legal June 2025

legal@lists.fedoraproject.org

4 participants
4 discussions

Sleepycat license with SaaS restriction
by Florian Weimer 08 Jul '25

08 Jul '25

cryptlib is licensed under the Sleepycat license with a SaaS restriction: “Note that decoupling the software from the user, for example by running in a SaaS configuration, does not exempt you from these requirements.” (Full text attached.) This was not part of the original Sleepycat license, so a new license tag is required. Maybe this license is not even free; this additional clause seems to be a restriction on use. But perhaps it is not so different from the AGPL. Thanks, Florian

6 8

ldraw rights concerns
by Benson Muite 03 Jul '25

03 Jul '25

Hi, Would like to bring ldraw into Fedora: https://bugzilla.redhat.com/show_bug.cgi?id=2368379 The content is under CC-BY-4.0 AND CC-BY-2.0 but are there any concerns about IP property for the designs? If so, should a new GitLab ticket be raised? Benson

3 2

Re: New package faad2 (AAC decoding)
by Gary Buhrmaster 17 Jun '25

17 Jun '25

"Review Request: faad2 - Library and frontend for decoding MPEG2/4 AAC" https://bugzilla.redhat.com/show_bug.cgi?id=2370973 Was this reviewed by Fedora Legal (I did not see it in the email list archives, but I might have used the wrong search criteria). Last I recall, some of the patents for AAC may not expire for a few more years. fdk-aac-free was reviewed a number of years ago, and that specific implementation was approved, but that approval may (or may not) apply to faad2 which may implement different parts of the AAC specifications. I will note in the README in the source tarball is the following statement: Please note that the use of this software may require the payment of patent royalties. You need to consider this issue before you start building derivative works. We are not warranting or indemnifying you in any way for patent royalities! YOU ARE SOLELY RESPONSIBLE FOR YOUR OWN ACTIONS! Given the minefield that is codec patents, I believe Fedora Legal needs to at least be aware of, and probably review, this package for whether it can be included in Fedora as is (and the README certainly raises an eyebrow).

2 1

Fwd: SPDX Statistics - 108 packages remaining
by Miroslav Suchý 04 Jun '25

04 Jun '25

-------- Přeposlaná zpráva -------- Předmět: SPDX Statistics - 108 packages remaining Datum: Wed, 4 Jun 2025 12:01:54 +0200 Od: Miroslav Suchý <msuchy(a)redhat.com> Společnost: Red Hat Czech, s.r.o. Komu: Development discussions related to Fedora <devel(a)lists.fedoraproject.org> Hot news: - in fedora-license-data - Richard and I are working together on old and painful issues. The number of open issues is now less than 50. This has been done while new requests are still coming. - several maintainers overwrote already migrated license tag or used incorrect license ID. I can detect this easily and I communicate with each of them individually to find the solution. - while the numbers seems to be the same like month ago (108 packages remaining) it was about +20 and -20. - Packages with invalid licenses are either resolved or are close to be resolved. Five weeks ago we had: > * 24479 spec files in Fedora > > * 31088license tags in all spec files > > * 108 tags are not SPDX compliant (number from line bellow minus packages with LicenseRef-Callaway-*) > > * 2143tags have not been converted to SPDX yet > > * 11 tags can be trivially converted using `license-fedora2spdx` > > * Progress: 99.63% ░░░░░░░░░█100% > > ELN subset: > > 58 out of 2322 packages are not converted yet (progress 97.65%) > Today we have: * 24552 spec files in Fedora * 31159license tags in all spec files * 108 tags are not SPDX compliant (number from line bellow minus packages with LicenseRef-Callaway-*) * 2093tags have not been converted to SPDX yet * 8 tags can be trivially converted using `license-fedora2spdx` * Progress: 99.65% ░░░░░░░░░█100% ELN subset: 55 out of 2291 packages are not converted yet (progress 97.65%) Graph of these data with the burndown chart: https://docs.google.com/spreadsheets/d/1QVMEzXWML-6_Mrlln02axFAaRKCQ8zE807r… The list of packages needed to be converted is here: https://pagure.io/copr/license-validate/blob/main/f/packages-without-spdx-f… List by package maintainers is here https://pagure.io/copr/license-validate/blob/main/f/packages-without-spdx-f… Packages that are neither in SPDX nor in Callaway format (highest priority for now) - 30 packages: https://pagure.io/copr/license-validate/blob/main/f/neither-nor-remaining-p… Most of such packages has open issue in fedora-license-data. A lot of them are waiting for SPDX to approved the license and assign ID. I released new version of fedora-license-data with 10 new license and several public domain or ultra permissive findings. 8 licenses are waiting to be reviewed by SPDX.org (and then to be added to fedora-license-data) https://gitlab.com/fedora/legal/fedora-license-data/-/issues/?label_name%5B… If your package does not have neither git-log entry nor spec-changelog entry mentioning SPDX and you know your license tag matches SPDX formula, you can put your package on ignore list https://pagure.io/copr/license-validate/blob/main/f/ignore-packages.txt Either pull-request or direct email to me is fine. Miroslav

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

legal June 2025