Find correct license when several binaries share the same copyright file

Question

I'm trying to automatically obtain a list of licenses of installed packages in my Debian distribution. I'm doing so by scanning the copyright files in /usr/share/doc/as explained in the answers to several questions, such as this and this.

However, I don't know how to handle the situation where a package includes different binaries, which are installed separately but share the same copyright file. In this case, copyright files include different file stanzas but it is not explicit which files have been installed on the device neither which package installs those files.

For instance, there is the example of libmodbus. According to Debian tracker, libmodbus is a package with two binaries: libmodbus5 and libmodbus-dev. If libmodbus5 is installed, the content of /usr/share/doc/libmodbus5/copyright is the following:

Format: http://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: libmodbus
Upstream-Contact: Stéphane Raimbault <[email protected]>
Source: http://www.libmodbus.org/

Files: *
Copyright:
  2008-2014 Stéphane Raimbault <[email protected]
License: LGPL-2.1+

Files: debian/*
Copyright:
  2008-2011 Stéphane Raimbault <[email protected]>
  2011-2014 Ivo De Decker <[email protected]>
License: LGPL-2.1+

Files: tests/*
Copyright:
  2008-2014 Stéphane Raimbault <[email protected]>
License: GPL-3+

License: LGPL-2.1+
 This library is free software; you can redistribute it and/or modify it
 under the terms of the GNU Lesser General Public License as published by the
 Free Software Foundation; either version 2.1 of the License, or (at your
 option) any later version.
 .
 This library is distributed in the hope that it will be useful, but WITHOUT
 ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
 FITNESS FOR A PARTICULAR PURPOSE.  See the GNU Lesser General Public License
 for more details.
 .
 You should have received a copy of the GNU Lesser General Public License
 along with this library; if not, write to the Free Software Foundation,
 Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
 .
 On Debian systems, the complete text of the GNU General Public License
 can be found in /usr/share/common-licenses/LGPL-2.1

License: GPL-3+
 This program is free software: you can redistribute it and/or modify
 it under the terms of the GNU General Public License as published by
 the Free Software Foundation, either version 3 of the License, or
 (at your option) any later version.
 .
 This package is distributed in the hope that it will be useful,
 but WITHOUT ANY WARRANTY; without even the implied warranty of
 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 GNU General Public License for more details.
 .
 You should have received a copy of the GNU General Public License
 along with this program. If not, see <http://www.gnu.org/licenses/>.
 .
 On Debian systems, the complete text of the GNU General Public License
 version 3 can be found in "/usr/share/common-licenses/GPL-3".

That is to say, the main license is LGPL-2.1+ but the license for the files in the tests folder is GPL-3+. However, it is not explicit whether I have installed those files and, as a result, whether this license applies to my installation.

The only way I can think of to find out whether these files are installed on my device is to check the install description files in the code repository, that is linked in Debian tracker. However, this method is far from automatic and it is not easy to find the install description files for the binaries in all packages.

Is there a way to automatically check which licenses in a copyright file apply to the binaries installed on my device?

Answer 1

There is no general-purpose, automatic method of determining the license for a given binary (or binary package, I get the impression your question concerns the latter). The copyright files shipped by Debian describe the license(s) of the source package, not the resulting license of the binary package(s). The File: stanzas apply to files in the source tree, not files in the binaries (so matching them to .install files doesn’t help).

There are some cases where a binary package’s license can be automatically deduced: trivially, if there’s a single license in the copyright file, then that license applies exactly to the binary packages (and binaries contained therein). When different licenses apply, you’d have to determine whether the files they apply to actually end up in the build. That could be automated to some extent; you could perform a binary-only build, with no tests, and check which files were read, and which license(s) apply to them. There’s a good chance that in libmodbus’s case, the license for the test files doesn’t affect the resulting binaries, but that can’t be guaranteed without further analysis (I’ve seen projects which end up using some of their “test” code in their main code).