legal February 2023

legal@lists.fedoraproject.org

14 participants
14 discussions

Update on SPDX license id adoption in Fedora
by Jilayne Lovejoy 21 Feb '23

21 Feb '23

Thanks to all the package maintainers who have been diligently updating their packages to SPDX identifiers! Here are a few interesting stats: - 160 issues in the Fedora-license-data, which has resulted in 34 new license/TOML files being added to the data, and 18 more ready to be added https://gitlab.com/fedora/legal/fedora-license-data/-/issues/?sort=created_… - As of the SPDX License List v3.20 release this past week, 40 new licenses have been added to the SPDX License List https://github.com/spdx/license-list-XML/releases/tag/v3.20 The vast majority of these have been as a result of Fedora's new policy (and most of those have been submitted by Richard) - We continue to improve the documentation for guidance on updating existing packages Related to process, a couple reminders: Please review the process description for license review https://docs.fedoraproject.org/en-US/legal/license-review-process/ and make sure you see the process through to the end! Issue titles in Gitlab: The License Review template does not add a Title - if you have a current issue in the Fedora License Data and could update the title to "License Review: <name of license>" that would be immensely helpful. If you end up submitting the license to SPDX, ensuring the name of the license in the issue is consistent in both repos would also be really helpful. Engage with the SPDX-legal community: if your license requires submission there, helping see that process through. (It is not scalable for Richard to submit most of the licenses to SPDX and me to create the files for those licenses... :) We have been implementing labels in the Fedora License Data repo to help indicate what is needed next. I think I've caught up on noting in the corresponding the ones that have been dealt with on the SPDX side, but please check your issues and tag me if I've missed something. Don't forget the last step: create a MR to add the TOML file to the Fedora-license-data! Let us know if you have any questions or suggestions for improvements. We've had two "office hours" so far with no attendees, but happy to schedule a few more for open discussion or questions! Thanks, Jilayne

2 1

What license for sgp4
by Mattia Verga 13 Feb '23

13 Feb '23

SGP4 is a small C++ library which is bundled in python-sgp4 currently under review [1]. The source code is available from https://celestrak.org/publications/AIAA/2006-6753/ and in the FAQ it says: """ Are there any Licenses required to use the SGP4 code? There is no license associated with the code and you may use it for any purpose—personal or commercial—as you wish. We ask only that you include citations in your documentation and source code to show the source of the code and provide links to the main page, to facilitate communications regarding any questions on the theory or source code. """ Is there a license that fits? It seems some sort of Public Domain with attribution... Mattia [1] https://bugzilla.redhat.com/show_bug.cgi?id=2156932

2 1

ASL 2.0 with 'CUPS' exception when packaging libcupsfilters (reviving old 'ASL 2.0 with exceptions' thread)
by Zdenek Dohnal 13 Feb '23

13 Feb '23

Hi all, I'm about to put a new package - libcupsfilters - under review to get it into Fedora. It has the same license as CUPS - ASL 2.0 with exception, which was taken from LLVM and we talked about it in thread mentioned in subject. Now I checked https://docs.fedoraproject.org/en-US/legal/allowed-licenses/ and I see there Apache-2.0 WITH LLVM-exception, which matches the contents of the license and exception, but the name of the exception in the NOTICE file is 'CUPS exception'. Is it okay from legal part to use SPDX name ' Apache-2.0 WITH LLVM-exception' or do we need a special name? Thank you in advance! Zdenek -- Zdenek Dohnal Software Engineer Red Hat, BRQ-TPBC

2 2

Licenses without SPDX expression found in sane-frontends
by Zdenek Dohnal 09 Feb '23

09 Feb '23

Hi all, ppisar was doing the license review of the package when it arrived into EPEL 9 and proposed to update the SPEC file to the latest FPG. Since Fedora Licensing now requires SPDX names for licenses, he found two of them without SPDX name in sane-frontends: GPL-2.0-or-later WITH Autoconf-exception-2.0-like exception GPL-2.0-or-later WITH gnu-javamail-exception-like exception The former is used in config.guess+config.guess files generated Autoconf, the latter is a license which is used in SANE project. Would it be possible to review the licenses and assign a SPDX identifiers for them? Or make an agreement to use just GPL-2.0-or-later? Thank you in advance! Zdenek -- Zdenek Dohnal Software Engineer Red Hat, BRQ-TPBC

2 2

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

legal February 2023