License files in debuginfo packages

[Jason L Tibbitts III]

Does Fedora/Red Hat Legal have any opinion on whether debuginfo packages
need to include license files?

Background:

There is a packaging guideline, drafted long ago according to
requirements given by the legal team, regarding the placement of license
files as they relate to subpackages:
https://fedoraproject.org/wiki/Packaging:LicensingGuidelines#Subpackage_L...

However, RPM itself generates debuginfo packages automatically in a way
that's not really controllable by the packager.  These packages do not
have dependencies on the base packages and will not generally include
license files.

Since, like drpms and such, they are a non-packager-controlled product
of the build system, the packaging committee hasn't ever considered them
subject to most guidelines besides a general "turn them off if they
aren't useful" rule.  Personally I'd like to keep doing that, but an FPC
ticket was opened (https://fedorahosted.org/fpc/ticket/639), so....

I will relay any feedback back to the packaging committee.

 - J<

[Mark Wielaard]

Hi Jason,

On Wed, 2016-07-13 at 04:18 -0500, Jason Tibbitts wrote:
>  However, RPM itself generates debuginfo packages automatically in a
> way
>  that's not really controllable by the packager.  These packages do not
>  have dependencies on the base packages and will not generally include
>  license files. 
I happen to be working on improvements to rpmbuild debuginfo packages:
https://taiga.fedorainfracloud.org/project/mjw-better-rpm-debuginfo-packa...
If legal provides guidelines that might require rpmbuild changes then
please feel free to add a wishlist item or add me to the CC of any
bugzilla item.

Cheers,

Mark

[Richard Fontana]

On Wed, Jul 13, 2016 at 11:36:05AM +0200, Mark Wielaard wrote:
>  Hi Jason,
>  
>  On Wed, 2016-07-13 at 04:18 -0500, Jason Tibbitts wrote:
>  > However, RPM itself generates debuginfo packages automatically in a way
>  > that's not really controllable by the packager.  These packages do not
>  > have dependencies on the base packages and will not generally include
>  > license files.
>  
>  I happen to be working on improvements to rpmbuild debuginfo packages:
>
> https://taiga.fedorainfracloud.org/project/mjw-better-rpm-debuginfo-packa...
>  If legal provides guidelines that might require rpmbuild changes then
>  please feel free to add a wishlist item or add me to the CC of any
>  bugzilla item. 
In my opinion rpmbuild debuginfo packages should include license
files.

Richard

[Neal Gompa]

On Thu, Jul 14, 2016 at 2:43 PM, Richard Fontana <rfontana(a)redhat.com&gt; wrote:
>  On Wed, Jul 13, 2016 at 11:36:05AM +0200, Mark Wielaard wrote:
> > Hi Jason,
> >
> > On Wed, 2016-07-13 at 04:18 -0500, Jason Tibbitts wrote:
> > > However, RPM itself generates debuginfo packages automatically in a way
> > > that's not really controllable by the packager.  These packages do not
> > > have dependencies on the base packages and will not generally include
> > > license files.
> >
> > I happen to be working on improvements to rpmbuild debuginfo packages:
> >
> https://taiga.fedorainfracloud.org/project/mjw-better-rpm-debuginfo-packa...
> > If legal provides guidelines that might require rpmbuild changes then
> > please feel free to add a wishlist item or add me to the CC of any
> > bugzilla item.
>
>  In my opinion rpmbuild debuginfo packages should include license
>  files.
>  
I don't profess to be a lawyer, but since we already include the
license files in the main packages, and the debuginfo ones require the
main packages anyway, why do we need to have them in there too?

And if we do require them, how would we tell the debuginfo generator
where they are?



-- 
真実はいつも一つ！/ Always, there's only one truth!

[Richard Fontana]

