nmap licensing has changed

[etu]

Seems like nmap changed the licence with the 7.90 release from GPL-2 to NPSL (Nmap public source licence).

NPSL is "based" on GPL but adds some nasty things such as:

Proprietary software companies wishing to use or incorporate Covered Software within their programs must contact Licensor to purchase a separate license

Which conflicts with the freedom 0:

The freedom to run the program as you wish, for any purpose (freedom 0).

Discussions about this:

• Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=972216
• Gentoo: https://bugs.gentoo.org/749390
• Upstream: NPSL License Improvements nmap/nmap#2199

The actual license file: https://svn.nmap.org/nmap/LICENSE

They also seem to bundle a GPL library, and their license doesn't seem to be GPL compatible.

Suggestion:

So we should probably add this new license at least. NPSL looks non-free to me.

Non-free is a good default until FSF or anyone has looked at it. We can always follow suit with what Debian does as well.

[gebner]

Non-free is a good default until FSF or anyone has looked at it.

Another option would be to revert to 7.80 for now. The new license seems to be a legal minefield even if you're ok with closed source.

[Ma27]

Yeah while looking at the issue in the train I thought of the same as well, will do that now.

[etu]

I just read the release annoncement for 7.90: https://seclists.org/nmap-announce/2020/1

Just to see if the license change was mentioned there. Which it is:

We also did some long-needed license cleanup and gave the
license a name (Nmap Public Source License) to avoid the previous confusion
of Nmap being under "GPLv2 with various clarifications and exceptions".
The NPSL is still based on the GPLv2, but brings in terms from some other
popular open source licenses. See https://nmap.org/npsl

Do I read this right they weren't really GPLv2 to begin with and just clarified that? That's like a major thing...

[Ma27]

First of all I just realized that I merged the original PR, so I really have to apologize for missing that license thing back then!

cc @armijnhemel in case you currently have time and energy for that, would you mind taking a look at the issue? I'm pretty sure that you have way more knowledge and insights about that kind of licensing issue than we have :).

Is there any kind of statement from OSI or FSF yet? Also, I'm wondering if other distros that are even more focused on free software than we are (such as Guix) have e.g. started a new fork that we may want to use as well.

[etu]

More details from the changelog: https://nmap.org/changelog#7.90

Upgraded the Nmap license form a sort of hacked-up version of GPLv2 to a cleaner and better organized version (still based on GPLv2) now called the Nmap Public Source License to avoid confusion. See https://nmap.org/npsl/ for more details and annotated license text. This NPSL project was started in 2006 (community discussion here: https://seclists.org/nmap-dev/2006/q4/126) and then it lost momentum for 7 years until it was restarted in 2013 (https://seclists.org/nmap-dev/2013/q1/399) and then we got distracted by development again. We still have some ideas for improving the NPSL, but it's already much better than the current license, so we're applying NPSL Version 0.92 to the code now and can make improvements later if needed. This does not change the license of previous Nmap releases.

@Ma27 I must say that I'm not sure if it's worth to roll the package back since it actually haven't seemed to change really. It just was weird to begin with and just now got a name on the weirdness.

[gebner]

It's not just a new name, apparently they also added new requirements in 7.90: https://bugs.gentoo.org/749390#c7

[SuperSandro2000]

I don't think we should revert it either. Add the new license and mark it unfree until this is clarified.

[Ma27]

It's not just a new name, apparently they also added new requirements in 7.90: https://bugs.gentoo.org/749390#c7

Oof.... that's actually another reason for reverting.

[Mindavi]

I'm in favor of marking as nonfree until the FSF or some other authoritative organisation decides otherwise.

[armijnhemel]

Either revert, or mark as non-free. Or, revert and add the new, non-free, version next to it.