Dear Maintainer,

I am filing this bug report with severity serious because the current
version of bmagic in the archive contains several violations of the
Debian Free Software Guidelines (DFSG) and licensing documentation
requirements.

1. Non-Free Attribution Requirement (DFSG 1 & 3)
The LICENSE file (and README.md) contains a clause that states:
"Proper BitMagic reference on your product/project page is a REQUIREMENT
for using the Library."
This "requirement" to maintain a specific reference on a project page
goes beyond standard attribution and imposes a specific redistribution
burden. This is effectively an advertising-style clause that restricts
free redistribution and the creation of derived works, making it
incompatible with the DFSG.

2. Binary Blobs (Policy 4.16, DFSG 2)
The source package contains a precompiled header file which is a
binary blob without source form:
msvc32/.vs/bm/v15/ipch/AutoPCH/60fd1a078cd898e5/PERF.ipch
This violates Debian Policy 4.16 ("Missing sources") and DFSG 2, as it
is not the "preferred form for modification". This file should have
been excluded from the +dfsg tarball.

3. Missing Authors and Licenses in debian/copyright
A scan with the `dnq` tool (available from
https://salsa.debian.org/dfsg-team/dfsg-new-queue) using
`dnq author-check` and manual inspection reveals several authors and
licenses that are not declared in debian/copyright:

- Francesco Nidito (MIT): lang-maps/libbm/src/try_throw_catch.h
- Kim Walisch (BSD-2-Clause): src/bmavx2.h, src/bmavx512.h (libpopcnt)
- Wojciech Muła (BSD-2-Clause): src/bmavx2.h, src/bmavx512.h (libpopcnt)
- Timo Bingmann (WTFPL-2.0): tests/stress/stacktrace_dbg.h
- Contributors to sse2neon.h (MIT): src/sse2neon.h

Because of the non-free attribution clause and the binary blob, this
package is currently not suitable for the main archive.

Regards,
-rt

4-clause BSD with the advertising clause has always been recognized as
DFSG-free (and is also listed at [1]):

  All advertising materials mentioning features or use of this software
  must display the following acknowledgement: This product includes
  software developed by the <copyright holder>.


AGPLv3 with the following clause is DFSG-free[2]:

  Notwithstanding any other provision of this License, if you modify the
  Program, your modified version must prominently offer all users
  interacting with it remotely through a computer network (if your
  version supports such interaction) an opportunity to receive the
  Corresponding Source of your version by providing access to the
  Corresponding Source from a network server at no charge, through some
  standard or customary means of facilitating copying of software.

(Debian provides modified AGPLv3 software (e.g. Redis), in which cases
 I'd assume our users have this obligation no matter whether they made
 additional modifications)


The full licence text of bmagic is:

  We ask you to explicitly mention BitMagic project in any derived work or our published
  materials. Proper BitMagic reference on your product/project page is a REQUIREMENT
  for using the Library.

(I assume "our published" was meant to say "your published")


It is not obvious to me why the bmagic licence would "restrict free
redistribution and the creation of derived works" given the precedent
that the AGPLv3 is DFSG-free.

cu
Adrian

[1] https://www.debian.org/legal/licenses/
[2] https://bugs.debian.org/cgi-bin/bugreport.cgi?msg=17;bug=495721

Hello,

Am 15.06.26 um 15:55 schrieb Adrian Bunk:

It might be free; but does Debian really want to write on all
"advertising materials mentioning features or use of this software":
"This product includes software developed by the <copyright holder>"?

Is that really a condition Debian wants to fulfill?

To fulfill a clause that is deprecated since years?

see https://www.debian.org/legal/licenses/

Kind regards
Michael

Hello,


Am 15.06.26 um 21:19 schrieb Sam Hartman:

So a maintainer is allowed to commit to the whole project? Without any
delegation?

I do not find such a power in the Constitution for the Debian Project -
pert 3.

Kind regards
Michael

    Michael> It might be free;

And by this we mean Free as in DFSG.
I agree with Adrian's analysis.
It is DFSG free.

    Michael> but does Debian really want to write on
    Michael> all "advertising materials mentioning features or use of
    Michael> this software": "This product includes software developed
    Michael> by the <copyright holder>"?

    Michael> Is that really a condition Debian wants to fulfill?

In my mind if it is DFSG free, the rest is up to the maintainer.

On Mon, 15 Jun 2026 16:55:11 +0300 Adrian Bunk wrote:

[...]

Yes, although it is obnoxious, deprecated, problematic and
almost everywhere recommended against, it has been traditionally
considered acceptable with respect to the DFSG.

The obnoxious advertising clause might be seen as similar to the bmagic
license clause under consideration.
So, maybe bmagic complies with the DFSG.

I believe that this is an unfortunate example, for at least two reasons.