On Thu, Jul 14, 2016 at 09:36:47PM -0400, Neal Gompa wrote:
>  On Thu, Jul 14, 2016 at 2:43 PM, Richard Fontana
> <rfontana(a)redhat.com&gt; wrote:
>  > On Wed, Jul 13, 2016 at 11:36:05AM +0200, Mark Wielaard wrote:
>  >> Hi Jason,
>  >>
>  >> On Wed, 2016-07-13 at 04:18 -0500, Jason Tibbitts wrote:
>  >> > However, RPM itself generates debuginfo packages automatically in a way
>  >> > that's not really controllable by the packager.  These packages do not
>  >> > have dependencies on the base packages and will not generally include
>  >> > license files.
>  >>
>  >> I happen to be working on improvements to rpmbuild debuginfo packages:
>  >>
> https://taiga.fedorainfracloud.org/project/mjw-better-rpm-debuginfo-packa...
>  >> If legal provides guidelines that might require rpmbuild changes then
>  >> please feel free to add a wishlist item or add me to the CC of any
>  >> bugzilla item.
>  >
>  > In my opinion rpmbuild debuginfo packages should include license
>  > files.
>  >
>  
>  I don't profess to be a lawyer, but since we already include the
>  license files in the main packages, and the debuginfo ones require the
>  main packages anyway, why do we need to have them in there too? 
When you say "the debuginfo ones require the main packages", doesn't
that contradict what Jason Tibbitts said ("These packages do not have
dependencies on the base packages")? I just verified that you can
install a debuginfo package with dnf without installing the
corresponding main package. Or am I misunderstanding something?

Richard

[Mark Wielaard]

On Fri, 2016-07-15 at 07:55 -0400, Richard Fontana wrote:
>  On Thu, Jul 14, 2016 at 09:36:47PM -0400, Neal Gompa wrote:
>  > On Thu, Jul 14, 2016 at 2:43 PM, Richard Fontana <rfontana(a)redhat.com&gt; wrote:
>  > > On Wed, Jul 13, 2016 at 11:36:05AM +0200, Mark Wielaard wrote:
>  > >> On Wed, 2016-07-13 at 04:18 -0500, Jason Tibbitts wrote:
>  > >> > However, RPM itself generates debuginfo packages automatically in a
> way
>  > >> > that's not really controllable by the packager.  These packages do
> not
>  > >> > have dependencies on the base packages and will not generally include
>  > >> > license files.
>  > >>
>  > >> I happen to be working on improvements to rpmbuild debuginfo packages:
>  > >>
> https://taiga.fedorainfracloud.org/project/mjw-better-rpm-debuginfo-packa...
>  > >> If legal provides guidelines that might require rpmbuild changes then
>  > >> please feel free to add a wishlist item or add me to the CC of any
>  > >> bugzilla item.
>  > >
>  > > In my opinion rpmbuild debuginfo packages should include license
>  > > files.
>  > >
>  > I don't profess to be a lawyer, but since we already include the
>  > license files in the main packages, and the debuginfo ones require the
>  > main packages anyway, why do we need to have them in there too?
>  
>  When you say "the debuginfo ones require the main packages", doesn't
>  that contradict what Jason Tibbitts said ("These packages do not have
>  dependencies on the base packages")? I just verified that you can
>  install a debuginfo package with dnf without installing the
>  corresponding main package. Or am I misunderstanding something? 
That is right, debuginfo packages don't have a hard requirement for the
main (sub-)package. In fact I am working on making it possible to have
multiple debuginfo packages parallel installable to make it easier to
debug multi-lib packages or get more information when tracing/profiling
different versions installed into containers, or to investigate core
files from different installs:
https://fedoraproject.org/wiki/Changes/ParallelInstallableDebuginfo

Your suggestion to include license files also in the debuginfo packages
actually makes that and some followup ideas like splitting debuginfo
packages like main sub-packages and splitting the sources into a
separate debugsource package a little more complex. We'll have to figure
out where to install those files and how to make them not conflict with
the ones installed by other versions of the debuginfo or main
sub-packages.

Cheers,

Mark

[Jerry James]

On Thu, Jul 14, 2016 at 7:36 PM, Neal Gompa <ngompa13(a)gmail.com&gt; wrote:
>  I don't profess to be a lawyer, but since we already include the
>  license files in the main packages, and the debuginfo ones require the
>  main packages anyway, why do we need to have them in there too? 
I don't think the debuginfo packages do require the main ones, at
least not in F-24:

$ rpm -q --requires glibc-debuginfo
glibc-debuginfo-common = 2.23.1-8.fc24
rpmlib(CompressedFileNames) <= 3.0.4-1
rpmlib(FileDigests) <= 4.6.0-1
rpmlib(PayloadFilesHavePrefix) <= 4.0-1
rpmlib(PayloadIsXz) <= 5.2-1
$ rpm -q --requires glibc-debuginfo-common
rpmlib(CompressedFileNames) <= 3.0.4-1
rpmlib(FileDigests) <= 4.6.0-1
rpmlib(PartialHardlinkSets) <= 4.0.4-1
rpmlib(PayloadFilesHavePrefix) <= 4.0-1
rpmlib(PayloadIsXz) <= 5.2-1

-- 
Jerry James
http://www.jamezone.org/