New Adobe CMaps license free enough for Debian?

[Jonas Smedegaard]

Hi,

The Ghostscript project includes some so-called "CMap" files contributed
by Adobe, which until recently was shipped with a non-free license
allowing only redistribution:

>Permission is granted for redistribution of this file
>provided this copyright notice is maintained intact and
>that the contents of this file are not altered in any
>way from its original form.

Consequently Ghostscript in Debian have shipped without those CMap
files, hurting (as I understand it) handling of multibyte fonts.

September 25 CMap files was updated in Ghostscript Subversion, with the
following license:

>Redistribution and use in source and binary forms, with or
>without modification, are permitted provided that the
>following conditions are met:
>
>Redistributions of source code must retain the above
>copyright notice, this list of conditions and the following
>disclaimer.
>
>Redistributions in binary form must reproduce the above
>copyright notice, this list of conditions and the following
>disclaimer in the documentation and/or other materials
>provided with the distribution.

Commit message indicates that Ghostscript project interpret the new
license as allowing modifications.  I would like to have the legal teams
opinion on whether this new license is acceptable for the Debian
project.  I am especially concerned about the the initial limitations:
do "use" in source form mean we are allowed only to compile the virgin
code or does that also allow us to derive and compile something else?


Kind regards,

  - Jonas

co-maintainer of Ghostscript for Debian


Please cc me personally on responses, as I am not subscribed to the
list.


 - Jonas

--
* Jonas Smedegaard - idealist & Internet-arkitekt
* Tlf.: [phone]  Website: http://dr.jones.dk/

  [x] quote me freely  [ ] ask before reusing  [ ] keep private

[Francesco Poli (t1000)]

On Sun, 18 Oct 2009 15:28:30 +0200 Jonas Smedegaard wrote:

> Hi,

Hi!  :-)

>
> The Ghostscript project includes some so-called "CMap" files contributed
> by Adobe, which until recently was shipped with a non-free license
> allowing only redistribution:
[...]

> Consequently Ghostscript in Debian have shipped without those CMap
> files, hurting (as I understand it) handling of multibyte fonts.
>
> September 25 CMap files was updated in Ghostscript Subversion, with the
> following license:
>
> >Redistribution and use in source and binary forms, with or
> >without modification, are permitted provided that the
> >following conditions are met:
> >
> >Redistributions of source code must retain the above
> >copyright notice, this list of conditions and the following
> >disclaimer.
> >
> >Redistributions in binary form must reproduce the above
> >copyright notice, this list of conditions and the following
> >disclaimer in the documentation and/or other materials
> >provided with the distribution.

Mmmmh, it seems that you didn't *fully* quote the text of the new
license...

>
> Commit message indicates that Ghostscript project interpret the new
> license as allowing modifications. I would like to have the legal teams
> opinion on whether this new license is acceptable for the Debian
> project.
[...]

According to recent news about this re-licensing, the newly adopted
license is a BSD license:
http://lists.debian.org/debian-legal/2009/09/msg00044.html

The blog post cited in the above message is:
http://bonedaddy.net/pabs3/log/2009/09/24/adobe-data-freed/
and the actual text of the new license is:
http://opensource.adobe.com/wiki/display/cmap/License
which is basically the 3-clause BSD license.

The 3-clause BSD license is a simple and permissive Free Software
non-copyleft license: it is perfectly fine for Debian (main).
There are many other packages in main that are released under
equivalent terms.

[...]
> Please cc me personally on responses, as I am not subscribed to the
> list.

Done.

--
 New location for my website! Update your bookmarks!
 http://www.inventati.org/frx
..................................................... Francesco Poli .
 GnuPG key fpr == C979 F34B 27CE 5CD8 DC12  31B5 78F4 279B DD6D FCF4

[Paul Wise-3]

On Sun, Oct 18, 2009 at 9:28 PM, Jonas Smedegaard <dr@...> wrote:

> September 25 CMap files was updated in Ghostscript Subversion, with the
> following license:
>
>> Redistribution and use in source and binary forms, with or
>> without modification, are permitted provided that the
>> following conditions are met:
>>
>> Redistributions of source code must retain the above
>> copyright notice, this list of conditions and the following
>> disclaimer.
>>
>> Redistributions in binary form must reproduce the above
>> copyright notice, this list of conditions and the following
>> disclaimer in the documentation and/or other materials
>> provided with the distribution.

In addition to Francesco's mail, I'd like to ask why ghostscript is
committing the CMap files to their SVN, shouldn't they just depend on
them instead of making an embedded data copy?

