Does Fedora/Red Hat Legal have any opinion on whether debuginfo packages need to include license files?
Background:
There is a packaging guideline, drafted long ago according to requirements given by the legal team, regarding the placement of license files as they relate to subpackages: https://fedoraproject.org/wiki/Packaging:LicensingGuidelines#Subpackage_Lice...
However, RPM itself generates debuginfo packages automatically in a way that's not really controllable by the packager. These packages do not have dependencies on the base packages and will not generally include license files.
Since, like drpms and such, they are a non-packager-controlled product of the build system, the packaging committee hasn't ever considered them subject to most guidelines besides a general "turn them off if they aren't useful" rule. Personally I'd like to keep doing that, but an FPC ticket was opened (https://fedorahosted.org/fpc/ticket/639), so....
I will relay any feedback back to the packaging committee.
- J<
Hi Jason,
On Wed, 2016-07-13 at 04:18 -0500, Jason Tibbitts wrote:
However, RPM itself generates debuginfo packages automatically in a way that's not really controllable by the packager. These packages do not have dependencies on the base packages and will not generally include license files.
I happen to be working on improvements to rpmbuild debuginfo packages: https://taiga.fedorainfracloud.org/project/mjw-better-rpm-debuginfo-package-... If legal provides guidelines that might require rpmbuild changes then please feel free to add a wishlist item or add me to the CC of any bugzilla item.
Cheers,
Mark
On Wed, Jul 13, 2016 at 11:36:05AM +0200, Mark Wielaard wrote:
Hi Jason,
On Wed, 2016-07-13 at 04:18 -0500, Jason Tibbitts wrote:
However, RPM itself generates debuginfo packages automatically in a way that's not really controllable by the packager. These packages do not have dependencies on the base packages and will not generally include license files.
I happen to be working on improvements to rpmbuild debuginfo packages: https://taiga.fedorainfracloud.org/project/mjw-better-rpm-debuginfo-package-... If legal provides guidelines that might require rpmbuild changes then please feel free to add a wishlist item or add me to the CC of any bugzilla item.
In my opinion rpmbuild debuginfo packages should include license files.
Richard
On Thu, Jul 14, 2016 at 2:43 PM, Richard Fontana rfontana@redhat.com wrote:
On Wed, Jul 13, 2016 at 11:36:05AM +0200, Mark Wielaard wrote:
Hi Jason,
On Wed, 2016-07-13 at 04:18 -0500, Jason Tibbitts wrote:
However, RPM itself generates debuginfo packages automatically in a way that's not really controllable by the packager. These packages do not have dependencies on the base packages and will not generally include license files.
I happen to be working on improvements to rpmbuild debuginfo packages: https://taiga.fedorainfracloud.org/project/mjw-better-rpm-debuginfo-package-... If legal provides guidelines that might require rpmbuild changes then please feel free to add a wishlist item or add me to the CC of any bugzilla item.
In my opinion rpmbuild debuginfo packages should include license files.
I don't profess to be a lawyer, but since we already include the license files in the main packages, and the debuginfo ones require the main packages anyway, why do we need to have them in there too?
And if we do require them, how would we tell the debuginfo generator where they are?
On Thu, Jul 14, 2016 at 09:36:47PM -0400, Neal Gompa wrote:
On Thu, Jul 14, 2016 at 2:43 PM, Richard Fontana rfontana@redhat.com wrote:
On Wed, Jul 13, 2016 at 11:36:05AM +0200, Mark Wielaard wrote:
Hi Jason,
On Wed, 2016-07-13 at 04:18 -0500, Jason Tibbitts wrote:
However, RPM itself generates debuginfo packages automatically in a way that's not really controllable by the packager. These packages do not have dependencies on the base packages and will not generally include license files.
