krb5-1.13.2+dfsg-5 source contains source subject to the aladdin license

[David Simons]

The krb5-1.13.2+dfsg-5 package source contains a file autolock.hxx in the directory krb5-1.13.2+dfsg-5\krb5_1.13.2+dfsg.orig\krb5-1.13.2+dfsg\src\ccapi\common\win\OldCC. Although not declared in any other licensing file for this package the file contains comments indicating its subject to the Aladdin license which has implications for any commercial distribution of the software, specifically:

“2(a) Distribution of the Program or any work based on the Program by a commercial organization to any third party is prohibited if any payment is made in connection with such distribution, whether directly (as in payment for a copy fo the Program) or indirectly (as in payment for some service related to the Program, or payment for some product or service that includes a copy of the Program ‘without charge’ . . .”

This file clearly is not needed or used for any Linux build as it appears specific to windows.

[Christian Ehrhardt  (paelzer)]

Hi,
thank you for your report on this - I must admit I'm not an expert on this.
I checked the actually delivered binaries do not contain any reference - as you outlined this is due to the respective file only being for win support.

In what extend the file being (unused) in the source is a violation I have no idea.
We likely want to drop or mention it in Debian and Ubuntu the same way.
I'll ask more developers how to proceed here.

Thank you!

[Robie Basak (racb)]

I cannot find the license claim mentioned. In the source for krb5 1.13.2+dfsg-5, I see src/ccapi/common/win/OldCC/autolock.hxx but it appears to have a regular MIT-style license boilerplate. It has sha256sum 02d63ce54f142101910143464f9eea3935f7d478e4e32998f5ba02cf8ffddc61. I also grepped for Aladdin (case insenstive) and nothing came up. Are you sure you don't have some local filesystem corruption or something like that? Can you confirm with "pull-lp-source" on a different system that you can pull the source file with the license you found, and provide the top line of the debian/changelog file in that source tree?

Marking Incomplete as I cannot find any evidence of a license problem in the source itself.

[Robie Basak (racb)]

I'm sorry, my mistake. I see what you mean now. It's "Alladin Free Public License", is mentioned in the boilerplate, but the associated copy of the license doesn't appear to be included.

[Christian Ehrhardt  (paelzer)]

Reported to Debian as that is an issue we share, linked the deb-bug here.

[Sam Hartman (hartmans)]

As a FYI, upstream has relicensed the file under their standard license
with permission from the author.
Coming to Debian soon.

[Robie Basak (racb)]

Thanks Sam!

[Christian Ehrhardt  (paelzer)]

Fixed since 1.15-1, which is quite a while ago.
Clearing this old bug by updating the status.