--
bye,
pabs

http://wiki.debian.org/PaulWise


--
To UNSUBSCRIBE, email to debian-legal-REQUEST@...
with a subject of "unsubscribe". Trouble? Contact listmaster@...

[Jonas Smedegaard]

On Sun, Oct 18, 2009 at 04:03:53PM +0200, Francesco Poli wrote:
>On Sun, 18 Oct 2009 15:28:30 +0200 Jonas Smedegaard wrote:

>> September 25 CMap files was updated in Ghostscript Subversion, with
>> the following license:
>>
>> >Redistribution and use in source and binary forms, with or
>> >without modification, are permitted provided that the
>> >following conditions are met:
>> >
>> >Redistributions of source code must retain the above
>> >copyright notice, this list of conditions and the following
>> >disclaimer.
>> >
>> >Redistributions in binary form must reproduce the above
>> >copyright notice, this list of conditions and the following
>> >disclaimer in the documentation and/or other materials
>> >provided with the distribution.
>
>Mmmmh, it seems that you didn't *fully* quote the text of the new
>license...

I believe that I quoted the _license_ part of a CMap source header,
deliberately leaving out the _copyright_ and _disclaimer_ parts, ad I
considered those irrelevant for the question at hand.

Please do educate me if that was a) incorrectly separated, b) bad style
to leave out those other parts for questions like this or c) something
else was wrong with what I did.

Here is verbatim the top 43 lines of that same CMap file, rev10096 of
http://svn.ghostscript.com/ghostscript/trunk/gs/Resource/CMap/78-EUC-H :

%!PS-Adobe-3.0 Resource-CMap
%%DocumentNeededResources: ProcSet (CIDInit)
%%IncludeResource: ProcSet (CIDInit)
%%BeginResource: CMap (78-EUC-H)
%%Title: (78-EUC-H Adobe Japan1 0)
%%Version: 10.003
%%Copyright: -----------------------------------------------------------
%%Copyright: Copyright 1990-2009 Adobe Systems Incorporated.
%%Copyright: All rights reserved.
%%Copyright:
%%Copyright: Redistribution and use in source and binary forms, with or
%%Copyright: without modification, are permitted provided that the
%%Copyright: following conditions are met:
%%Copyright:
%%Copyright: Redistributions of source code must retain the above
%%Copyright: copyright notice, this list of conditions and the following
%%Copyright: disclaimer.
%%Copyright:
%%Copyright: Redistributions in binary form must reproduce the above
%%Copyright: copyright notice, this list of conditions and the following
%%Copyright: disclaimer in the documentation and/or other materials
%%Copyright: provided with the distribution..
%%Copyright:
%%Copyright: Neither the name of Adobe Systems Incorporated nor the names
%%Copyright: of its contributors may be used to endorse or promote
%%Copyright: products derived from this software without specific prior
%%Copyright: written permission..
%%Copyright:
%%Copyright: THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND
%%Copyright: CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES,
%%Copyright: INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
%%Copyright: MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
%%Copyright: DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR
%%Copyright: CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
%%Copyright: SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
%%Copyright: NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
%%Copyright: LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
%%Copyright: HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
%%Copyright: CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
%%Copyright: OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
%%Copyright: SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
%%Copyright: -----------------------------------------------------------
%%EndComments




>> Commit message indicates that Ghostscript project interpret the new
>> license as allowing modifications. I would like to have the legal
>> teams opinion on whether this new license is acceptable for the
>> Debian project.
>[...]
>
>According to recent news about this re-licensing, the newly adopted
>license is a BSD license:
>http://lists.debian.org/debian-legal/2009/09/msg00044.html

Oh, above thread started as a dialog with Masayuki Hatta.  Odd that he
did not inform his fellow package maintainers of Ghostscript... :-/


>The blog post cited in the above message is:
>http://bonedaddy.net/pabs3/log/2009/09/24/adobe-data-freed/
>and the actual text of the new license is:
>http://opensource.adobe.com/wiki/display/cmap/License
>which is basically the 3-clause BSD license.

Oh, ok.  I did not recognize it as BSD license.  Thanks for the
clarification.


