Bug#869180: src:hydrogen-drumkits: source contains unlicensed material (bogusly treated as GPL-2)

[Jonas Smedegaard]

Package: src:hydrogen-drumkits
Version: 2015.09.28-1
Severity: serious
Justification: Policy 2.2.1

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

These drumkits are in upstream metadata listed _without_ license:

ColomboAcousticDrumkit (sf)
EasternHop (sf)
Electric Empire (sf)
HardElectro (sf)
HipHop-1 (sf)
HipHop-2 (sf)
Millo's MultiLayered 2 (sf)
Synthie-1 (sf)
VariBreaks (sf)

In Debian copyright file those are listed as licensed GPL-2.

- Jonas

[James Cowgill]

Hi,

Post by Jonas Smedegaard
Package: src:hydrogen-drumkits
Version: 2015.09.28-1
Severity: serious
Justification: Policy 2.2.1
ColomboAcousticDrumkit (sf)
EasternHop (sf)
Electric Empire (sf)
HardElectro (sf)
HipHop-1 (sf)
HipHop-2 (sf)
Millo's MultiLayered 2 (sf)
Synthie-1 (sf)
VariBreaks (sf)
In Debian copyright file those are listed as licensed GPL-2.

The fact that the metadata doesn't contain a license, does not imply
that these files are not GPL-2. Have you actually checked the license of
any of these?

For instance, a brief google search seems to indicate that the first one
on your list (ColomboAcousticDrumkit) is GPL-2 licensed:
http://freepats.zenvoid.org/Percussion/acoustic-drum-kit.html

James

[Jonas Smedegaard]

Control: retitle -1 src:hydrogen-drumkits: Some sources lack licensing

Quoting James Cowgill (2017-07-21 11:56:15)

Post by James Cowgill

Post by Jonas Smedegaard
Package: src:hydrogen-drumkits
Version: 2015.09.28-1
Severity: serious
Justification: Policy 2.2.1
ColomboAcousticDrumkit (sf)
EasternHop (sf)
Electric Empire (sf)
HardElectro (sf)
HipHop-1 (sf)
HipHop-2 (sf)
Millo's MultiLayered 2 (sf)
Synthie-1 (sf)
VariBreaks (sf)
In Debian copyright file those are listed as licensed GPL-2.

The fact that the metadata doesn't contain a license, does not imply
that these files are not GPL-2. Have you actually checked the license
of any of these?

The issue here is that information about licensing is unavailable in the
source package. Title now rephrased to not avoid assumption.

If licensing is based on external information and/or guesswork, then
that should be documented in debian/copyright.

Post by James Cowgill
For instance, a brief google search seems to indicate that the first one
http://freepats.zenvoid.org/Percussion/acoustic-drum-kit.html

Thanks for the valuable info - now added to debian/copyright.

Do you have similar info for the other sources?


- Jonas

[u***@debian.org]

Post by Jonas Smedegaard

Post by James Cowgill

Post by Jonas Smedegaard
ColomboAcousticDrumkit (sf)
EasternHop (sf)
Electric Empire (sf)
HardElectro (sf)
HipHop-1 (sf)
HipHop-2 (sf)
Millo's MultiLayered 2 (sf)
Synthie-1 (sf)
VariBreaks (sf)
In Debian copyright file those are listed as licensed GPL-2.

The fact that the metadata doesn't contain a license, does not imply
that these files are not GPL-2. Have you actually checked the license
of any of these?

The issue here is that information about licensing is unavailable in the
source package. Title now rephrased to not avoid assumption.
If licensing is based on external information and/or guesswork, then
that should be documented in debian/copyright.

hmm.

the "orig.tar.gz" contains this information, since it includes
"drumkits.json" which includes the licenses for each drumkit as
specified by (their) upstream(s) (which is mostly a casual short name,
rather than the full license text; however, this doesn't make the
licenses any less valid).

since "drumkits.json" is generated by a script in debian/ this might
require some additional information, so:

the licenses are obtained from the same source as the information on
how to obtain the drumkits:
"their drumkit feed" (as it is called in debian/README.source).
with "them" being upstream (hydrogen), and their "drumkit feed" being
http://www.hydrogen-music.org/feeds/drumkit_list.php
it is my understanding that this feed is generated from information
that has been directly entered by the upstreams' of the various
drumkits. i have no reason to distrust this source of information.

therefore, for me the license information *has* been added by
upstream, albeit on a separate channel, and i don't see any problem
with the licenses as stated in d/copyright)

i agree, this should probably be added to the d/README.source

[Jonas Smedegaard]

Post by u***@debian.org

Post by Jonas Smedegaard

Post by James Cowgill

Post by Jonas Smedegaard
ColomboAcousticDrumkit (sf)
EasternHop (sf)
Electric Empire (sf)
HardElectro (sf)
HipHop-1 (sf)
HipHop-2 (sf)
Millo's MultiLayered 2 (sf)
Synthie-1 (sf)
VariBreaks (sf)
In Debian copyright file those are listed as licensed GPL-2.

The fact that the metadata doesn't contain a license, does not imply
that these files are not GPL-2. Have you actually checked the license
of any of these?

The issue here is that information about licensing is unavailable in the
source package. Title now rephrased to not avoid assumption.
If licensing is based on external information and/or guesswork, then
that should be documented in debian/copyright.

hmm.
the "orig.tar.gz" contains this information, since it includes
"drumkits.json" which includes the licenses for each drumkit as
specified by (their) upstream(s) (which is mostly a casual short name,
rather than the full license text; however, this doesn't make the
licenses any less valid).
since "drumkits.json" is generated by a script in debian/ this might
the licenses are obtained from the same source as the information on
"their drumkit feed" (as it is called in debian/README.source).
with "them" being upstream (hydrogen), and their "drumkit feed" being
http://www.hydrogen-music.org/feeds/drumkit_list.php
it is my understanding that this feed is generated from information
that has been directly entered by the upstreams' of the various
drumkits. i have no reason to distrust this source of information.
therefore, for me the license information *has* been added by
upstream, albeit on a separate channel, and i don't see any problem
with the licenses as stated in d/copyright)
i agree, this should probably be added to the d/README.source

A week ago I updated debian/copyright in git to elaborate on origin of
copyright and licensing as best as I could - which took XML feed into
account. In that process, I relicensed some of the drumkits as I found
no evidence of the stated licensing but evidence of another.

I have failed to identify a source of copyright + licensing for the
following, however: EasternHop-1 HipHop-1 HipHop-2 Synthie-1.

- Jonas