First off, the GNU AfferoGPL v3 is a controversial license, which (this is
true) has been considered acceptable for main by the Debian FTP Masters
[2], but is seen as non-acceptable by a number of people (including me
[3]).

Secondly, I don't see much similarity between this clause and the bmagic
license clause under consideration. Hence, I don't think that the
DFSG-freeness of works released under the terms of the GNU AfferoGPL v3
is too relevant for the topic we're discussing here.

[...]

[3] https://bugs.debian.org/495721#28

AGPLv3 is an example of a licence that is considered DFSG-free by Debian,
this is a precedent no matter whether you or I like it.

We do (thankfully) not have a history of changing what licences we
consider DFSG-free.

Reinhard was arguing with "imposes a specific redistribution burden".

AGPLv3 requires something from the user far more often than 4-clause BSD,
not only when advertising the use of the software.

How can a requirement to maintain a specific reference on a project page
be considered not DFSG-free, when the AGPLv3 precedent is that a
requirement to "prominently" link to the sources is DFSG-free?

cu
Adrian

Le Tue, Jun 16, 2026 at 12:07:07AM +0200, Francesco Poli a écrit :

I searched for "All advertising materials mentioning features" in the
Debian sources and it looks like the number of different copyright
holders for which we accepted software under the 4-clause BSD may
be not so large.

So maybe the DFSG team could decide that we gave an exception to the
DFSG to these copyright holders only, that we note that it pushes on our
users the duty to check the copyright file of every package they use in
case they want to mention them in advertisements, and that because this
is too unreasonable we will not grant exceptions anymore to new
packages, for the 4-clause BSD and for any other similar license?

We could also make a Lintian tag that asks the maintainer to make a
comment in debian/copyright for UCSC Berkeley-licensed code that the
advertisement clause has been revoked on January 31st 2012.

https://en.wikipedia.org/wiki/BSD_licenses#3-clause_license_(%22BSD_License_2.0%22,_%22Revised_BSD_License%22,_%22New_BSD_License%22,_or_%22Modified_BSD_License%22)

Lastly we could ask politely to the other copyright holders if they were
willing to make the same change.

Have a nice day,

Charles

This seems an excellent idea - I can really get on board with it.

Thanks,
Andrew McMillan

Following up on the discussion, and in particular the points raised by
Adrian and Sam.

After further consideration, I am withdrawing my objection on point 1
(the attribution clause). The clause is structurally comparable to the
4-clause BSD advertising clause, which Debian has traditionally
accepted as DFSG-free. I was initially concerned about the practical
burden this places on Debian as a distributor, but I believe this can
be satisfied by mentioning BitMagic in the package description, which
is propagated to packages.debian.org.

That said, points 2 and 3 from my original report remain unaddressed:

2. Binary Blobs (Policy 4.16, DFSG 2)
The precompiled header file
msvc32/.vs/bm/v15/ipch/AutoPCH/60fd1a078cd898e5/PERF.ipch
is still present in the +dfsg tarball and needs to be excluded.

3. Missing Authors and Licenses in debian/copyright
The authors and licenses listed in my original report are still not
declared in debian/copyright.

Regards,
-rt

Hi,
holder is Y. Once there is a second copyright holder due to a patch
getting applied, it is no longer free and would need removal from
Debian?

It seems also against the spirit of "No Discrimination Against Persons
or Groups" as we discriminate against copyright holders... (Yes, I know
it's not a license condition.)

I would recommend not making licenses non-free retroactively just
because they contain annoying clauses like GPL-2's requirement to add
"notices stating that you changed the files and the date of any change"
of any modified file (which Debian just ignores anyway) or some
advertisement clauses (which probably get handled in practice much like
the aforementioned GPL clause).

Ansgar

Hi,

Oh, and if people want to label the BSD-4 license as non-free, please
go the proper way and change the DFSG to remove the (originally 4-
clause) BSD license from this clause:

| 10. Example Licenses
|
| The "GPL", "BSD", and "Artistic" licenses are examples of licenses
| that we consider "free".

Otherwise they should be regarded as free even though all of them have
clauses that one would not want in new licenses.

You could also explicitly include the list of copyright holders which
get an exception there. ;-)

