legal

legal@lists.fedoraproject.org

1 participants
1396 discussions

Request to stop hobbling crypto libraries
by Neal Gompa 12 Sep '24

12 Sep '24

Hey all, As part of the discussion going on about Mesa on devel@, the situation around OpenSSL was brought up, and Adam Williamson brought up that we might not need to hobble OpenSSL anymore[1]. A quick check seems to indicate we no longer do it for GnuTLS either, and haven't for many years[2]. Could we just drop all this stuff and use pristine OpenSSL sources? All the crypto algorithm usability stuff is controlled through crypto-policies, so I don't think it makes sense to do this anymore for OpenSSL since all the patents indicated in the script have expired for a couple of years now[3]. Dropping this will eliminate a chunk of cruft that nobody needs around anymore and simplify OpenSSL maintenance. [1]: https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org… [2]: https://src.fedoraproject.org/rpms/gnutls/c/46d865d8451be0f4576dcc56841175a… [3]: https://src.fedoraproject.org/rpms/openssl//blob/rawhide/f/hobble-openssl -- 真実はいつも一つ！/ Always, there's only one truth!

7 16

MIT without copyright notice, requires to include the copyright notice
by Miro Hrončok 03 Sep '24

03 Sep '24

Hello. I see an important project has decided it's good idea to remove their own copyright notice from the top of their MIT license file while preserving the requirement for distributors to keep the copyright notice. """ The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. """ But there is no such copyright notice to include. Is it OK for a Fedora package to distribute the project or is it impossible to comply with the license terms and hence not allowed? https://github.com/pypa/setuptools/commit/5957d58266e479f124b31f30e4322e798… https://github.com/jaraco/skeleton/issues/78 https://github.com/jaraco/inflect/issues/197 Note that this is not the case of MIT-0. -- Miro Hrončok -- Phone: +420777974800 Fedora Matrix: mhroncok

2 3

tcplay generic_xts* file licenses
by Ian McInerney 26 Aug '24

26 Aug '24

I am working on the Zulucrypt 7.0.0 update and SPDX license audit at the same time, and there is one license listed in their copyright file that isn't obvious to me. Specifically, it is the generic_xts files included in the bundled tcplay (https://github.com/mhogomchungu/zuluCrypt/blob/master/external_libraries/tc…) It is bundled because upstream has made changes to it, and also we no longer have tcplay in Fedora (it was retired 5 years ago for FTBFS). The file header says: /* * Copyright (C) 2008, Damien Miller * Copyright (C) 2011, Alex Hornung * * Permission to use, copy, and modify this software with or without fee * is hereby granted, provided that this entire notice is included in * all copies of any software which is or includes a copy or * modification of this software. * You may use this code under the GNU public license if you so wish. Please * contribute changes back to the authors under this freer than GPL license * so that we may further the use of strong encryption without limitations to * all. * * THIS SOFTWARE IS BEING PROVIDED "AS IS", WITHOUT ANY EXPRESS OR * IMPLIED WARRANTY. IN PARTICULAR, NONE OF THE AUTHORS MAKES ANY * REPRESENTATION OR WARRANTY OF ANY KIND CONCERNING THE * MERCHANTABILITY OF THIS SOFTWARE OR ITS FITNESS FOR ANY PARTICULAR * PURPOSE. */ Is it appropriate to list this under the GPL in the license tag, or does this need its own licenseref in Fedora? (I already have tags for GPL-3.0-or-later AND GPL-2.0-or-later anyway).

