Debian packaging: Files with missing license and copyright information

[ViviCoder]

I am working on packaging netcdf-java for Debian, but I am facing some issues that need to be solved before going further. As you may know, the Debian policy is pretty strict about what is redistributable and what is not. In particular, binary files without sources are strongly discouraged. Besides, two files (cdm/core/src/main/java/ucar/unidata/geoloc/projection/Gdc_To_Utm_Converter.java and Utm_To_Gdc_Converter.java) are under the GeoTransform License, which is most likely not compliant with the Debian Free Software Guidelines. But that is not the real issue here.

A lot of files (including java source file httpservices/src/test/java/ucar/httpservices/TestUrlCreds.java) have no license or copyright information. Others have only Copyright (e.g. cdm/core/src/main/java/ucar/nc2/AttributeContainerHelper.java) or Copyright Unidata (e.g. cdm/core/src/main/java/ucar/nc2/dataset/NetcdfDatasets.java) without license information. Others refer to files, such as LICENSE.txt (e.g. cdm/core/src/main/java/ucar/nc2/ncml/AggregationFmrc.java), COPYRIGHT (e.g. files in cdm/core/src/test/java/examples/), or NOTICE (e.g. httpservices/src/main/java/ucar/httpservices/HTTPCredentialsProvider.java), that do not exist. Finally, others contain a main copyright and license notice plus an additional copyright for some parts of the files, without specifying the license associated with the latter (e.g. cdm/core/src/main/java/ucar/nc2/dataset/conv/Cosmic1Convention.java).

[lesserwhirls]

Greetings! Thank you for reaching out. I'll need to look deeper at the classes from GeoTransform and get back with you on those, as well find the license for the code translated from Cosmic fortran routines. The missing copyright and license blocks in the test code can be added pretty easily.

In terms of distributing netCDF-Java through Debian, what specifically are you looking to distribute? The project builds several maven artifacts, as well as a few stand alone jars, and the licenses for each of those may differ quite a bit.

[ViviCoder]

Thank you for the quick response. Originally, I wanted to package the netCDF Java library because it is a dependency of HDFView. I was quite surprised to see that netCDF-Java contains much more than what I would have called netCDF-Java myself. After digging a bit, I found that the only thing that I really need is the cdm core library, but if packaging other things is not too difficult, I might as well. In the end, because of dependencies that are not in Debian, I was only able to build a restricted set of subprojects: bufr, cdm-core, cdm-image, cdm-misc, cdm-radial, dap4, httpservices, netcdf4, and udunits.

[ViviCoder]

I have a few more related questions. What is the license and copyright of all the tables (and other files) located in resources directories? What is the purpose of the files located in sources directories? Concerning the documentation, what would be worth distributing in Debian? And what would be distributable in the first place? The copyright information looks pretty unclear/incomplete. For instance, what is the license of the NSF logo?

[ViviCoder]

Another comment: in the subprojects that include code from third-party software components (buildSrc, waterml, testUtil), it is not clear what actually comes from the original software and what has been added by netcdf-java, because there is often no individual copyright statement. Of course, you can use the same license as the original software for these subprojects, but you probably cannot use their copyright for pieces they did not write.

[JohnLCaron]

Hi @ViviCoder

Im not sure if you are still working on this, but we are working on solving problems with the legacy code, such as:

1. making our library more modular, so you can just include what you need.
2. getting rid of library dependencies where possible
3. getting everything with proper copyrights.

Most/all of the files with additional copyrights are not central to the library, not sure if you can just make a version without them?

We are doing a "rapid" release cycle of major versions, and in many ways it would be better to wait until that slows down, as these intermediate versions are intended to be bridges to a smaller, long term maintainable library. Probably at least version 7 or 8, nominally in 6 months and a year from now, respectively. If that is useful to you, we can work with you to make sure to satisfy your requirements.

John Caron

[ViviCoder]

Hi @JohnLCaron

I am still interested in packaging netcdf-java for Debian, so let me know if you need any input from my side.

[pombredanne]

gentle ping.... this is an issue well beyond Debian packaging and for any user of netcdf... There is also code in https://github.com/Unidata/netcdf-java/tree/6cfc989b91f492edc2a6980e65263075a11e8347/cdm/core/src/main/java/uk/ac/rdg/resc/edal/time which is missing attribution in the binaries BTW (this is under a BSD-license)

Also the license for geotransform mentioned in https://github.com/Unidata/netcdf-java/issues/335#issue-642643658 seems pretty onerous and 100% not open source, reading a bit like a license that would say: "All your bases are belong to us"

See https://web.archive.org/web/20200127152653/http://www.ai.sri.com/geotransform/license.html

[tdrwenski]

Hi @pombredanne, thanks for your comment. We updated the netcdfAll.jar to contain both our own license and some third party licenses (including the one you pointed out was missing). The third party licenses included are not yet an exhaustive list unfortunately. The changes will be in tomorrow's snapshot.

Regarding the geotransform license-- We are trying to reduce our third party dependencies but I'm not sure at the moment how easy it is to replace this one.