Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.maint.python > #14499 > unrolled thread

bringing python-django-registration back into testing, dfsg issues

Back to article view | Back to linux.debian.maint.python

Contents

  bringing python-django-registration back into testing, dfsg issues Elena ``of Valhalla'' Grandi <valhalla@debian.org> - 2022-09-26 11:20 +0200
    Re: bringing python-django-registration back into testing, dfsg issues Craig Small <csmall@debian.org> - 2022-09-27 00:30 +0200
      Re: bringing python-django-registration back into testing, dfsg  issues Elena ``of Valhalla'' Grandi <valhalla@debian.org> - 2022-09-30 10:50 +0200

#14499 — bringing python-django-registration back into testing, dfsg issues

[Multipart message — attachments visible in raw view] — view raw

Hello

python-django-registration has been removed from testing, and since it's
an useful package I'd like to bring it back into it.

There is a new upstream release, and there was already some work done in
git to package it, but it was failing because upstream has added a new
dependency on https://pypi.org/project/confusable_homoglyphs/

The problem with the latter is that it includes two files from the
unicode consortium:
http://www.unicode.org/Public/UNIDATA/Scripts.txt
http://www.unicode.org/Public/security/latest/confusables.txt
which, if my understanding of https://www.unicode.org/copyright.html is
correct aren't DFSG, but could be redistributed.

I have two questions on how to proceed.

1) I've pushed to git a patch to make confusable_homoglyphs optional:
it seems to be working, but it's still missing proper warning of the
user that that specific protection is disabled. I would add both a
runtime warning and a .NEWS.

Do you think it is ok to upload the package like this?

2) Even if the answer to 1 is yes, I can also try to package
confusable_homoglyphs: upstream can download the files from the unicode
consortium if they aren't available: do you think it's better to use
that ability and package the file in contrib, or just put everything in
non-free?

Personally, the latter sounds quite easier, and I would be strongly
tempted by it.
-- 
Elena ``of Valhalla''

🧛

[toc] | [next] | [standalone]

#14501

[Multipart message — attachments visible in raw view] — view raw

On Mon, 26 Sept 2022 at 19:18, Elena ``of Valhalla'' Grandi <
valhalla@debian.org> wrote:

> http://www.unicode.org/Public/UNIDATA/Scripts.txt
> http://www.unicode.org/Public/security/latest/confusables.txt
> which, if my understanding of https://www.unicode.org/copyright.html is
> correct aren't DFSG, but could be redistributed.
>
Given they sit under Public aren't they DATA FILES and subject to
https://www.unicode.org/license.txt
That license seems very BSD 3-Clause-ish.

I suppose it comes down to what "Further specification" means. Does it mean
license.txt overrules copyright.html?

You could ask debian-legal for guidance.

Do you think it is ok to upload the package like this?
>
It's not ideal but if the result is you cannot use those confusables then
its the only way forward.


> 2) Even if the answer to 1 is yes, I can also try to package
> confusable_homoglyphs: upstream can download the files from the unicode
> consortium if they aren't available: do you think it's better to use
> that ability and package the file in contrib, or just put everything in
> non-free?
>
> Personally, the latter sounds quite easier, and I would be strongly
> tempted by it.
>
I have a similar problem with SNMP MIBs (thanks IETF). They're not even
redistributable so I have a contrib mibs-downloader package.
If the system can do it itself, that's ok but it needs to be something that
the user knows is happening. I have had issues with WordPress before where
it has links in some of the themes.

So in summary:
 * See if license.txt is the actual license and its DFSG free (I think it
could be)
* If not, I'd package the files in a separate archive

 - Craig

-- 
> Elena ``of Valhalla''
>
> 🧛
>

[toc] | [prev] | [next] | [standalone]

#14504 — Re: bringing python-django-registration back into testing, dfsg issues

[Multipart message — attachments visible in raw view] — view raw

On 2022-09-27 at 08:17:39 +1000, Craig Small wrote:
> Given they sit under Public aren't they DATA FILES and subject to
> https://www.unicode.org/license.txt
> That license seems very BSD 3-Clause-ish.
> [...]

thanks, I was using my pessimist parser :) and didn't notice the good
news.

confusable-homoglyphs is now in NEW.

-- 
Elena ``of Valhalla''

🧛

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.maint.python

csiph-web