[Pkg-ia32-libs-maintainers] Bug#480373: Source package contains non-free IETF RFC/I-D

[Simon Josefsson]

Severity: serious
Package: ia32-libs
Version: 2.4
User: debian-release at lists.debian.org
Usertags: nonfree-doc rfc

Hi!

This source package contains the following files from the
IETF under non-free license terms:

  ia32-libs-2.4/srcs/openldap2_2.1.30.dfsg.orig.tar.gz:openldap-2.1.30/doc/drafts/draft-legg-ldapext-component-matching-xx.txt
  ia32-libs-2.4/srcs/openldap2_2.1.30.dfsg.orig.tar.gz:openldap-2.1.30/doc/drafts/draft-zeilenga-ldap-rfc2596-xx.txt
  ia32-libs-2.4/srcs/openldap2_2.1.30.dfsg.orig.tar.gz:openldap-2.1.30/doc/drafts/draft-leach-uuids-guids-xx.txt
  ia32-libs-2.4/srcs/openldap2_2.1.30.dfsg.orig.tar.gz:openldap-2.1.30/doc/drafts/draft-legg-ldap-admin-xx.txt
  ia32-libs-2.4/srcs/openldap2_2.1.30.dfsg.orig.tar.gz:openldap-2.1.30/doc/drafts/draft-zeilenga-ldap-user-schema-xx.txt
  ia32-libs-2.4/srcs/openldap2_2.1.30.dfsg.orig.tar.gz:openldap-2.1.30/doc/drafts/draft-lachman-laser-ldap-mail-routing-xx.txt
  ia32-libs-2.4/srcs/openldap2_2.1.30.dfsg.orig.tar.gz:openldap-2.1.30/doc/drafts/draft-ietf-ldapext-matchedval-xx.txt
  ia32-libs-2.4/srcs/openldap2_2.1.30.dfsg.orig.tar.gz:openldap-2.1.30/doc/drafts/draft-zeilenga-ldap-adlist-xx.txt
  ia32-libs-2.4/srcs/openldap2_2.1.30.dfsg.orig.tar.gz:openldap-2.1.30/doc/drafts/draft-ietf-ldapext-locate-xx.txt
  ia32-libs-2.4/srcs/openldap2_2.1.30.dfsg.orig.tar.gz:openldap-2.1.30/doc/drafts/draft-legg-ldap-gser-abnf-xx.txt
  ia32-libs-2.4/srcs/openldap2_2.1.30.dfsg.orig.tar.gz:openldap-2.1.30/doc/drafts/draft-legg-ldap-acm-admin-xx.txt
  ia32-libs-2.4/srcs/openldap2_2.1.30.dfsg.orig.tar.gz:openldap-2.1.30/doc/drafts/draft-legg-ldap-gser-xx.txt
  ia32-libs-2.4/srcs/openldap2_2.1.30.dfsg.orig.tar.gz:openldap-2.1.30/doc/drafts/draft-zeilenga-ldap-features-xx.txt
  ia32-libs-2.4/srcs/openldap2_2.1.30.dfsg.orig.tar.gz:openldap-2.1.30/doc/drafts/draft-zeilenga-ldap-authzid-xx.txt
  ia32-libs-2.4/srcs/openldap2_2.1.30.dfsg.orig.tar.gz:openldap-2.1.30/doc/drafts/draft-zeilenga-ldap-opattrs-xx.txt
  ia32-libs-2.4/srcs/openldap2_2.1.30.dfsg.orig.tar.gz:openldap-2.1.30/doc/drafts/draft-ietf-ldapext-ldap-c-api-xx.txt
  ia32-libs-2.4/srcs/openldap2_2.1.30.dfsg.orig.tar.gz:openldap-2.1.30/doc/drafts/draft-zeilenga-ldap-t-f-xx.txt

The bug for the openldap2 package is #463964, but the openldap2 package
appear to have been removed from unstable so perhaps it is being removed
altogether.  If that is the case, maybe the simplest is to remove
openldap2 from ia32-libs as well.

The license on RFC/I-Ds is not DFSG-free, see:
 * http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=199810
 * http://release.debian.org/removing-non-free-documentation
 * http://wiki.debian.org/NonFreeIETFDocuments

The lenny release policy says binary and source packages must each be free:
 * http://release.debian.org/lenny/rc_policy.txt

The severity is serious, because this violates the Debian policy:
 * http://www.debian.org/doc/debian-policy/ch-archive.html#s-dfsg

There are (at least) three ways to fix this problem.  In order of
preference:

1. Ask the author of the RFC to re-license the RFC under a free
   license.  A template for this e-mail request can be found at
   http://wiki.debian.org/NonFreeIETFDocuments

2. Remove the non-free material from the source, e.g., by re-packaging
   the upstream archive and adding 'dfsg' to the Debian package
   version name.

3. Move the package to non-free.

General discussions are kindly requested to take place on debian-legal
or debian-devel in the thread with Subject: "Non-free IETF RFC/I-Ds in
source packages".

Thanks,
Simon