> [C]an someone reply with a bad source package (or d/copyright file) > that we can evaluate in main?
Here is sgml-data's copyright file: <http://ftp-master.metadata.debian.org/changelogs//main/s/sgml-data/sgml-data_2.0.10_copyright>. Here is the source of sgml-data: <http://http.debian.net/debian/pool/main/s/sgml-data/sgml-data_2.0.10.tar.xz>. Offending files are in sgml/entities/sgml-iso-entities*/. Also, files in xml/entities/xml-iso-entities-8879.1986 are derived from files with the same licence. The files and files derived from them are in other packages as well.