  - Jonas

--
* Jonas Smedegaard - idealist & Internet-arkitekt
* Tlf.: [phone]  Website: http://dr.jones.dk/

  [x] quote me freely  [ ] ask before reusing  [ ] keep private

[Jonas Smedegaard]

On Sun, Oct 18, 2009 at 10:24:56PM +0800, Paul Wise wrote:

>On Sun, Oct 18, 2009 at 9:28 PM, Jonas Smedegaard <dr@...> wrote:
>
>> September 25 CMap files was updated in Ghostscript Subversion, with the
>> following license:
>>
>>> Redistribution and use in source and binary forms, with or
>>> without modification, are permitted provided that the
>>> following conditions are met:
>>>
>>> Redistributions of source code must retain the above
>>> copyright notice, this list of conditions and the following
>>> disclaimer.
>>>
>>> Redistributions in binary form must reproduce the above
>>> copyright notice, this list of conditions and the following
>>> disclaimer in the documentation and/or other materials
>>> provided with the distribution.
>
>In addition to Francesco's mail, I'd like to ask why ghostscript is
>committing the CMap files to their SVN, shouldn't they just depend on
>them instead of making an embedded data copy?

We (the Debian ghostscript team) do not include CMap files, upstream do.

They include several software parts that we then avoid using - more so
in recent cleanups made by me, and even more (separate packaging of
jbig2dec) still pending.

Masayuki Hatta is probably more knowledgable about CMap files than me.  
I just didn't hear from him for a long time so did not expect him to be
active currently.


  - Jonas

--
* Jonas Smedegaard - idealist & Internet-arkitekt
* Tlf.: [phone]  Website: http://dr.jones.dk/

  [x] quote me freely  [ ] ask before reusing  [ ] keep private

[Francesco Poli (t1000)]

On Sun, 18 Oct 2009 19:05:44 +0200 Jonas Smedegaard wrote:

> On Sun, Oct 18, 2009 at 04:03:53PM +0200, Francesco Poli wrote:
[...]
> >Mmmmh, it seems that you didn't *fully* quote the text of the new
> >license...
>
> I believe that I quoted the _license_ part of a CMap source header,
> deliberately leaving out the _copyright_ and _disclaimer_ parts, ad I
> considered those irrelevant for the question at hand.
>
> Please do educate me if that was a) incorrectly separated,

I would say you left out the third clause, which is the difference
between the 3-clause BSD license and the 2-clause BSD license...

> b) bad style
> to leave out those other parts for questions like this

I personally think that the copyright notice is important to quote too,
as we are talking about a specific work, rather than about a license in
a vacuum.

Moreover, the disclaimer is typically "attached" to the license, and is
part of the legal text that grants the permissions we need.
In some licenses, it is even more entwined with the rest of the legal
text.
I think the disclaimer should be fully quoted too.

[...]
> Here is verbatim the top 43 lines of that same CMap file, rev10096 of
> http://svn.ghostscript.com/ghostscript/trunk/gs/Resource/CMap/78-EUC-H :
[...]

This seems to actually correspond to
http://opensource.adobe.com/wiki/display/cmap/License

Good.

> >The blog post cited in the above message is:
> >http://bonedaddy.net/pabs3/log/2009/09/24/adobe-data-freed/
> >and the actual text of the new license is:
> >http://opensource.adobe.com/wiki/display/cmap/License
> >which is basically the 3-clause BSD license.
>
> Oh, ok.  I did not recognize it as BSD license.  Thanks for the
> clarification.

You're welcome!  :-)


--
 New location for my website! Update your bookmarks!
 http://www.inventati.org/frx
..................................................... Francesco Poli .
 GnuPG key fpr == C979 F34B 27CE 5CD8 DC12  31B5 78F4 279B DD6D FCF4

[Jonas Smedegaard]

On Tue, Oct 20, 2009 at 12:32:36AM +0200, Francesco Poli wrote:

>On Sun, 18 Oct 2009 19:05:44 +0200 Jonas Smedegaard wrote:
>
>> On Sun, Oct 18, 2009 at 04:03:53PM +0200, Francesco Poli wrote:
>[...]
>> >Mmmmh, it seems that you didn't *fully* quote the text of the new
>> >license...
>>
>> I believe that I quoted the _license_ part of a CMap source header,
>> deliberately leaving out the _copyright_ and _disclaimer_ parts, ad I
>> considered those irrelevant for the question at hand.
>>
>> Please do educate me if that was a) incorrectly separated,
>
>I would say you left out the third clause, which is the difference
>between the 3-clause BSD license and the 2-clause BSD license...

Ah, ok.

