Follow up for https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1016029
(this bug is archived, but I think my comments should be recorded somewhere)

They do provide new versions from their public repositories without
subscription, but they don't provide source packages, only binary .deb
packages [1].

Actually, they cannot withhold the packaging files, as it would violate
the terms of GPL 2.0 -  debian packaging is a derivative work of fusion
directory, which is under GPL 2.0. They can do that only if they hold
copyright to the whole codebase or get permission from every single
copyright holder. Since they forked Gosa, it is unlikely they rewrote
the code or took permission from all external contributors.

I have asked them to publish the source packages as they are required to
do it under GPL as they won't be able distribute the code from external
contributors without following GPL [2].

Any copyright holder / contributor can enforce this.

Mike, they are violating your copyright for debian/* files at least.

I don't think we should let them get away with clear GPL violation this
easily (just removing the package).

[1]
https://fusiondirectory-user-manual.readthedocs.io/en/latest/repositories/debian.html
[2] https://github.com/fusiondirectory/fusiondirectory/issues/90

Hi Pirate Praveen,

I am aware of the potential copyright infringement, however, iirc, I
mostly cherry-picked packaging changes from their upstream DEB
packaging. On the other hand, they started off from packaging work by
GONICUS GmbH (Cajus Pollmeier) and myself as found in the gosa DEB
packaging.

However, I must admit I am to no extent interested in FusionDirectory
anymore. Upgrades broke the installation I had regularly (i.e. too
often), because required LDAP changes (expected by the new FD version)
were not handled gracefully as part of their update procedure but all
LDAP changes required I had to apply myself. That said, these days I
totally disrecommend running/using FusionDirectory.

Instead, I currently invest my time in improving GOsa² on the upstream
side and as an Open Source project. GONICUS currently is
step-by-step-adding PHP composer support to their plugins +
  the core, so there is activity again in GOsa² upstream. In fact, we
(GONICUS and my company) have quite a big customer who is running a
deployment of recent GOsa² successfully as their IDM (many thousand
users on it).

Sorry, but for me personally, hunting FD developers for close-sourcing
my few lines of DEB packaging with lawyers is not something I am
willing to invest time in.

Greets,
Mike

ok thanks for that feedback.

I'd be interested to migrate to Gosa as well, if there is some
documentation / migration tool.

I opened this for such support
https://github.com/gosa-project/gosa-core/issues/66 but it was turned
into a licensing discussion by Fusion Directory folks.

Ok makes sense. I think there would also be other contributors to fusion
directory itself or original contributors to Gosa who don't want to let
Fusion Directory violate their copyright, since derivative works
(including packaging) also needs to be under GPL. I will see if there is
any other contributors who wants to pursue it legally.

But if they violate GPL, they lose their ability to distribute itself,
as GPL is the only legal permission that allows them to distribute other
people's works..