2 2

Fwd: SPDX Statistics - Gold Rush Edition
by Miroslav Suchý 16 Aug '24

16 Aug '24

-------- Přeposlaná zpráva -------- Předmět: SPDX Statistics - Gold Rush Edition Datum: Fri, 16 Aug 2024 17:14:03 +0200 Od: Miroslav Suchý <msuchy(a)redhat.com> Společnost: Red Hat Czech, s.r.o. Komu: Development discussions related to Fedora <devel(a)lists.fedoraproject.org> Hot news: * Almost all trivial conversion has been done. Only 208 "trivial" cases remains. I will not continue converting them to SPDX counterpart as there are various caveats hidden there. I will go over the remaining cases one by one. But it is likely that most of them will be converted to some form of LicenseRef-* * I sent email about my intention to convert all remaining 5k licenses to LicenseRef-Callaway-*. In upcoming days I will send a proper diff in smaller batches that can be easier for review. Two weeks ago we had: > * 24248spec files in Fedora > > * 30924license tags in all spec files > > * 7016 tags have not been converted to SPDX yet > > * 1383 tags can be trivially converted using `license-fedora2spdx` > > * Progress: 77,31% ░░░░░░░███ 100% > > ELN subset: > > 60 out of 2345 packages are not converted yet (progress 97.44%) > Today we have: * 24312spec files in Fedora * 30925license tags in all spec files * 5740 tags have not been converted to SPDX yet * 208 tags can be trivially converted using `license-fedora2spdx` * Progress: 81,31% ░░░░░░░░██ 100% ELN subset: 57 out of 2337 packages are not converted yet (progress 97.56%) Graph of these data with the burndown chart: https://docs.google.com/spreadsheets/d/1QVMEzXWML-6_Mrlln02axFAaRKCQ8zE807r… The list of packages needed to be converted is here: https://pagure.io/copr/license-validate/blob/main/f/packages-without-spdx-f… List by package maintainers is here https://pagure.io/copr/license-validate/blob/main/f/packages-without-spdx-f… New version of fedora-license-data has been released. With: 1 new licenses, 1 correction and several public domain dedications 8 licenses are waiting to be reviewed by SPDX.org (and then to be added to fedora-license-data) https://gitlab.com/fedora/legal/fedora-license-data/-/issues/?label_name%5B… Legal docs and especially https://docs.fedoraproject.org/en-US/legal/allowed-licenses/ was updated too. New projection when we will be finished is 2025-02-02 (-31 days from last report). Pure linear approximation. If your package does not have neither git-log entry nor spec-changelog entry mentioning SPDX and you know your license tag matches SPDX formula, you can put your package on ignore list https://pagure.io/copr/license-validate/blob/main/f/ignore-packages.txt Either pull-request or direct email to me is fine. Why Gold Rush Edition? Because on today's date in 1896 prospectors discovered gold in Klondike river. This discovery started Gold Rush. It is estimated that around 100 000 people tried to reach Klondike. We can learn from the rush and stampede even nowadays. https://en.wikipedia.org/wiki/Klondike_Gold_Rush#Discovery_(1896) Miroslav

1 0

Should I mention Build-scripts' licensing terms in a spec's License field?
by Peter Lemenkov 05 Aug '24

05 Aug '24

Hello! I stumbled upon the following situation. I am packaging a library under MIT license. However the upstream-provided build-script in a tarball explicitly licensed under ISC license (has a header with ISC license). If it matters I do not use this script for building at all. So I have two questions. 1. If a tarball has a differently licensed file which is not going to a final RPM should I still list its license in a spec's %license field? 2. Does it change anything if this file wasn't used at all during RPM build process? -- With best regards, Peter Lemenkov.

8 21

Dealing with snippets credited to StackOverflow?
by Ben Beasley 01 Aug '24

01 Aug '24

Although I haven’t signed up to do the official review, I was looking at python-meshio[1], and I found that it contains a function substantially derived from a StackOverflow answer[2]. While I’m impressed that upstream cared enough to give credit, this leaves me with a question. Normally I would suggest that, to be strictly correct, the license of the copied-and-modified snippet should be added to the package’s License expression. But all answers on StackOverflow are, depending on when they are posted[3], licensed CC-BY-SA-2.5, CC-BY-SA-3.0, or CC-BY-SA-4.0. In this case, the applicable license is CC-BY-SA-3.0[4]. All of these licenses are listed as allowed in Fedora for content, but not for code. Strictly speaking, then, this appears to be code under a not-allowed-for-code license. At the same time, it is hard to believe that prohibiting packages containing snippets from StackOverflow would be an intended outcome. Since code copied or heavily inspired by StackOverflow answers is extremely widespread, and the only thing that is perhaps unusual here is that proper attribution is present, I’m curious how cases like this *ought* to be handled. – Ben Beasley (FAS: music) [1] https://bugzilla.redhat.com/show_bug.cgi?id=2283539 [2] https://github.com/nschloe/meshio/blob/b2ee99842e119901349fdeee06b5bf61e01f… [3] https://stackoverflow.com/help/licensing [4] https://stackoverflow.com/posts/8964779/timeline