I happen to be working on improvements to rpmbuild debuginfo packages: https://taiga.fedorainfracloud.org/project/mjw-better-rpm-debuginfo-package-... If legal provides guidelines that might require rpmbuild changes then please feel free to add a wishlist item or add me to the CC of any bugzilla item.
In my opinion rpmbuild debuginfo packages should include license files.
I don't profess to be a lawyer, but since we already include the license files in the main packages, and the debuginfo ones require the main packages anyway, why do we need to have them in there too?
When you say "the debuginfo ones require the main packages", doesn't that contradict what Jason Tibbitts said ("These packages do not have dependencies on the base packages")? I just verified that you can install a debuginfo package with dnf without installing the corresponding main package. Or am I misunderstanding something?
Richard
On Fri, 2016-07-15 at 07:55 -0400, Richard Fontana wrote:
On Thu, Jul 14, 2016 at 09:36:47PM -0400, Neal Gompa wrote:
On Thu, Jul 14, 2016 at 2:43 PM, Richard Fontana rfontana@redhat.com wrote:
On Wed, Jul 13, 2016 at 11:36:05AM +0200, Mark Wielaard wrote:
On Wed, 2016-07-13 at 04:18 -0500, Jason Tibbitts wrote:
However, RPM itself generates debuginfo packages automatically in a way that's not really controllable by the packager. These packages do not have dependencies on the base packages and will not generally include license files.
I happen to be working on improvements to rpmbuild debuginfo packages: https://taiga.fedorainfracloud.org/project/mjw-better-rpm-debuginfo-package-... If legal provides guidelines that might require rpmbuild changes then please feel free to add a wishlist item or add me to the CC of any bugzilla item.
In my opinion rpmbuild debuginfo packages should include license files.
I don't profess to be a lawyer, but since we already include the license files in the main packages, and the debuginfo ones require the main packages anyway, why do we need to have them in there too?
When you say "the debuginfo ones require the main packages", doesn't that contradict what Jason Tibbitts said ("These packages do not have dependencies on the base packages")? I just verified that you can install a debuginfo package with dnf without installing the corresponding main package. Or am I misunderstanding something?
That is right, debuginfo packages don't have a hard requirement for the main (sub-)package. In fact I am working on making it possible to have multiple debuginfo packages parallel installable to make it easier to debug multi-lib packages or get more information when tracing/profiling different versions installed into containers, or to investigate core files from different installs: https://fedoraproject.org/wiki/Changes/ParallelInstallableDebuginfo
Your suggestion to include license files also in the debuginfo packages actually makes that and some followup ideas like splitting debuginfo packages like main sub-packages and splitting the sources into a separate debugsource package a little more complex. We'll have to figure out where to install those files and how to make them not conflict with the ones installed by other versions of the debuginfo or main sub-packages.
Cheers,
Mark
On Thu, Jul 14, 2016 at 7:36 PM, Neal Gompa ngompa13@gmail.com wrote:
I don't profess to be a lawyer, but since we already include the license files in the main packages, and the debuginfo ones require the main packages anyway, why do we need to have them in there too?
I don't think the debuginfo packages do require the main ones, at least not in F-24:
$ rpm -q --requires glibc-debuginfo glibc-debuginfo-common = 2.23.1-8.fc24 rpmlib(CompressedFileNames) <= 3.0.4-1 rpmlib(FileDigests) <= 4.6.0-1 rpmlib(PayloadFilesHavePrefix) <= 4.0-1 rpmlib(PayloadIsXz) <= 5.2-1 $ rpm -q --requires glibc-debuginfo-common rpmlib(CompressedFileNames) <= 3.0.4-1 rpmlib(FileDigests) <= 4.6.0-1 rpmlib(PartialHardlinkSets) <= 4.0.4-1 rpmlib(PayloadFilesHavePrefix) <= 4.0-1 rpmlib(PayloadIsXz) <= 5.2-1
-
Jason L Tibbitts III -
Jerry James -
Mark Wielaard -
Neal Gompa -
Richard Fontana