legal May 2025

legal@lists.fedoraproject.org

3 participants
2 discussions

Creative Commons as code license
by Alejandro Saez Morollon 16 May '25

16 May '25

Hi! I’m working on including a now-retired dependency inside the golang-x-perf package. The dependency is licensed under CC-BY-4.0[0], but it clearly contains code. As far as I understand, CC-BY-4.0 is only permitted for content, not code. But the original package, which was shipped until Fedora 40, also had CC-BY-4.0 as its license. So, my questions are: where can I see if this was an exception? And what would be the next step to request an exception? [0] https://src.fedoraproject.org/rpms/golang-github-ajstarks-svgo/blob/f40/f/g…

2 1

Fwd: SPDX Statistics - 108 packages remaining
by Miroslav Suchý 02 May '25

02 May '25

-------- Přeposlaná zpráva -------- Předmět: SPDX Statistics - 108 packages remaining Datum: Fri, 2 May 2025 11:27:52 +0200 Od: Miroslav Suchý <msuchy(a)redhat.com> Společnost: Red Hat Czech, s.r.o. Komu: Development discussions related to Fedora <devel(a)lists.fedoraproject.org> Hot news: - SPDX upstream finally got approved some of our licenses waiting in the queue. - in fedora-license-data - Richard and I are working together on old and painful issues. The number of open issues is now 52. I am so happy about it, because it was over 60 for ages. - almost every week I notice maintainer who has local copy of spec file and when they rebase package they overwrite the migrated license tag. If you have such workflow, please check for the changes in dist-git first. - legal documentations got several updates: https://docs.fedoraproject.org/en-US/legal/update-existing-packages/#_publi… https://docs.fedoraproject.org/en-US/legal/update-existing-packages/#_licen… https://docs.fedoraproject.org/en-US/legal/license-review-process/ (note about funny licenses being treated seriously) - kernel was documented as exception to BSD-3-Clause-Clear so kernel package is finally reported as OK. - There are 3 packages in Fedora with not-allowed license. Despite my reports and ping they does not seems to have a plan. I plan to open FESCO issue and retire these packages. For list of packages see tracking bug https://bugzilla.redhat.com/show_bug.cgi?id=2310597 Five weeks ago we had: > * 24495 spec files in Fedora > > * 31150license tags in all spec files > > * 115 tags are not SPDX compliant (number from line bellow minus packages with LicenseRef-Callaway-*) > > * 2184tags have not been converted to SPDX yet > > * 12 tags can be trivially converted using `license-fedora2spdx` > > * Progress: 99.83% ░░░░░░░░░█100% > > ELN subset: > > 54 out of 2301 packages are not converted yet (progress 97.50%) > Today we have: * 24479 spec files in Fedora * 31088license tags in all spec files * 108 tags are not SPDX compliant (number from line bellow minus packages with LicenseRef-Callaway-*) * 2143tags have not been converted to SPDX yet * 11 tags can be trivially converted using `license-fedora2spdx` * Progress: 99.63% ░░░░░░░░░█100% ELN subset: 58 out of 2322 packages are not converted yet (progress 97.65%) Graph of these data with the burndown chart: https://docs.google.com/spreadsheets/d/1QVMEzXWML-6_Mrlln02axFAaRKCQ8zE807r… The list of packages needed to be converted is here: https://pagure.io/copr/license-validate/blob/main/f/packages-without-spdx-f… List by package maintainers is here https://pagure.io/copr/license-validate/blob/main/f/packages-without-spdx-f… Packages that are neither in SPDX nor in Callaway format (highest priority for now) - 31 packages: https://pagure.io/copr/license-validate/blob/main/f/neither-nor-remaining-p… Most of such packages has open issue in fedora-license-data. A lot of them are waiting for SPDX to approved the license and assign ID. I released new version of fedora-license-data with 10 new license and bunch of public domain or ultra permissive findings. 6 licenses are waiting to be reviewed by SPDX.org (and then to be added to fedora-license-data) https://gitlab.com/fedora/legal/fedora-license-data/-/issues/?label_name%5B… If your package does not have neither git-log entry nor spec-changelog entry mentioning SPDX and you know your license tag matches SPDX formula, you can put your package on ignore list https://pagure.io/copr/license-validate/blob/main/f/ignore-packages.txt Either pull-request or direct email to me is fine. Miroslav

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

legal May 2025