3 2

Fwd: SPDX Statistics - Niki Lauda Edition
by Miroslav Suchý 01 Aug '24

01 Aug '24

-------- Přeposlaná zpráva -------- Předmět: SPDX Statistics - Niki Lauda Edition Datum: Thu, 1 Aug 2024 09:06:59 +0200 Od: Miroslav Suchý <msuchy(a)redhat.com> Společnost: Red Hat Czech, s.r.o. Komu: Development discussions related to Fedora <devel(a)lists.fedoraproject.org> Hot news: * Big batch of GPL families was mass converted. * Sent email about packages with problems (licenses neither in SPDX nor in Callaway format). * Still on todo list: convert Perl licenses (already announced) and Public Domain, UltraPermissive, and Firmware. Two weeks ago we had: > * 24223spec files in Fedora > > * 30899license tags in all spec files > > * 10114 tags have not been converted to SPDX yet > > * 4325 tags can be trivially converted using `license-fedora2spdx` > > * Progress: 67,27% ░░░░░░████ 100% > > ELN subset: > > 80 out of 2354 packages are not converted yet (progress 96.59%) > Today we have: * 24248spec files in Fedora * 30924license tags in all spec files * 7016 tags have not been converted to SPDX yet * 1383 tags can be trivially converted using `license-fedora2spdx` * Progress: 77,31% ░░░░░░░███ 100% ELN subset: 60 out of 2345 packages are not converted yet (progress 97.44%) Graph of these data with the burndown chart: https://docs.google.com/spreadsheets/d/1QVMEzXWML-6_Mrlln02axFAaRKCQ8zE807r… The list of packages needed to be converted is here: https://pagure.io/copr/license-validate/blob/main/f/packages-without-spdx-f… List by package maintainers is here https://pagure.io/copr/license-validate/blob/main/f/packages-without-spdx-f… New version of fedora-license-data has been released. With: 4 new licenses. 7 licenses are waiting to be reviewed by SPDX.org (and then to be added to fedora-license-data) https://gitlab.com/fedora/legal/fedora-license-data/-/issues/?label_name%5B… Legal docs and especially https://docs.fedoraproject.org/en-US/legal/allowed-licenses/ was updated too. New projection when we will be finished is 2025-03-05 (-133 days from last report). Pure linear approximation. If your package does not have neither git-log entry nor spec-changelog entry mentioning SPDX and you know your license tag matches SPDX formula, you can put your package on ignore list https://pagure.io/copr/license-validate/blob/main/f/ignore-packages.txt Either pull-request or direct email to me is fine. Why Niki Lauda edition? Because on today's date at 1976 Niki Lauda crashed on the Nurburgring. Two other cars crashed into Niki's car after he crashed guardrail. The fuel tank of his red Ferrari ruptured and his formula was engulfed in a fiery inferno. The Nurburing is a long track, at this point the organisers were missing. So Niki was pulled out by his rivals. Arturo Merzario, a former Ferrari driver who knew how Lauda's seatbelt worked, was the biggest contributor to Niki's rescue. He threw himself into the flames with complete disregard for his own life. Niki fought for his life in hospital for a week. His face was - as Germany's Bild wrote - "My God, where is his face? The world's fastest racing driver, Niki Lauda, no longer has a face. It's nothing but burnt flesh with eyes coming out of it." The priest gave Lauda the last rites and everyone thought he was going to die. So it was unbelievable that just 39 days after the accident, he jumped back into the formula at Monza. He finished the best of the Ferraris - fifth. He arrived at the finish with a hood of blood as his wounds opened and swelled. He went into the last race of the season in Japan with three points to his credit. But it was raining in Suzuka and Niki couldn't wipe the drops from his eyes by blinking as his burnt eyelids were still missing. He fell backwards in the race, not wanting to gamble. "Some things are more important than the championship," he said at the time. https://www.youtube.com/watch?v=f-zk48lN0D0 https://en.wikipedia.org/wiki/Niki_Lauda#1976_N%C3%BCrburgring_crash Miroslav

1 0

License acceptability check for py-sdl
by Sandro 25 Jul '24

25 Jul '24

Hi, During package review [1] the license terms of py-sdl [2] were flagged as problematic. Therefore I'm passing this on to Fedora Legal for deciding on a) Does py-sdl2 come with an acceptable license? b) If so, which license should be specified? For the opposing views on the matter, please see comment 1 and 2 in the Bugzilla ticket. [1] https://bugzilla.redhat.com/show_bug.cgi?id=2283541 [2] https://github.com/py-sdl/py-sdl2/blob/master/doc/copying.rst Cheers, -- Sandro FAS: gui1ty Matrix: Penguinpee Elsewhere: [Pp]enguinpee

