4 ms·

How does this work when Ubuntu package maintainers patch upstream packages? Do they arrange special trademark licensing terms with the upstream maintainer? I

by davb 10y ago

How does this work when Ubuntu package maintainers patch upstream packages? Do they arrange special trademark licensing terms with the upstream maintainer? I think I'm apt-get installing super-foo-blah, but during installation it's actually being patched so is deviating from what upstream are really shipping [1]. As I understand it, Canonical advocate patching upstream packages (with the noble goal of improving compatibility with their platform) and keeping the package under the same name. Just as OVH et al are doing with Ubuntu itself. [1] http://packaging.ubuntu.com/html/patches-to-packages.html http://packaging.ubuntu.com/html/patches-to-packages.html

pietroalbini 10y ago
If those packages' names are under trademark and the terms says you can't ship modified versions of the package, they must either: - Ask for the approval of the upstream developer - Rename the package, as Debian did with Firefox/IceWeasel The problem with the OVH images is their kernel lacks months of security patches, so they're advertising insecure images as "Ubuntu".
- davb 10y ago
  I absolutely agree that downstream packages have some level of responsibility to maintain up-to-date packages. However, this alone isn't necessarily reason to prevent someone from distributing derived versions of your open source project using the original name. If this was the case, Canonical would prevent people from shipping EOL'd versions of Ubuntu under any circumstances. If I ship an appliance with Ubuntu 10.04 (EOL 2013-05-09), it would have the same negative impact as shipping a patched 16.04 with no up-to-date patches or a similarly unpatchable kernel or core package.
  - pietroalbini 10y ago
    Even if in this case the changes they make are damaging the system security, the trademark policy doesn't say anything about security or updates: you just can't ship unapproved changes in an image called "Ubuntu", regardless if those changes are secure or not. Edit: typo
toyg 10y ago
Upstream being Debian, afaik they explicitly have permissive clauses regarding trademarks.
- davb 10y ago
  Sorry, I should have been clearer. I mean upstream third party packages, not those that form the core of Debian itself. If I create a package which Debian ships unmodified, but it's then subsequently patched by Canonical and shipped with Ubuntu (or via its repositories) under the same name, I'd argue that I could (but possibly shouldn't) cry foul as Canonical are doing with VPS providers.
  - toyg 10y ago
    By uploading it to Debian I think you have to accept terms to match the rest of the system. You have to object at the source; once it's in Debian, then any downstream developer can do anything he wants with it, as long as it abides to Debian licensing terms. If you don't accept the Debian terms, your package ends up in "nonfree" and I honestly don't know how that is managed downstream.
  - pietroalbini 10y ago
    Yes, you could rightfully do it, and the package mantainer would probably rename the package or just remove it.
regularfry 10y ago
This is exactly the reason Iceweasel happened in Debian. Debian was applying security patches, Mozilla objected that the end product wasn't Firefox as distributed. I'm not exactly sure why Ubuntu didn't pick up the Iceweasel branding.

by davb 10y ago

pietroalbini 10y ago

If those packages' names are under trademark and the terms says you can't ship modified versions of the package, they must either: - Ask for the approval of the upstream developer - Rename the package, as Debian did with Firefox/IceWeasel The problem with the OVH images is their kernel lacks months of security patches, so they're advertising insecure images as "Ubuntu".

davb 10y ago
I absolutely agree that downstream packages have some level of responsibility to maintain up-to-date packages. However, this alone isn't necessarily reason to prevent someone from distributing derived versions of your open source project using the original name. If this was the case, Canonical would prevent people from shipping EOL'd versions of Ubuntu under any circumstances. If I ship an appliance with Ubuntu 10.04 (EOL 2013-05-09), it would have the same negative impact as shipping a patched 16.04 with no up-to-date patches or a similarly unpatchable kernel or core package.
- pietroalbini 10y ago
  Even if in this case the changes they make are damaging the system security, the trademark policy doesn't say anything about security or updates: you just can't ship unapproved changes in an image called "Ubuntu", regardless if those changes are secure or not. Edit: typo

toyg 10y ago

Upstream being Debian, afaik they explicitly have permissive clauses regarding trademarks.

davb 10y ago
Sorry, I should have been clearer. I mean upstream third party packages, not those that form the core of Debian itself. If I create a package which Debian ships unmodified, but it's then subsequently patched by Canonical and shipped with Ubuntu (or via its repositories) under the same name, I'd argue that I could (but possibly shouldn't) cry foul as Canonical are doing with VPS providers.
- toyg 10y ago
  By uploading it to Debian I think you have to accept terms to match the rest of the system. You have to object at the source; once it's in Debian, then any downstream developer can do anything he wants with it, as long as it abides to Debian licensing terms. If you don't accept the Debian terms, your package ends up in "nonfree" and I honestly don't know how that is managed downstream.
- pietroalbini 10y ago
  Yes, you could rightfully do it, and the package mantainer would probably rename the package or just remove it.

regularfry 10y ago

This is exactly the reason Iceweasel happened in Debian. Debian was applying security patches, Mozilla objected that the end product wasn't Firefox as distributed. I'm not exactly sure why Ubuntu didn't pick up the Iceweasel branding.