't included a copyright notice anywhere in the >> project. It turns out that the authors are not sure if this is required for >> an LGPL project[1].
From a Debian perspective, what is the recommendation regarding this? Do we
require projects to include the copyright information along with LGPL?
If the copyright *has* to be included, is it enough to include it in a
COPYRIGHT file? I couldn't find an example of a project that does this. Most >> projects seem to include a copyright line along with a short form of LGPL in >> each file. (I think it may be more appealing to upstream authors if we don't >> have to include the copyright in every file).
For example, libplacebo[2] is a library I found installed on my system that >> uses LGPL. This project does not have a common copyright file, but there are >> copyright notices in some source files[3]. While some other source files in >> this project do not have a copyright notice[4][5][6].
Note: my doubts are specifically regarding the LGPL license. For other
licenses like BSD, I see both practices of including a COPYRIGHT file as well
as a short copyright notice in each file, or a combination of the two.
Thanks,
Alan M Varghese
[0] https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1065352
[1] https://github.com/hyprwm/hyprlang/issues/28
[2] https://code.videolan.org/videolan/libplacebo
[3]
https://code.videolan.org/videolan/libplacebo/-/blob/master/src/dither.c?
type=heads [4]ref_t
https://code.videolan.org/videolan/libplacebo/-/blob/master/src/dummy.c?
ype=heads [5]ref_t
https://code.videolan.org/videolan/libplacebo/-/blob/master/src/cache.c?
ype=heads [6]colorspace.c?
https://code.videolan.org/videolan/libplacebo/-/blob/master/src/
ref_type=heads
Hello Soren,Why would that make a difference?
Thank you for answering my queries.
I will share this with the upstream project. The project authors are unsure how
to do this for an LGPL project. I will see tomorrow if I can find an example of
an LGPL project that includes the copyright information in the root of the project.
(I found a project that does this for GPL[1], but not for LGPL).
What I meant was that upstream does not know where to put the copyright information or how it should be formatted. Or, to rephrase, is there a preferred format for a COPYRIGHT file in a project that uses LGPL?
This is the issue I opened upstream: https://github.com/hyprwm/hyprlang/issues/28
On 3/5/24 01:38, Andrey Rahmatullin wrote:
On Tue, Mar 05, 2024 at 12:38:00AM +0530, Alan M Varghese wrote:
Hello Soren,
Thank you for answering my queries.
I will share this with the upstream project. The project authors are unsure
how to do this for an LGPL project. I will see tomorrow if I can find an >> example of an LGPL project that includes the copyright information in the >> root of the project. (I found a project that does this for GPL[1], but not >> for LGPL).
Why would that make a difference?
On Tue, Mar 05, 2024 at 12:38:00AM +0530, Alan M Varghese wrote:
Hello Soren,Why would that make a difference?
Thank you for answering my queries.
I will share this with the upstream project. The project authors are unsure how
to do this for an LGPL project. I will see tomorrow if I can find an example of
an LGPL project that includes the copyright information in the root of the project.
(I found a project that does this for GPL[1], but not for LGPL).
What I meant was that upstream does not know where to put the copyright information orThere are no special formats for copyright files and the license shouldn't matter so I'm still not sure what's the actual question they have.
how it should be formatted. Or, to rephrase, is there a preferred format for a COPYRIGHT file
in a project that uses LGPL?
There are no special formats for copyright files and the license shouldn't matter so I'm still not sure what's the actual question they have.
In most software the top-level copyright is simply stated as one line in
the top-level LICENSE or whatever file or even in the top-level README,
and separate per-file copyrights are stated in the files themselves. The calibre one you linked is very unusual
Alan,
These are good questions.
1. Yes, there must be a copyright statement. Only the person, people, group,
or organization that holds the copyright can issue a license for other people
to use the work. So, you must have someone claiming a copyright or they do not have the legal ability to release the work to others under the LGPL.
My recommendation would be that you communicate to the upstream project that they need to include the copyright and licensing information in the root of their repository, preferably all in one file, as a minimum requirement for you
to be willing to package their project in Debian.
On 2024-03-04 11:19 -0700, Soren Stoutner wrote:
Alan,
These are good questions.
1. Yes, there must be a copyright statement. Only the person, people, group, or organization that holds the copyright can issue a license for other people to use the work. So, you must have someone claiming a copyright or they do not have the legal ability to release the work to others under the LGPL.But what requires that to be in the source tarball? Copyright is
intrinsic in the authors, it doesn't require a statement to create
it. Said authors _do_ need to specify a licence (and the LGPL requires
that licence text to be shipped in the source (I think, although I
could only actually find this requirement for a 'Combined work' and in
the FAQ just now)).
_Debian_ requires a copyright statement (in the copyright file) so we
do need to find out from the project what to put, and a statement in
the source would be a good way to communicate that, but a notice on
the project website or even an email from a representative would also
do the job.
thatMy recommendation would be that you communicate to the upstream project
ofthey need to include the copyright and licensing information in the root
their repository, preferably all in one file, as a minimum requirement for you to be willing to package their project in Debian.
