From jfs at computer.org  Mon Oct 27 01:40:05 2008
From: jfs at computer.org (Javier =?iso-8859-1?Q?Fern=E1ndez-Sanguino_Pe=F1a?=)
Date: Mon, 27 Oct 2008 01:40:05 +0100
Subject: [Openvas-distro] Gentoo NASL scripts valid?
	[ftpmaster@debian.org:	openvas-plugins_1.0.2-1_i386.changes
	REJECTED]
Message-ID: <20081027004005.GD9624@javifsp.no-ip.org>


The openvas-plugin package has been rejected by Debian's ftpmasters (see
below). I've reviewed the plugins and *all* the Gentoo plugins (GLSA) include
the following header:

------------------------------------------
 # This script was automatically generated from 
 #  http://www.gentoo.org/security/en/glsa/glsa-200503-27.xml
 # It is released under the Nessus Script Licence.
 # The messages are release under the Creative Commons - Attribution /
 # Share Alike license. See http://creativecommons.org/licenses/by-sa/2.0/
-----------------------------------------

I guess this is because Gentoo's pages are licensed under the CC-by-sa.
However, the pages in Gentoo's do not mention a version. If you take a look
at any Gentoo advisory page, its footer is linked to
http://www.gentoo.org/main/en/contact.xml which links to
http://creativecommons.org/licenses/by-sa/2.5 (but does not explicitly say
that is the license for *all* pages).

Now, the problem with this header is that 

a) there is no reference that the "Nessus Script License" is the GPL. Indeed,
this is a fault in many scripts.

b) the CC-by-sa 2.0 is not compatible with the GPL, so those NASL scripts are
not 

I'm tempted to remove all these plugins from the Debian version of the
openvas-plugins package, in order to get it into Debian.

Could this issue be resolved or should I drop all these plugins?

Regards

Javier

----- Forwarded message from Kalle Kivimaa <ftpmaster at debian.org> -----

From: Kalle Kivimaa <ftpmaster at debian.org>
Date: Sun, 26 Oct 2008 21:47:36 +0000
To: Javier Fernandez-Sanguino Pen~a <jfs at debian.org>
Cc: Debian Installer <installer at ftp-master.debian.org>
Subject: openvas-plugins_1.0.2-1_i386.changes REJECTED

Dear Maintainer,

rejected, CC by-sa version 2.0 is DFSG incompatible. 3.0 is compatible, if you
can get the upstream to license the relevant parts with that.




===

If you don't understand why your files were rejected, or if the
override file requires editing, reply to this email.

----- End forwarded message -----
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: Digital signature
Url : http://lists.wald.intevation.org/pipermail/openvas-distro/attachments/20081027/13ebb4cc/attachment.pgp

From jan-oliver.wagner at intevation.de  Mon Oct 27 09:04:06 2008
From: jan-oliver.wagner at intevation.de (Jan-Oliver Wagner)
Date: Mon, 27 Oct 2008 10:04:06 +0200
Subject: [Openvas-distro]
 =?iso-8859-1?q?Gentoo_NASL_scripts_valid=3F_=5Bf?=
 =?iso-8859-1?q?tpmaster=40_debian=2Eorg=3A=09openvas-plugins=5F1=2E0=2E2-?=
 =?iso-8859-1?q?1=5Fi386=2Echanges_REJECTED=5D?=
In-Reply-To: <20081027004005.GD9624@javifsp.no-ip.org>
References: <20081027004005.GD9624@javifsp.no-ip.org>
Message-ID: <200810270904.08390.jan-oliver.wagner@intevation.de>

On Montag, 27. Oktober 2008, Javier Fern?ndez-Sanguino Pe?a wrote:
> 
> The openvas-plugin package has been rejected by Debian's ftpmasters (see
> below). I've reviewed the plugins and *all* the Gentoo plugins (GLSA) include
> the following header:

on 2008-09-24 all gentoo scripts were replaced by Thomas with properly licensed
ones.
That was shortly after the 1.0.3 release.
We can make a 1.0.4 release to resolve this issue.

I wonder what happened to openvas-server. Seems also rejected.

