legal October 2022

legal@lists.fedoraproject.org

13 participants
12 discussions

Sleepycat license with SaaS restriction
by Florian Weimer 09 Jul '25

09 Jul '25

cryptlib is licensed under the Sleepycat license with a SaaS restriction: “Note that decoupling the software from the user, for example by running in a SaaS configuration, does not exempt you from these requirements.” (Full text attached.) This was not part of the original Sleepycat license, so a new license tag is required. Maybe this license is not even free; this additional clause seems to be a restriction on use. But perhaps it is not so different from the AGPL. Thanks, Florian

6 8

Request to stop hobbling crypto libraries
by Neal Gompa 12 Sep '24

12 Sep '24

Hey all, As part of the discussion going on about Mesa on devel@, the situation around OpenSSL was brought up, and Adam Williamson brought up that we might not need to hobble OpenSSL anymore[1]. A quick check seems to indicate we no longer do it for GnuTLS either, and haven't for many years[2]. Could we just drop all this stuff and use pristine OpenSSL sources? All the crypto algorithm usability stuff is controlled through crypto-policies, so I don't think it makes sense to do this anymore for OpenSSL since all the patents indicated in the script have expired for a couple of years now[3]. Dropping this will eliminate a chunk of cruft that nobody needs around anymore and simplify OpenSSL maintenance. [1]: https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org… [2]: https://src.fedoraproject.org/rpms/gnutls/c/46d865d8451be0f4576dcc56841175a… [3]: https://src.fedoraproject.org/rpms/openssl//blob/rawhide/f/hobble-openssl -- 真実はいつも一つ！/ Always, there's only one truth!

7 16

Brainpool Curves in Fedora (openssl, libgcrypt, gnupg)
by Timothée Ravier 21 May '24

21 May '24

Hi everyone, The ECC Brainpool Curves [1][2] are currently not available in Fedora as according to this BZ [3], this needs Fedora Legal approval. Could someone from the legal team take a look to see if there are any blockers regarding Brainpool Curves inclusion in Fedora? Thanks! [1] https://en.wikipedia.org/wiki/Elliptic-curve_cryptography#Implementation [2] https://tools.ietf.org/html/rfc5639 [3] https://bugzilla.redhat.com/show_bug.cgi?id=1413618

14 31

Henry Spencer's license
by Petr Šabata 07 Mar '23

07 Mar '23

Dear legal, While checking the contents of our `perl' package, I noticed the following: (...) /* NOTE: this is derived from Henry Spencer's regexp code, and should not * confused with the original package (see point 3 below). Thanks, Henry! */ /* Additional note: this code is very heavily munged from Henry's version * in places. In some spots I've traded clarity for efficiency, so don't * blame Henry for some of the lack of readability. */ /* The names of the functions have been changed from regcomp and * regexec to pregcomp and pregexec in order to avoid conflicts * with the POSIX routines of the same names. */ (...) * pregcomp and pregexec -- regsub and regerror are not used in perl * * Copyright (c) 1986 by University of Toronto. * Written by Henry Spencer. Not derived from licensed software. * * Permission is granted to anyone to use this software for any * purpose on any computer system, and to redistribute it freely, * subject to the following restrictions: * * 1. The author is not responsible for the consequences of use of * this software, no matter how awful, even if they arise * from defects in it. * * 2. The origin of this software must not be misrepresented, either * by explicit claim or by omission. * * 3. Altered versions must be plainly marked as such, and must not * be misrepresented as being the original software. * **** Alterations to Henry's code are... **** **** Copyright (C) 1991, 1992, 1993, 1994, 1995, 1996, 1997, 1998, 1999, **** 2000, 2001, 2002, 2003, 2004, 2005, 2006, 2007, 2008 **** by Larry Wall and others **** **** You may distribute under the terms of either the GNU General Public **** License or the Artistic License, as specified in the README file. (...) You can see the whole file here: https://metacpan.org/source/SHAY/perl-5.20.1/regexec.c I looked but couldn't find any common name for this license of Henry's. Is it on our list? Is it free? What name should I use in the License tag? Thank you, Petr

5 9

about openssl we may enable and build all elliptic curves on corp ?
by Sérgio Basto 06 Nov '22

06 Nov '22

Hello, I reopen or start thinking again on this question of enable elliptic curves of openssl [1] So going directly to the point, may I built all source of openssl in copr [2] ? or at least some other curves that fedora package don't ship? [1] https://bugzilla.redhat.com/show_bug.cgi?id=1405843 [2] Version: 1.0.2k %global fips_version 2.0.14 I mean sources: http://ftp.o penssl.org/source/openssl-%{version}.tar.gz and http://ftp.openssl.org/s ource/openssl-fips-%{fips_version}.tar.gz Thanks , -- Sérgio M. B.

