nmap: clarify licensing situation

[danchr (Dan Villiom Podlaski Christiansen)]

The nmap port contains this license description:

license		{GPL-2 OpenSSLException}

Yet reading the ​actual license, contains this part:

Covered Software is licensed to you under the terms of the GPL (Exhibit A), with all the exceptions, clarifications, and additions noted in this Main License Body. Where the terms in this Main License Body conflict in any way with the GPL, the Main License Body terms shall take precedence. These additional terms mean that You may not distribute Covered Software or Derivative Works under plain GPL terms without special permission from Licensor.

However, the software is also available under ​an older licence which contains stuff like:

This program is free software; you may redistribute and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; Version 2 ("GPL"), BUT ONLY WITH ALL OF THE CLARIFICATIONS AND EXCEPTIONS DESCRIBED HEREIN. […] Note that the GPL places important restrictions on "derivative works", yet it does not provide a detailed definition of that term. To avoid misunderstandings, we interpret that term as broadly as copyright law allows. […] Because this license imposes special exceptions to the GPL, Covered Work may not be combined (even as part of a larger work) with plain GPL software.

The new licence is arguably not GPL; the same could be said of the old one, which also seems somewhat self-contradictory. Anyway, there's an ​issue where the primary author discusses the situation with someone from Fedora. Among other things, he grants permission to keep using the old licence for newer releases.

In short, I think the licence should be changed to Restrictive/Distributable.

Some background:

• ​https://lwn.net/Articles/842436/
• ​https://lists.fedoraproject.org/archives/list/legal@lists.fedoraproject.org/thread/GZIDC4DHXZP67LFU7P2OT2AQVDJRHZ2M/
• ​https://fedoraproject.org/wiki/Licensing/Nmap
• ​https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=972216
• ​https://nmap.org/npsl/

[danchr (Dan Villiom Podlaski Christiansen)]

Oh, and an addition: If MacPorts really does consider nmap to distributable under the GPL — along with derivative works — a comment explaining why and how would probably be relevant.

[danchr (Dan Villiom Podlaski Christiansen)]

​https://github.com/macports/macports-ports/pull/12939

[danielluke (Daniel J. Luke)]

The license line in Macports is intended to determine if we can distribute binaries or not. It’s not intended to be a definitive stance on the license. I think when we added the line, that was the closest description to the actual license that was available. We can update it, though.

[jmroot (Joshua Root)]

Note that nmap isn't distributable either way:

% ./jobs/port_binary_distributable.tcl -v nmap
"nmap" is not distributable because its license "GPL-2" conflicts with license "Apache-2" of dependency "apr"

[jmroot (Joshua Root)]

Replying to danchr:

In short, I think the licence should be changed to Restrictive/Distributable.

It think it would be more accurate to say {GPL-2 OpenSSLException} Restrictive/Distributable, since it presumably still conflicts with everything that the GPL does. Restrictive/Distributable is only considered to conflict with the various GPL flavours.

[danchr (Dan Villiom Podlaski Christiansen)]

In 370a2919e1579b2f1d4ad4e7c948bc2528b7ce7f/macports-ports (master):

nmap: correct licence to Restrictive/Distributable

Nmap is licensed under unique terms, derived from the GPL but
explicitly inconsistent with it. The licence doesn't seem to restrict
MacPorts redistributing neither source nor archives, but it is
definitely incompatible with other GPL-licensed software. So,
Restrictive/Distributable seems the apt choice.

As the OpenSSLException clarification is irrelevant to this licence, I
removed it.

While at it, I adjusted the modeline to prevent port lint nmap from
complaining about tabs.

See: ​https://github.com/nmap/nmap/issues/2199
Closes: #63941

[danielluke (Daniel J. Luke)]

From reading the referenced issues, It's really GPL plus additional restriction (that makes it not GPL), so jmr's suggestion is correct.

Also, this isn't an openmaintainer port, so I don't really understand why it was merged.

[danchr (Dan Villiom Podlaski Christiansen)]

Yeah; that struck me as rather odd too; I added a comment to the PR. Anyway, the comments here make sense, and I think merging the PR unmodified was incorrect; may change as it was would lose the incompatibility with APR, wouldn’t it?

[danielluke (Daniel J. Luke)]

Replying to danchr:

Yeah; that struck me as rather odd too; I added a comment to the PR. Anyway, the comments here make sense, and I think merging the PR unmodified was incorrect;

I saw your comment there - thanks.

may change as it was would lose the incompatibility with APR, wouldn’t it?

Yep, but it should be all set now.