Re: Arch Linux Rust packaging licensing problem

[mpan <archml-y1vf3axu@xxxxxxx>]

  Hello. Before this hit mails/MLs, I had a talk with Arvid in 
#archlinux-offtopic, where the issue was first mentioned, finally 
suggesting to to mail heftig directly. Two points from that talk.

  First. I believe the “/usr/share/licenses” part is both more 
important and easier to solve. The importance comes from many licenses 
requiring keeping the copyright notice (or other form of attribution). A 
solution may be as simple as concatenating licenses from deps into a 
single file.

  Second. The `license` array on the other hand has no such 
requirement. In most cases it may be the same as upstream’s declared 
license. If they use a given dependency, they’re already required to 
adjust their own license to match. If there is a mismatch, it’s still 
best if it’s fixed at the upstream, not by the distro.

  The exception is a situation where source uses an API, the API has 
multiple equivalent implementations, and Arch package maintainer is 
choosing one of them. In this case it’s IMO maintainer’s job to attach 
the right license to the `license` array, as the upstream couldn’t do 
that. But I’m not sure this actually happens with Rust deps discussed here.

  Blindly combining license identifiers is also suboptimal and, as 
tippfehlr noted, leads to a meaningless mess. Collapsing the graph is 
theoretically possible, but isn’t trivial. With OR clauses one of the 
options has to be chosen (which? by whom?). It all depends on specific 
license’s language (hard to automatize; sure, Foo is compatible with 
Foo, but is Foo compatible with GPL-2.1-only?) So I would leave that 
part for later.

Cheers