>> b) bad style
>> to leave out those other parts for questions like this
>
>I personally think that the copyright notice is important to quote too,
>as we are talking about a specific work, rather than about a license in
>a vacuum.
>
>Moreover, the disclaimer is typically "attached" to the license, and is
>part of the legal text that grants the permissions we need.
>In some licenses, it is even more entwined with the rest of the legal
>text.
>I think the disclaimer should be fully quoted too.

Thanks for educating me! :-)


  - Jonas

--
* Jonas Smedegaard - idealist & Internet-arkitekt
* Tlf.: [phone]  Website: http://dr.jones.dk/

  [x] quote me freely  [ ] ask before reusing  [ ] keep private

[MJ Ray-2]

Jonas Smedegaard wrote:
> I believe that I quoted the _license_ part of a CMap source header,
> deliberately leaving out the _copyright_ and _disclaimer_ parts, ad I
> considered those irrelevant for the question at hand.

I think it's probably important to have the disclaimer because some
licensors have tried to slip licence restrictions or liabilities into
what they labelled as disclaimers; and it's useful to know the
copyright holder in case it's one of the few that insists on
particular interpretations of terms like "use".

It also makes it slightly easier to spot common-licenses and compare
with them with wdiff because they are included in debian whole.

Thanks for asking.  I've nothing much to add to other comments on
the substantial question.  ccing as originally requested.

Hope that helps,
--
MJR/slef
My Opinion Only: see http://people.debian.org/~mjr/
Please follow http://www.uk.debian.org/MailingLists/#codeofconduct


--
To UNSUBSCRIBE, email to debian-legal-REQUEST@...
with a subject of "unsubscribe". Trouble? Contact listmaster@...

[Jonas Smedegaard]

On Tue, Oct 20, 2009 at 11:22:12AM +0100, MJ Ray wrote:

>Jonas Smedegaard wrote:
>> I believe that I quoted the _license_ part of a CMap source header,
>> deliberately leaving out the _copyright_ and _disclaimer_ parts, ad I
>> considered those irrelevant for the question at hand.
>
>I think it's probably important to have the disclaimer because some
>licensors have tried to slip licence restrictions or liabilities into
>what they labelled as disclaimers; and it's useful to know the
>copyright holder in case it's one of the few that insists on
>particular interpretations of terms like "use".
>
>It also makes it slightly easier to spot common-licenses and compare
>with them with wdiff because they are included in debian whole.
>
>Thanks for asking.  I've nothing much to add to other comments on
>the substantial question.  ccing as originally requested.
>
>Hope that helps,

It certainly helps - all the input from you guys!

I will now go through my (or "my" where team-maintained) 90+ packages
and make sure disclaimers are included.

...oh, a related question: when including disclaimer of older
GPL-licenses then lintian complains that the address is wrong - but
isn't it wrong of us to "correct" that, as then the text is no longer
"verbatim"?

(sorry if this is a FAQ somewhere)


Regards,

  - Jonas

--
* Jonas Smedegaard - idealist & Internet-arkitekt
* Tlf.: [phone]  Website: http://dr.jones.dk/

  [x] quote me freely  [ ] ask before reusing  [ ] keep private

[Ben Finney-5]

Jonas Smedegaard <dr@...> writes:

> On Tue, Oct 20, 2009 at 11:22:12AM +0100, MJ Ray wrote:
> >I think it's probably important to have the disclaimer because some
> >licensors have tried to slip licence restrictions or liabilities into
> >what they labelled as disclaimers; and it's useful to know the
> >copyright holder in case it's one of the few that insists on
> >particular interpretations of terms like "use".

I interpret MJ here as saying that it's useful to include the full text
*in the discussion here on ‘debian-legal’*, and not commenting on
whether it's appropriate for the ‘copyright’ file.

Perhaps I'm wrong and MJ does intend to comment on the ‘copyright’ file
contents.

> I will now go through my (or "my" where team-maintained) 90+ packages
> and make sure disclaimers are included.

I don't think the disclaimer is part of the copyright license terms, so
doesn't need to be in ‘copyright’. You certainly need to preserve it in
the original upstream source files, of course! But I don't see the need
to duplicate it.

> ...oh, a related question: when including disclaimer of older
> GPL-licenses then lintian complains that the address is wrong - but
> isn't it wrong of us to "correct" that, as then the text is no longer
> "verbatim"?

Yes, you're right. If the copyright license is one that you think
upstream has neglected to update, you should work with upstream to
address that, and not change it on their behalf since you're not the
copyright holder who granted the license.