I don't think this is correct. And we should be happy to package
anything which is actually free software. We don't get to impose extra requirements before we will package something.
They should put a copy of the LGPL in (in a file called 'COPYING' or 'LICENCE' by convention) (if this isn't done already). A copyright
notice for the project should _not_ go in the same file (The LGPL
already has one for the LGPL authorship itself, so this is probably
the only file in the distribution which should definitiely _not_ have
the project copyright notice). It should ideally be a header on at least
one source file, (preferably all of them), but could be any README, or
even just a notice on the project website, or an email saying '
... but it is also perfectly fine to ship them in the same file.I think what Wookey is referring to is that GPL and LGPL licenses contain
Wookey,
On Tuesday, March 5, 2024 2:51:10 AM MST Wookey wrote:
On 2024-03-04 11:19 -0700, Soren Stoutner wrote:
Alan,But what requires that to be in the source tarball? Copyright is
These are good questions.
1. Yes, there must be a copyright statement. Only the person, people,
group, or organization that holds the copyright can issue a license for
other people to use the work. So, you must have someone claiming a
copyright or they do not have the legal ability to release the work to
others under the LGPL.
intrinsic in the authors, it doesn't require a statement to create
it. Said authors _do_ need to specify a licence (and the LGPL requires
that licence text to be shipped in the source (I think, although I
could only actually find this requirement for a 'Combined work' and in
the FAQ just now)).
_Debian_ requires a copyright statement (in the copyright file) so we
do need to find out from the project what to put, and a statement in
the source would be a good way to communicate that, but a notice on
the project website or even an email from a representative would also
do the job.
That is correct. There must be a copyright statement or the license information is not legally valid (because only someone who claims copyright can issue a license). However, it doesn’t expressly need to be in the tarball
(see below). That part is simply best practice, because it maintain the copyright information if the project is forked or upstream disappears, which otherwise can be difficult to determine if it was only on a website that is now
defunct or in an email sent to a Debian developer who is no longer participating in the project.
So, there is a distinction between what is the minimum legal requirement and what is best practice.
thatMy recommendation would be that you communicate to the upstream project
ofthey need to include the copyright and licensing information in the root
their repository, preferably all in one file, as a minimum requirement for >>> you to be willing to package their project in Debian.
I don't think this is correct. And we should be happy to package
anything which is actually free software. We don't get to impose extra
requirements before we will package something.
As pointed out above, there is a distinction between what is the minimum requirement for packaging in Debian and best practice. I carefully worded point 2 in my original email to state that, if **I** were packaging this software, I would communicate with upstream that if they wanted **me** to package their software in Debian, my minimum requirement would be that they explicitly state the copyright information in the source code. Originally I had a point 3, which I deleted before sending the email, explaining that my personal preference for when I would be willing to package software is higher than Debian’s requirement, and that a website notation or email communication
of copyright has been used in some packages in the past, but with the downside
described above. I took out point 3 because I felt it muddied the waters, but
since the point has been brought up, it is worth discussing.
They should put a copy of the LGPL in (in a file called 'COPYING' or
'LICENCE' by convention) (if this isn't done already). A copyright
notice for the project should _not_ go in the same file (The LGPL
already has one for the LGPL authorship itself, so this is probably
the only file in the distribution which should definitiely _not_ have
the project copyright notice). It should ideally be a header on at least
one source file, (preferably all of them), but could be any README, or
even just a notice on the project website, or an email saying '
I must disagree with you on this point. It is perfectly fine to ship the copyright and the license in two separate files, but it is also perfectly fine
to ship them in the same file. I do so in my upstream project linked in a previous email, and Debian does so in debian/copyright. Using a file named LICENSE or COPYING or AUTHORS is fairly standard, but exactly how this is done
doesn’t matter as long as both copyright (with years) and license are communicated.
Soren,
... but it is also perfectly fine to ship them in the same file.I think what Wookey is referring to is that GPL and LGPL licenses contain
a line that says something like:
'Copyright (C) 1991, 1999 Free Software Foundation, Inc.'
I believe this copyright refers to the text of the license itself.
Hence, it
might not be a good idea to include a second copyright in this same file.
So, including the copyright and license in the same file can work for licenses
like MIT, BSD etc which does not mention a copyright of its own, and not
for GPL-like licenses which includes a copyright line as part of the
license.
Anyways, upstream author has added a new file called "COPYRIGHT" in
the root
of the project[1] that mentions the copyright years, owner and the
license used.
Based on all our discussion so far, I understand this should be
acceptable
for our purposes in Debian.
[1] https://github.com/hyprwm/hyprlang/blob/main/COPYRIGHT
Alan
On 3/6/24 02:19, Soren Stoutner wrote:
Wookey,
On Tuesday, March 5, 2024 2:51:10 AM MST Wookey wrote:
On 2024-03-04 11:19 -0700, Soren Stoutner wrote:
Alan,But what requires that to be in the source tarball? Copyright is
These are good questions.
