Hello ftp-master team,

I'm opening this bug to request an official position of the team on
whether the NPSL license meets the DFSG requirements or not.

There's some divergence of opinions on the matter and I think the only
next step is to get an evaluation from the ftp-master team. FWIW I'm
currently on the opinion that the license should be considered free
due to its similarity with GPL2 (and copyleft licenses in general) but
Hilko (the other maintainer) is on the side of considering it non-free
due to a contamination issue. Sorry if I'm oversimplifying here,
Hilko. Both mine and Hilko's points are better written in the
references below.

Related discussions:
Thread on d-legal:
https://lists.debian.org/debian-legal/2022/09/msg00000.html
Upstream discussion:
https://github.com/nmap/nmap/issues/2199

Please consider that upstream is usually quite responsive in that
Github issue and so we can make follow-up questions.

We need to make a decision to understand if the current nmap we are
shipping (in all our supported releases[0]) is DFSG-free or not. This
decision should be done ideally before the freeze so we can take any
required actions.

Thank you,

[0] At least one issue that I've seen raised is present in all
versions of nmap we ship (since the first iteration of NPSL), which
would mean even our package in oldstable and stable is non-free.

We believe that the bug you reported is fixed in the latest version of
nmap, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1025650@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Samuel Henrique <samueloph@debian.org> (supplier of updated nmap package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Fri, 23 Dec 2022 22:05:26 +0000
Source: nmap
Binary: ncat ncat-dbgsym ndiff nmap nmap-common nmap-dbgsym nmap-virtual-license-check-1025650
Architecture: source amd64 all
Version: 7.92+dfsg2-2~exp1
Distribution: experimental
Urgency: medium
Maintainer: Debian Security Tools <team+pkg-security@tracker.debian.org>
Changed-By: Samuel Henrique <samueloph@debian.org>
Description:
 ncat       - NMAP netcat reimplementation
 ndiff      - The Network Mapper - result compare utility
 nmap       - The Network Mapper
 nmap-common - Architecture independent files for nmap
 nmap-virtual-license-check-1025650 - Please check bug report #1025650
Closes: 1025650
Changes:
 nmap (7.92+dfsg2-2~exp1) experimental; urgency=medium
 .
   New package: nmap-virtual-license-check-1025650
   Please check bug report #1025650
https://bugs.debian.org/1025650
 .
   This package won't be pushed to unstable, this is just a way of
   getting this in the ftp-master queue so they can review nmap's
   license (closes: #1025650).
Checksums-Sha1:
 651618d845757043d6604c77945611c324ff6814 2393 nmap_7.92+dfsg2-2~exp1.dsc
 d74e00908e7a72af707825089db750fe3120891f 7348836 nmap_7.92+dfsg2.orig.tar.xz
 eac7fe47c12eeb69119fc6c3aaf519d391ecc694 34244 nmap_7.92+dfsg2-2~exp1.debian.tar.xz
 874734e9e69fc26402044dad51aefc0bc8cdaba1 257096 ncat-dbgsym_7.92+dfsg2-2~exp1_amd64.deb
 af3767986e5e3cd5f438237e9df4fabb79e46e67 382240 ncat_7.92+dfsg2-2~exp1_amd64.deb
 4b4c1877ba7740f00a7e86fee11dfb18896e462b 298944 ndiff_7.92+dfsg2-2~exp1_all.deb
 cf9f576114f0d568d4730fe85793075a6db10955 4057728 nmap-common_7.92+dfsg2-2~exp1_all.deb
 1c272c0545d1b851f8cf62b99625819215bb58b1 4297316 nmap-dbgsym_7.92+dfsg2-2~exp1_amd64.deb
 68a11f2fd2345f77d0e881866d3c010a2bf36384 283512 nmap-virtual-license-check-1025650_7.92+dfsg2-2~exp1_amd64.deb
 e05845b0bf89e481c7512bc1352c3c89117bd2df 10815 nmap_7.92+dfsg2-2~exp1_amd64.buildinfo
 29a5d66d0fc75240939e9d75d1a45b82c5a8019e 1896848 nmap_7.92+dfsg2-2~exp1_amd64.deb
Checksums-Sha256:
 35506249115cf42e5532648751691aa995195edf46f5f0281b8c0cb853ef8d8c 2393 nmap_7.92+dfsg2-2~exp1.dsc
 dcef5b3d987b21334123d896f5b94fc91a164648a32e900ed159678e4ada1a75 7348836 nmap_7.92+dfsg2.orig.tar.xz
 5808dc29914e1c03651536074de91c4f575c7cd43d37c1d1a94056f2f76d5378 34244 nmap_7.92+dfsg2-2~exp1.debian.tar.xz
 6d27dea186ac55a9a2e8addd176ea19956220bb684751b1728971be81b6156f6 257096 ncat-dbgsym_7.92+dfsg2-2~exp1_amd64.deb
 58d81a1f720e0a9b08866898e4db33326b97e88d669da831fc05720cb3cb923c 382240 ncat_7.92+dfsg2-2~exp1_amd64.deb
 84e99244eba473a6b409f80fcd70034fb3a4d6dab6d40e2b96c4b0dd06d9caab 298944 ndiff_7.92+dfsg2-2~exp1_all.deb
 ada4db6db14076f199220810a05607d54bebc16891d5ce5acc3a5b3bf448c4b1 4057728 nmap-common_7.92+dfsg2-2~exp1_all.deb
 160a8ba2127446c0b785b299518d60f18ce9ea2d38219262ae07bcb431d78a0f 4297316 nmap-dbgsym_7.92+dfsg2-2~exp1_amd64.deb
 3b4a39353baa30dbd93acd5b7b46a3f481cbb98d89b5f989ccbdde5f605e0964 283512 nmap-virtual-license-check-1025650_7.92+dfsg2-2~exp1_amd64.deb
 d26254132ba2630771da8bb367292d20cc2efbc3255fac331c5da6c817949ebd 10815 nmap_7.92+dfsg2-2~exp1_amd64.buildinfo
 4c7f7732dcb2c27f6a8dc6be110787e9384f195b0fb13b4c56009b7a3483aa4c 1896848 nmap_7.92+dfsg2-2~exp1_amd64.deb
Files:
 e7a648af932383f277d35bdc979aae37 2393 net optional nmap_7.92+dfsg2-2~exp1.dsc
 f5b1a7d45e5f63ec3b3f1d218418bd35 7348836 net optional nmap_7.92+dfsg2.orig.tar.xz
 4b28f205e378792b0b4e7d5a8a464349 34244 net optional nmap_7.92+dfsg2-2~exp1.debian.tar.xz
 b552335fa8657bd38bac4411981ddb06 257096 debug optional ncat-dbgsym_7.92+dfsg2-2~exp1_amd64.deb
 2e8ab612ffe5b39557b8bf932a51a755 382240 net optional ncat_7.92+dfsg2-2~exp1_amd64.deb
 0987a0e352292199889818af5994e7d2 298944 net optional ndiff_7.92+dfsg2-2~exp1_all.deb
 6386d5804bad693b6d6fe051de3e9b6a 4057728 net optional nmap-common_7.92+dfsg2-2~exp1_all.deb
 958a9674e07b66237184d60837a09716 4297316 debug optional nmap-dbgsym_7.92+dfsg2-2~exp1_amd64.deb
 71811d2e02d7ab3d4f55ee34c5785e51 283512 net optional nmap-virtual-license-check-1025650_7.92+dfsg2-2~exp1_amd64.deb
 19e7898d988b554fab272e14af8e604e 10815 net optional nmap_7.92+dfsg2-2~exp1_amd64.buildinfo
 9b90e1befb32d698a64ca713d4c93f50 1896848 net optional nmap_7.92+dfsg2-2~exp1_amd64.deb
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEBdtqg34QX0sdAsVfu6n6rcz7RwcFAmOmPHQACgkQu6n6rcz7
Rwf1ehAAuol9MoYkh5pEeZDuXfsMrBLg9C7YJVOwv3SSqdk1e8l/iTGXZMkDNUoz
kJLvzbgGCCP/MjjjLkfzoecRGWY/Vf26BFu5+oG0n5X85ciIAgcdxZ8Vc1Q/hnh6
L7huQchF7dUYERhjt2BYKEVXejBuIQfO/vQhwDwGhPNIFcixl2HhMB7ZiH5V/sn8
My8ie3k0YLBtnnhxmkNsGkTwRKSz1N9rLCLmAS8Y51BaLsl/0XShaGquLKSYzm0H
M/euIkbOdvkeua/GXjxHLUyg850eeswxfFzV/3p/fsNOVlvSsxJVXFcVE7cxrdmJ
s0yBNQIoyI0l2wqqnnHMmPtNebKVAItNmezVB8WJD2ZGF0ebfPz2WNC+S/Yqvmvu
flmzyUumrq7+Ow52xanrhZfI7PxMgNME87kJI1Ns09SIU5bYgzwTc9J/CJowTp40
V1B4po5qzmmfAUvO/sRBfzF+N5DvMGHB9LOg7QSHuF0RSSI1BwUXQpsrvKH4NBe1
Jhnb7Ea36KaLEYMNjcqUfq5Z21l25KFoeCmwm7AQ7O5UYGsDdrKFwM3/DtTTbGdl
CDtM2txGf147iUzyprFj9UmJAG5N/jOIFbMpLLBQzJrcPthIoS3+BPMXCHG77cmp
wc4yCgNZzjWYCuFOM4UplR5a/iodHy+mtorcYzHLT9PlStHL2Vw=
=kkwc
-----END PGP SIGNATURE-----