--
 \      “He that would make his own liberty secure must guard even his |
  `\                             enemy from oppression.” —Thomas Paine |
_o__)                                                                  |
Ben Finney

[Ben Finney-5]

Ben Finney <ben+debian@...> writes:

> Jonas Smedegaard <dr@...> writes:
> > I will now go through my (or "my" where team-maintained) 90+
> > packages and make sure disclaimers are included.
>
> I don't think the disclaimer is part of the copyright license terms,
> so doesn't need to be in ‘copyright’. You certainly need to preserve
> it in the original upstream source files, of course! But I don't see
> the need to duplicate it.

Belay that. On further consideration, the disclaimer is not a
*condition* of the license (it's not something that restricts the
recipient's exercise of their rights in the work), but it is a *term* of
the license (something that's part of the deal received by the
recipient). Therefore it needs to be documented in ‘copyright’.

IANAL and I may be using these terms incorrectly; but the reasoning
seems sound to me. Hopefully any errors can be pointed out gleefully by
others :-)

--
 \         “What is it that makes a complete stranger dive into an icy |
  `\   river to save a solid gold baby? Maybe we'll never know.” —Jack |
_o__)                                                           Handey |
Ben Finney

[Masayuki Hatta-2]

Hi,

At Sun, 18 Oct 2009 19:13:09 +0200,

> >In addition to Francesco's mail, I'd like to ask why ghostscript is
> >committing the CMap files to their SVN, shouldn't they just depend
> >on them instead of making an embedded data copy?
>
> We (the Debian ghostscript team) do not include CMap files, upstream
> do.

Yes, and I had been removing them from orig.tar.gz manually whenever
the new upstream release came out...

I don't know why they include CMaps in the upstream tarball.  My guess
is, until very recently, Adobe didn't release CMaps in a coherent way
-- sometimes a part of Acrobat, sometimes a part of something, such as
the example files of Lunde's CJKV book, or mysteriously appear out of
the blue in somewhere at ftp.adobe.com, etc.  And in some cases those
were a little bit different from each other.  I guess that's one of
the reason the upstream decided to include their own copy of CMaps in
GS tarball.

Of course, now the situation has changed, so it's possibly worth
trying to convince the upstream not to include CMaps in the upstream
tarball.  It became a mere redundancy.

Also, I know some Debian packages currently contain or use their own
copy of Cmaps.  For example, poppler uses poppler-data, which contains
Cmaps.  IIRC xpdf-* and dvipdfmx have some Cmaps, too.  I think we
should begin a coordinated effort to identify such packages and try to
convince the upstream or Debian maintainers to use Cmaps in
cmap-adobe-* instead.  Possibly we need some very short Debian Cmap
policy or such, I guess.

> They include several software parts that we then avoid using - more
> so in recent cleanups made by me, and even more (separate packaging
> of jbig2dec) still pending.

That's their tradition -- they want their customers to use the
libraries included in the upstream tarball, so that they can
(hopefully) reproduce any problem their customer has experienced.
From a security perspective, it's a nightmare.

> Masayuki Hatta is probably more knowledgable about CMap files than
> me.  I just didn't hear from him for a long time so did not expect
> him to be active currently.

Still buried under a pile of everyday odd jobs -- sorry but you are
doing fine ;-) Hopefully I'll be back soon.

Best regards,
MH

--
Masayuki Hatta
Graduate School of Economics, The University of Tokyo
Manufacturing Management Research Center, The University of Tokyo

mhatta@... / mhatta@...
mhatta@... / mhatta@... / mhatta@...


--
To UNSUBSCRIBE, email to debian-legal-REQUEST@...
with a subject of "unsubscribe". Trouble? Contact listmaster@...

[Paul Wise-3]

On Wed, Oct 21, 2009 at 8:53 AM,  <mhatta@...> wrote:

> Also, I know some Debian packages currently contain or use their own
> copy of Cmaps.  For example, poppler uses poppler-data, which contains
> Cmaps.  IIRC xpdf-* and dvipdfmx have some Cmaps, too.  I think we
> should begin a coordinated effort to identify such packages and try to
> convince the upstream or Debian maintainers to use Cmaps in
> cmap-adobe-* instead.  Possibly we need some very short Debian Cmap
> policy or such, I guess.

IMO, just file some wishlist bugs for all the packages containing a
copy of the Cmap files.

--
bye,
pabs

http://wiki.debian.org/PaulWise


--
To UNSUBSCRIBE, email to debian-legal-REQUEST@...
with a subject of "unsubscribe". Trouble? Contact listmaster@...