4 6

Patent question for moodycamel-readerwriterqueue package
by Sergey Mende 01 Nov '22

01 Nov '22

Hi, I have a package in review process that could affect some patents [0]. The author claims that the work was done from scratch [1] though he admits that he did not search for any existing patents. Benson Muite had found a patent that covers the similar topic [2] I am completely dumb in this area, so I kindly ask someone to help identify if the author's implementation violates the rights of any patent owner. [0] https://bugzilla.redhat.com/show_bug.cgi?id=2129304 [1] https://moodycamel.com/blog/2013/a-fast-lock-free-queue-for-c++ [2] https://patents.google.com/patent/US8543743B2/en Thanks in advance, Sergey

1 0

Package log4j 2.17.2 contains strangely-licensed files
by Marián Konček 21 Oct '22

21 Oct '22

Hi, in the Fedora package "log4j" (branch Rawhide) I noticed a file apache-log4j-2.17.2-src/src/site/resources/glyphicons-halflings-2-1.zip It contains "_glyphicons_license.pdf" which also points here https://glyphicons.com/license/ I am asking for a legal review of this license. -- Marián Konček

3 3

can we bundle CNN models for wechat_qrcode ?
by Sérgio Basto 19 Oct '22

19 Oct '22

Hi, Recently opencv add to opencv_contrib "CNN models for wechat_qrcode module, including the detector model and the super scale model." https://github.com/WeChatCV/opencv_3rdparty CNN models is about "Object Detection using CNNs" https://docs.opencv.org/4.x/d2/da2/tutorial_dnn_objdetect.html I proposed add the models https://src.fedoraproject.org/rpms/opencv/pull-request/21# The lack of information of the License of these "models" , make me think I should ask to legal ? if we can bundle these binaries that are in a 3rdparty repo. In the opencv_contrib code we have this License information https://github.com/opencv/opencv_contrib/blob/4.x/modules/wechat_qrcode/LIC… Thanks, -- Sérgio M. B.

3 3

Where are the OFL* licenses?
by Jerry James 19 Oct '22

19 Oct '22

I just ran rpmlint over a package under the OFL-1.1-RFN license, with the rpmlint-fedora-license-data package installed. I got "W: invalid-license OFL-1.1-RFN". I undertook a search on the allowed [1] and not allowed [2] license pages. Only "OFL-1.1" appears anywhere, under the "All licenses" section of [1]. (And, faithfully reproducing this, "OFL-1.1" is the only OFL* license that appears in the rpmlint-fedora-license-data package.) The underlying license data [3] from which [1] and [2] are generated lists all of OFL-1.0, OFL-1.0-RFN, OFL-1.0-no-RFN, OFL-1.1, OFL-1.1-RFN, and OFL-1.1-no-RFN. Why aren't the other licenses showing up on [1] and in rpmlint-fedora-license-data? Is it because "OFL-1.1" is the only one of the six that has a "Y" in both the "OSI?" and "FSFLibre?" columns of licenses.md? If so, what does that imply about the status of the other 5 licenses for Fedora? References: [1] https://docs.fedoraproject.org/en-US/legal/allowed-licenses/ [2] https://docs.fedoraproject.org/en-US/legal/not-allowed-licenses/ [3] https://gitlab.com/fedora/legal/fedora-license-data -- Jerry James http://www.jamezone.org/

3 4

License correction for libIDL-doc
by Ben Beasley 17 Oct '22

17 Oct '22

While converting libIDL to SPDX (LGPLv2+ → LGPL-2.0-or-later), I noticed that the documentation is actually GPLv3+. The libIDL-doc subpackage’s License field is therefore corrected from LGPLv2+ to GPL-3.0-or-later. – Ben Beasley (FAS music)

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

legal October 2022