WPF - sRGB Color Space Profile.icm is non-free

[dviererbe]

Describe the Bug

The .NET 9 source contains the file src/wpf/src/Microsoft.DotNet.Wpf/src/PresentationCore/System/Windows/Media/Resources/ColorProfiles/sRGB.icm. This file may not be distributed without fee if modified.

Steps to Reproduce

Go to the location https://github.com/dotnet/dotnet/blob/main/src/wpf/src/Microsoft.DotNet.Wpf/src/PresentationCore/System/Windows/Media/Resources/ColorProfiles/sRGB.icm in the VMR and see that it exists.

Other Information

• There exists an old Debian Bug that describes the issue with this file: https://bugs.debian.org/657281
• We just remove it from the Ubuntu source tarball as it is a windows only resource

[omajid]

The sRGB.icm file doesn't seem to have any licensing information (either embedded or via a sibling LICENSE file). How did you find the license this file is under?

[dviererbe]

The sRGB.icm file doesn't seem to have any licensing information (either embedded or via a sibling LICENSE file). How did you find the license this file is under?

@omajid I used the tool lintian(1), which is a static analysis tool for deb packages. It showed the error message:

E: dotnet9 source: license-problem-md5sum-non-free-file usual name is sRGB.icm. This file may not be distributed without fee if modified. See also https://bugs.debian.org/657281. [src/wpf/src/Microsoft.DotNet.Wpf/src/PresentationCore/System/Windows/Media/Resources/ColorProfiles/sRGB.icm]

The tool found it based on the md5 hash sum.

[omajid]

The tool found it based on the md5 hash sum.

Oh, that's amazing!

[MichaelSimons]

[Triage] @dotnet/dotnet-wpf - Can you provide details on how this file was obtained and what license it is under?

[MichaelSimons]

[Triage] This is a blocker for distro maintainers in 9.0. It can be cloaked in 9.0 since the Unified Build project is not complete. It will need to be addressed in 10.0.

A secondary question is how can we detect this in our binary scan tool?