Hello DFSG Team,

as the FTP Team is not involved in DFSG compliance anymore, may I ask
you to have a look at the issue brought up below and help resolving it?

Regards,
Sven

Hello,

I start to review.

So I looked through the links and read the first lines from
https://nmap.org/npsl/npsl-annotated.html

The first line says:" The NPSL itself is rather terse, ...".
And in the third line: "These annotations are not part of the license
itself, a legal document, or legal advice."

Where can we find the original license text, the legal document. Nothing
else is legally binding

On Behalf of the DFSG-Team

Mechtilde

Am 16.07.26 um 15:54 schrieb Sven Geuer:

The text outside the boxes or, as the second paragraph of the first box
links, https://svn.nmap.org/nmap/LICENSE

Hello

Am 16.07.26 um 18:31 schrieb Andrey Rakhmatullin:


This isn't a "rather terse" text. So it will take time to compare this
license text with the underlying GPL 2 (only) and the other licenses,
e.g the not DFSG-compliant AFL-3.0.

More info will come later

Mechtilde

Hello

Am 16.07.26 um 18:31 schrieb Andrey Rakhmatullin:


This isn't a "rather terse" text. So it will take time to compare this
license text with the underlying GPL 2 (only) and the other licenses,
e.g the not DFSG-compliant AFL-3.0.

More info will come later

Mechtilde