Best

	Jan

-- 
Dr. Jan-Oliver Wagner                        Intevation GmbH, Osnabr?ck
Amtsgericht Osnabr?ck, HR B 18998             http://www.intevation.de/
Gesch?ftsf?hrer: Frank Koormann, Bernhard Reiter, Dr. Jan-Oliver Wagner

From michael.wiegand at intevation.de  Mon Oct 27 11:41:37 2008
From: michael.wiegand at intevation.de (Michael Wiegand)
Date: Mon, 27 Oct 2008 11:41:37 +0100
Subject: [Openvas-distro]
 =?iso-8859-1?q?Gentoo_NASL_scripts_valid=3F_=5Bf?=
 =?iso-8859-1?q?tpmaster=40_debian=2Eorg=3A=09openvas-plugins=5F1=2E0=2E2-?=
 =?iso-8859-1?q?1=5Fi386=2Echanges_REJECTED=5D?=
In-Reply-To: <200810270904.08390.jan-oliver.wagner@intevation.de>
References: <20081027004005.GD9624@javifsp.no-ip.org>
	<200810270904.08390.jan-oliver.wagner@intevation.de>
Message-ID: <200810271141.37478.michael.wiegand@intevation.de>

[Monday 27 October 2008 - 09:04:06] "Jan-Oliver Wagner" 
<jan-oliver.wagner at intevation.de>:
> on 2008-09-24 all gentoo scripts were replaced by Thomas with properly
> licensed ones.
> That was shortly after the 1.0.3 release.
> We can make a 1.0.4 release to resolve this issue.

Looking at the -plugins ChangeLog, I think an 1.0.4 release is well justified 
anyway.

If there are no objections against this, I'd like to do the release very soon 
to have the updated release available to package maintainers as soon as 
possible.

Let me know what you think.

Regards,

  Michael

-- 
Michael Wiegand |  OpenPGP key: D7D049EC  |  http://www.intevation.de/
Intevation GmbH, Neuer Graben 17, 49074 Osnabr?ck | AG Osnabr?ck, HR B 18998
Gesch?ftsf?hrer: Frank Koormann, Bernhard Reiter, Dr. Jan-Oliver Wagner

From jfs at computer.org  Mon Oct 27 20:30:47 2008
From: jfs at computer.org (Javier Fernandez-Sanguino)
Date: Mon, 27 Oct 2008 20:30:47 +0100
Subject: [Openvas-distro] Gentoo NASL scripts valid? [ftpmaster@
	debian.org: openvas-plugins_1.0.2-1_i386.changes REJECTED]
In-Reply-To: <200810270904.08390.jan-oliver.wagner@intevation.de>
References: <20081027004005.GD9624@javifsp.no-ip.org>
	<200810270904.08390.jan-oliver.wagner@intevation.de>
Message-ID: <f3c99a80810271230l6d995971u591b420d84fdf282@mail.gmail.com>

2008/10/27 Jan-Oliver Wagner <jan-oliver.wagner at intevation.de>:
> On Montag, 27. Oktober 2008, Javier Fern?ndez-Sanguino Pe?a wrote:
>>
>> The openvas-plugin package has been rejected by Debian's ftpmasters (see
>> below). I've reviewed the plugins and *all* the Gentoo plugins (GLSA) include
>> the following header:
>
> on 2008-09-24 all gentoo scripts were replaced by Thomas with properly licensed
> ones.
> That was shortly after the 1.0.3 release.
> We can make a 1.0.4 release to resolve this issue.

I can move forward all the changes over to 1.0.3 but the diff would be
much more readable if I based the new packages on a new release which
fixed this issue. Please do.


>
> I wonder what happened to openvas-server. Seems also rejected.

The openvas-server had an issue with copyright documentation that I
solved and uploaded once more. Hopefully this time it will get int.

Regards

Javier

From njtaylor at asterisk.demon.co.uk  Tue Oct 28 00:27:31 2008
From: njtaylor at asterisk.demon.co.uk (Nigel J. Taylor)
Date: Mon, 27 Oct 2008 23:27:31 +0000
Subject: [Openvas-distro] OpenVAS port to OpenBSD
Message-ID: <49064E63.4030605@asterisk.demon.co.uk>

All,

I am planning to add OpenVAS to the OpenBSD ports and maintain the port,
as the port doesn't exist. I would just like to ask if there are any
objections to making the port available.

I have ported the following

openvas-client-1.0.4
openvas-libnasl-1.0.1
openvas-libraries-1.0.2
openvas-plugins-1.0.4
openvas-server-1.0.2

after making few patches. I am just doing some testing before submitting
to the OpenBSD Ports.

Regards

Nigel Taylor

From kost at linux.hr  Tue Oct 28 06:01:19 2008
From: kost at linux.hr (Vlatko Kosturjak)
Date: Tue, 28 Oct 2008 06:01:19 +0100
Subject: [Openvas-distro] OpenVAS port to OpenBSD
In-Reply-To: <49064E63.4030605@asterisk.demon.co.uk>
References: <49064E63.4030605@asterisk.demon.co.uk>
Message-ID: <49069C9F.1060502@linux.hr>

Hello Nigel!

