4 ms·

Some distributions take this more seriously than others. Debian, historically, is the largest stickler about this. I've had to delay packaging things for lice

Some distributions take this more seriously than others. Debian, historically, is the largest stickler about this. I've had to delay packaging things for licensing problems[1], written 1000+ line d/copyright files[2], etc. Not all distributions will take the investigations that seriously. I'm not saying that Debian always gets it right either! Just, there's an emphasis on doing so. [1]: https://github.com/openstenoproject/plover/issues/560 https://github.com/openstenoproject/plover/issues/560 [2]: https://metadata.ftp-master.debian.org/changelogs//main/a/ansible/ansible_5.5.0-1_copyright https://metadata.ftp-master.debian.org/changelogs//main/a/an...

nextaccountic 4y ago
On the other hand, once Debian does due diligence, people can link up the findings on discussions of other distros. Most distros don't care about investigating those issues, but most distros also don't want to distribute code with clear legal issues. Also it's usually pretty straightforward to solve most of those problems. Cease distribution and contact the authors, and if they are unresponsive either replace the troublesome code (if it's trivial), or patch the program to not use the code (if it's not the main thing the program is about), or give up packaging the program in the official repositories.