1. Yes, there must be a copyright statement. Only the person,
people,
group, or organization that holds the copyright can issue a license
for
other people to use the work. So, you must have someone claiming a
copyright or they do not have the legal ability to release the work to >>>> others under the LGPL.
intrinsic in the authors, it doesn't require a statement to create
it. Said authors _do_ need to specify a licence (and the LGPL requires
that licence text to be shipped in the source (I think, although I
could only actually find this requirement for a 'Combined work' and in
the FAQ just now)).
_Debian_ requires a copyright statement (in the copyright file) so we
do need to find out from the project what to put, and a statement in
the source would be a good way to communicate that, but a notice on
the project website or even an email from a representative would also
do the job.
That is correct. There must be a copyright statement or the license
information is not legally valid (because only someone who claims
copyright
can issue a license). However, it doesn’t expressly need to be in
the tarball
(see below). That part is simply best practice, because it maintain the
copyright information if the project is forked or upstream
disappears, which
otherwise can be difficult to determine if it was only on a website
that is now
defunct or in an email sent to a Debian developer who is no longer
participating in the project.
So, there is a distinction between what is the minimum legal
requirement and
what is best practice.
thatMy recommendation would be that you communicate to the upstream
project
ofthey need to include the copyright and licensing information in the
root
their repository, preferably all in one file, as a minimum
requirement for
you to be willing to package their project in Debian.
I don't think this is correct. And we should be happy to package
anything which is actually free software. We don't get to impose extra
requirements before we will package something.
As pointed out above, there is a distinction between what is the minimum
requirement for packaging in Debian and best practice. I carefully
worded
point 2 in my original email to state that, if **I** were packaging this
software, I would communicate with upstream that if they wanted
**me** to
package their software in Debian, my minimum requirement would be
that they
explicitly state the copyright information in the source code.
Originally I
had a point 3, which I deleted before sending the email, explaining
that my
personal preference for when I would be willing to package software
is higher
than Debian’s requirement, and that a website notation or email
communication
of copyright has been used in some packages in the past, but with the
downside
described above. I took out point 3 because I felt it muddied the
waters, but
since the point has been brought up, it is worth discussing.
They should put a copy of the LGPL in (in a file called 'COPYING' or
'LICENCE' by convention) (if this isn't done already). A copyright
notice for the project should _not_ go in the same file (The LGPL
already has one for the LGPL authorship itself, so this is probably
the only file in the distribution which should definitiely _not_ have
the project copyright notice). It should ideally be a header on at
least
one source file, (preferably all of them), but could be any README, or
even just a notice on the project website, or an email saying '
I must disagree with you on this point. It is perfectly fine to ship
the
copyright and the license in two separate files, but it is also
perfectly fine
to ship them in the same file. I do so in my upstream project linked
in a
previous email, and Debian does so in debian/copyright. Using a file
named
LICENSE or COPYING or AUTHORS is fairly standard, but exactly how
this is done
doesn’t matter as long as both copyright (with years) and license are
communicated.
Soren,
... but it is also perfectly fine to ship them in the same file.
I think what Wookey is referring to is that GPL and LGPL licenses contain
a line that says something like:
'Copyright (C) 1991, 1999 Free Software Foundation, Inc.'
I believe this copyright refers to the text of the license itself. Hence, it might not be a good idea to include a second copyright in this same file.
On Tuesday, March 5, 2024 2:15:24 PM MST Alan M Varghese wrote:
Soren,
... but it is also perfectly fine to ship them in the same file.
I think what Wookey is referring to is that GPL and LGPL licensescontain
a line that says something like:
'Copyright (C) 1991, 1999 Free Software Foundation, Inc.'
I believe this copyright refers to the text of the license itself.Hence, it
might not be a good idea to include a second copyright in this samefile.
I assume that is what he is referring to, but it really isn’t a
problem. You typically list the project copyright above the license. Below, you list the license, which can include the copyright of the
license text itself.
As I mentioned in the previous email, this is done all the time,
including in debian/copyright files if the follows the recommended
format.
https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
As an example, see the debian copyright file for privacybrowser, which
is one of the packages I maintain:
https://salsa.debian.org/soren/privacybrowser/-/blob/master/debian/copyright?ref_type=heads
Also, see how it is handled upstream:
https://gitweb.stoutner.com/?p=PrivacyBrowserPC.git;a=blob;f=COPYING;hb=HEAD
And on the web interface:
https://www.stoutner.com/privacy-browser-pc/licenses/
The point being that a single file can contain multiple pieces of
copyright and license information without problem, as long as all of
the information is clearly communicated. In fact, in many cases, like scenarios where there are multiple differing copyrights or licenses
involved in a project (see, for example, the Chromium package), not
listing all the different copyrights and licenses is incomplete.
https://salsa.debian.org/chromium-team/chromium/-/blob/master/debian/copyright?ref_type=heads
--
Soren Stoutner
[email protected]
| Sysop: | Keyop |
|---|---|
| Location: | Huddersfield, West Yorkshire, UK |
| Users: | 715 |
| Nodes: | 16 (2 / 14) |
| Uptime: | 15:36:40 |
| Calls: | 12,102 |
| Calls today: | 2 |
| Files: | 15,004 |
| Messages: | 6,518,049 |