Ansgar

We believe that the bug you reported is fixed in the latest version of
bmagic, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1135657@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Bastian Germann <bage@debian.org> (supplier of updated bmagic package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Tue, 23 Jun 2026 11:56:20 +0200
Source: bmagic
Binary: bmagic bmagic-doc
Architecture: source all
Version: 7.13.4+dfsg2-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Science Maintainers <debian-science-maintainers@lists.alioth.debian.org>
Changed-By: Bastian Germann <bage@debian.org>
Description:
 bmagic     - C++ template library for efficient platform independent bitsets
 bmagic-doc - C++ template library for efficient platform independent bitsets (
Closes: 1135657
Changes:
 bmagic (7.13.4+dfsg2-1) unstable; urgency=medium
 .
   * Team upload
   * Exclude Windows/Mac files with blobs
   * d/copyright: Add missing info (Closes: #1135657)
 .
   [ Andreas Tille ]
   * Remove Athena Capital Research from Uploaders
   * Create separate -doc package
   * Remove unused lintian-overrides
Checksums-Sha1:
 00ee80c0bc464fc07cb7e28e733aedaff04b3a5a 1877 bmagic_7.13.4+dfsg2-1.dsc
 c931a7c1aa68316f507124c52a9e115b36c9fe50 606092 bmagic_7.13.4+dfsg2.orig.tar.xz
 fc3fca8311f5da6ab43c278ce009baf91a5508a4 5716 bmagic_7.13.4+dfsg2-1.debian.tar.xz
 e46f08aa34b45fcad9699726b2fc2b5fe7e75037 24550204 bmagic-doc_7.13.4+dfsg2-1_all.deb
 7f84589ba34bab40b10cf6c1693167d99dee8d4c 325004 bmagic_7.13.4+dfsg2-1_all.deb
 94b81111067b89383400ef9b39b54bbcb9b16b76 8995 bmagic_7.13.4+dfsg2-1_amd64.buildinfo
Checksums-Sha256:
 8b6b7c7653c0f7550fb11e7143110f919fa2dc8f28056267f3b0c9c7ee314b75 1877 bmagic_7.13.4+dfsg2-1.dsc
 a5da6c0de9d5910299c3340ccbc60b66f5a7cc9a6bd93ddb419def9960e9d501 606092 bmagic_7.13.4+dfsg2.orig.tar.xz
 319925690c967a7e00096a7643a1972e53e628b60d8c7ebd6756233e2ae68b6a 5716 bmagic_7.13.4+dfsg2-1.debian.tar.xz
 28043c91dcc190ef4e760b186fed3d67dc21c976673bd3193a906eb0f1658661 24550204 bmagic-doc_7.13.4+dfsg2-1_all.deb
 d0625e366b93b66a8e3e12a56b1821dd01dd1e690fc6bcf73d026ec096a25772 325004 bmagic_7.13.4+dfsg2-1_all.deb
 8a88d86b73ebb96dab631586341630c74b2e9f03d1455724c81dce7f1d8d2b8e 8995 bmagic_7.13.4+dfsg2-1_amd64.buildinfo
Files:
 ee504b6eedc3a891cf3e17313646e9c4 1877 libdevel optional bmagic_7.13.4+dfsg2-1.dsc
 056df347818bb205be736b2053dbd6e5 606092 libdevel optional bmagic_7.13.4+dfsg2.orig.tar.xz
 6e60bd619676cb548b89e08bb9538e0e 5716 libdevel optional bmagic_7.13.4+dfsg2-1.debian.tar.xz
 220eeb4b713d7d2e5a5231009edc4634 24550204 doc optional bmagic-doc_7.13.4+dfsg2-1_all.deb
 1aedafd617d04f418eee17f3b6b559c3 325004 libdevel optional bmagic_7.13.4+dfsg2-1_all.deb
 11c6ba8b8f1c7aef69946fa2783f971d 8995 libdevel optional bmagic_7.13.4+dfsg2-1_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----

iQHEBAEBCgAuFiEEQGIgyLhVKAI3jM5BH1x6i0VWQxQFAmo85NoQHGJhZ2VAZGVi
aWFuLm9yZwAKCRAfXHqLRVZDFD+gC/0ennK0rWHYNx0lyj4uLJfkyEkzi0AoxMx8
nSHvtKNZn5v90u7U/XLMc7ZeQZE/J9z4B65eeewXYYJsPCGbTKW7ZrbilkJZt8SW
aMSoNyQbwG3TEJg/zm5vKjVwcNf7N7lHuA2b7pZeI4Jgefoe9xOO/+EJj7kbG0uY
yGGvoB5B9EpqnkjcoSHX8OiA2an4122qsec6npCRcHbzLPl0quDa89sU/ybpRseJ
qJkQT5IuTaU1d0egu3+oBNGyqEOsoW9r24s/DGvvszvsmykn3FcQEI0ZyDPtnpqW
5LARFeR9GjugBzvu0tT9/vZ/YK9t9m3KV/ip7svY3VnUuYlXN550WfKH4atSnjgK
u2mk7JcuKOvr1UuD+5H4NfHMMF4GLA7bFJnNtgz+FNzmwXXTvqNjbo9O4wdJb3zQ
kBSLW82xNf1zrK0s8kneLyznpp4aux+r4D0X1j/SXcd/7UUrjwZoRar8PJUQmY+w
DzWjIMbM1idBN8POE/im9qhGVD+E/7I=
=9Den
-----END PGP SIGNATURE-----