> I am planning to add OpenVAS to the OpenBSD ports and maintain the port,
> as the port doesn't exist. I would just like to ask if there are any
> objections to making the port available.
> 
> I have ported the following
> 
> openvas-client-1.0.4
> openvas-libnasl-1.0.1
> openvas-libraries-1.0.2
> openvas-plugins-1.0.4
> openvas-server-1.0.2
> 
> after making few patches. I am just doing some testing before submitting
> to the OpenBSD Ports.

There were some efforts before:
http://www.mail-archive.com/openvas-discuss at wald.intevation.org/msg00399.html
Don't know what happend with that...

Feel free to submit patches back to us also.

Kost



From jan-oliver.wagner at intevation.de  Tue Oct 28 16:49:08 2008
From: jan-oliver.wagner at intevation.de (Jan-Oliver Wagner)
Date: Tue, 28 Oct 2008 17:49:08 +0200
Subject: [Openvas-distro] Gentoo NASL scripts valid? [ftpmaster@
	debian.org: openvas-plugins_1.0.2-1_i386.changes REJECTED]
In-Reply-To: <f3c99a80810271230l6d995971u591b420d84fdf282@mail.gmail.com>
References: <20081027004005.GD9624@javifsp.no-ip.org>
	<200810270904.08390.jan-oliver.wagner@intevation.de>
	<f3c99a80810271230l6d995971u591b420d84fdf282@mail.gmail.com>
Message-ID: <200810281649.10505.jan-oliver.wagner@intevation.de>

On Montag, 27. Oktober 2008, Javier Fernandez-Sanguino wrote:
> 2008/10/27 Jan-Oliver Wagner <jan-oliver.wagner at intevation.de>:
> > On Montag, 27. Oktober 2008, Javier Fern?ndez-Sanguino Pe?a wrote:
> >>
> >> The openvas-plugin package has been rejected by Debian's ftpmasters (see
> >> below). I've reviewed the plugins and *all* the Gentoo plugins (GLSA) include
> >> the following header:
> >
> > on 2008-09-24 all gentoo scripts were replaced by Thomas with properly licensed
> > ones.
> > That was shortly after the 1.0.3 release.
> > We can make a 1.0.4 release to resolve this issue.
> 
> I can move forward all the changes over to 1.0.3 but the diff would be
> much more readable if I based the new packages on a new release which
> fixed this issue. Please do.

1.0.4 alraedy happened ;-)

> > I wonder what happened to openvas-server. Seems also rejected.
> 
> The openvas-server had an issue with copyright documentation that I
> solved and uploaded once more. Hopefully this time it will get int.

Thanks!

I don't see it at http://ftp-master.debian.org/new.html yet, does it mean
it is rejected again?

Any changes to the base packages we'll do as fast as possible, just let us know,

Best

	Jan

-- 
Dr. Jan-Oliver Wagner                        Intevation GmbH, Osnabr?ck
Amtsgericht Osnabr?ck, HR B 18998             http://www.intevation.de/
Gesch?ftsf?hrer: Frank Koormann, Bernhard Reiter, Dr. Jan-Oliver Wagner

From randy at procyonlabs.com  Thu Oct 30 18:43:14 2008
From: randy at procyonlabs.com (Randal T. Rioux)
Date: Thu, 30 Oct 2008 13:43:14 -0400 (EDT)
Subject: [Openvas-distro] OpenVAS port to OpenBSD
In-Reply-To: <49064E63.4030605@asterisk.demon.co.uk>
References: <49064E63.4030605@asterisk.demon.co.uk>
Message-ID: <c0b4c0409beb3a90a31d30b9cfe52ea2.squirrel@meteor.procyonlabs.com>

On Mon, October 27, 2008 7:27 pm, Nigel J. Taylor wrote:
> All,
>
> I am planning to add OpenVAS to the OpenBSD ports and maintain the port,
> as the port doesn't exist. I would just like to ask if there are any
> objections to making the port available.
>
> I have ported the following
>
> openvas-client-1.0.4 openvas-libnasl-1.0.1 openvas-libraries-1.0.2
> openvas-plugins-1.0.4 openvas-server-1.0.2
>
> after making few patches. I am just doing some testing before submitting
> to the OpenBSD Ports.

This is great. Let me know when they're available and I can help test it
on multiple platforms.

Thanks,
Randy