2 2

Fwd: SPDX Statistics - House Sign Edition
by Miroslav Suchý 19 Jul '24

19 Jul '24

-------- Přeposlaná zpráva -------- Předmět: SPDX Statistics - House Sign Edition Datum: Fri, 19 Jul 2024 12:05:31 +0200 Od: Miroslav Suchý <msuchy(a)redhat.com> Společnost: Red Hat Czech, s.r.o. Komu: Development discussions related to Fedora <devel(a)lists.fedoraproject.org> Hot news: * FESCO agreed on decision about conversions. But there was a confusion about the wording, so the ticket is reopened https://pagure.io/fesco/issue/3230 * The confusion is just about "trivial" conversions. All others will be converted to LicenseRef-Callaway-$OLDID before Change Completation deadline (mid of August). * Richard reviewed all Nmap licenses. All of them were declined. Blocking new releases on Nmap in Fedora. Old version is allowed in Fedora under exception. https://gitlab.com/fedora/legal/fedora-license-data/-/issues/?sort=updated_… * We (stakeholders of this Change) resumed our investigation on what tooling we should use to detect changes in new upstream releases. Two weeks ago we had: > * 24117spec files in Fedora > > * 30788license tags in all spec files > > * 10271 tags have not been converted to SPDX yet > > * 4460 tags can be trivially converted using `license-fedora2spdx` > > * Progress: 66,64% ░░░░░░████ 100% > > ELN subset: > > 84 out of 2354 packages are not converted yet (progress 96.43%) > Today we have: * 24223spec files in Fedora * 30899license tags in all spec files * 10114 tags have not been converted to SPDX yet * 4325 tags can be trivially converted using `license-fedora2spdx` * Progress: 67,27% ░░░░░░████ 100% ELN subset: 80 out of 2354 packages are not converted yet (progress 96.59%) Graph of these data with the burndown chart: https://docs.google.com/spreadsheets/d/1QVMEzXWML-6_Mrlln02axFAaRKCQ8zE807r… The list of packages needed to be converted is here: https://pagure.io/copr/license-validate/blob/main/f/packages-without-spdx-f… List by package maintainers is here https://pagure.io/copr/license-validate/blob/main/f/packages-without-spdx-f… New version of fedora-license-data has been released. With: 5 new licenses. 5 licenses are waiting to be reviewed by SPDX.org (and then to be added to fedora-license-data) https://gitlab.com/fedora/legal/fedora-license-data/-/issues/?label_name%5B… Legal docs and especially https://docs.fedoraproject.org/en-US/legal/allowed-licenses/ was updated too. New projection when we will be finished is 2025-07-16 (+12 days from last report). Pure linear approximation. If your package does not have neither git-log entry nor spec-changelog entry mentioning SPDX and you know your license tag matches SPDX formula, you can put your package on ignore list https://pagure.io/copr/license-validate/blob/main/f/ignore-packages.txt Either pull-request or direct email to me is fine. Why Hause sign edition? Because on today's date at 1770 my hometown (Brno) introduced house numbering. BTW House numbering has various implementation over the word and it is big rabbit hole. [1]. I was wondering what was used before the house numbers? Outside of the cities plain names of families were used to identifies houses. But in big cities hause signs were used. So we have House of Two Suns, House of White Swan etc. Here are some pictures of house signs from Prague where they are still present in old city. http://www.notasthecrowsflies.com/2014/09/prague-house-signs-of-nerudova-st… [1] https://en.wikipedia.org/wiki/House_numbering Miroslav

1 0

Review and Guidance needed - licenses transforming based on time
by Michal Schorm 17 Jul '24

17 Jul '24

Hello, I'd like a review of 'MariaDB Business Source License (BSL)'. Here is a specific instance of the license: https://github.com/mariadb-corporation/MaxScale/blob/24.02/licenses/LICENSE… Here is FAQ about it: https://mariadb.com/bsl-faq-mariadb/ TL;DR: the license says it's non-free, but it becomes free (GPL in this case) after a specific time. -- Apart from this specific case, I'd like to hear your guidance in similar cases in general - whether they are mostly accepted or rather avoided (by Fedora), as more licenses with this idea exists, e.g.: https://github.com/getsentry/sentry/blob/master/LICENSE.md -- Michal Schorm Software Engineer Core Services - Databases Team Red Hat --

5 12

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

legal