Question about two Fedora packages that are CC0

[Máirín Duffy]

Hi Fedora Legal! 👋

I have a question about two packages in Fedora that are dependencies for
goose, which our (Rodolfo and I's) team are working on packaging for
Fedora. They are:

- *constant_time_eq* -
   https://packages.fedoraproject.org/pkgs/rust-constant_time_eq/
   - *tiny-keccak - *
   https://packages.fedoraproject.org/pkgs/rust-tiny-keccak

*constant_time_eq*'s upstream states it may be used under CC0, Apache 2.0,
or MIT at the user's option:
https://github.com/cesarb/constant_time_eq (see README)

*tiny-keccak *is CC0 only, though: https://github.com/debris/tiny-keccak

Goose is built in Rust, and we're looking at packaging it as a bundle and
vendoring dependencies like these. They already exist in Fedora, but not
sure what the policy is on pre-existing libraries like these.

Questions:

- Assuming just because these are already packaged in Fedora, doesn't mean
they're ok to vendor in another Fedora package. Correct?
- Can we use one of the other licenses for *constant_time_eq* which are
acceptable for Fedora packages? Or are there any concerns there?
- Do you have any advice on how to handle *tiny-keccak*'s license?

Greatly appreciate your help in advance!!

Thanks,
~m

[Neal Gompa]

On Thu, Jan 15, 2026 at 9:48 AM Máirín Duffy via legal <
[e-mail]> wrote:
> Hi Fedora Legal! 👋
>
> I have a question about two packages in Fedora that are dependencies for
> goose, which our (Rodolfo and I's) team are working on packaging for
> Fedora. They are:
> *constant_time_eq* -
>
> https://packages.fedoraproject.org/pkgs/rust-constant_time_eq/
> *tiny-keccak - *
>
> https://packages.fedoraproject.org/pkgs/rust-tiny-keccak
>
> *constant_time_eq*'s upstream states it may be used under CC0, Apache
> 2.0, or MIT at the user's option:
> https://github.com/cesarb/constant_time_eq (see README)
>
> *tiny-keccak *is CC0 only, though: https://github.com/debris/tiny-keccak
>
> Goose is built in Rust, and we're looking at packaging it as a bundle and
> vendoring dependencies like these. They already exist in Fedora, but not
> sure what the policy is on pre-existing libraries like these.
>
> Questions:
> Assuming just because these are already packaged in Fedora, doesn't mean
>
> they're ok to vendor in another Fedora package. Correct?

That is correct. If you're pulling them in normally, they are covered by
the grandfather clause for now, but new stuff (including vendoring) will
need fixes.
> Can we use one of the other licenses for *constant_time_eq* which are
>
> acceptable for Fedora packages? Or are there any concerns there?

As it is multi-licensed, there's no concern. In practice we'd just consider
CC0 a null option.
> Do you have any advice on how to handle *tiny-keccak*'s license?

Ask the upstream to change to a suitable alternative? Usually I suggest MIT
instead. If they accept the change, then you can pull that back into Fedora.

[Máirín Duffy]

On Thu, Jan 15, 2026 at 9:51 AM Neal Gompa  wrote:
> > Do you have any advice on how to handle *tiny-keccak*'s license?
>
> Ask the upstream to change to a suitable alternative? Usually I suggest
> MIT instead. If they accept the change, then you can pull that back into
> Fedora.

Working on that. It's a cryptographic library though - is there any impact
on how we view licensing given a work of that nature?

~m

[Daniel P. Berrangé]

On Thu, Jan 15, 2026 at 09:51:06AM -0500, Neal Gompa via legal wrote:
> On Thu, Jan 15, 2026 at 9:48 AM Máirín Duffy via legal <
> [e-mail]> wrote:
> > Hi Fedora Legal! 👋
> >
> > I have a question about two packages in Fedora that are dependencies for
> > goose, which our (Rodolfo and I's) team are working on packaging for
> > Fedora. They are:
> > *constant_time_eq* -
> >
> > https://packages.fedoraproject.org/pkgs/rust-constant_time_eq/
> > *tiny-keccak - *
> >
> > https://packages.fedoraproject.org/pkgs/rust-tiny-keccak
> >
> > *constant_time_eq*'s upstream states it may be used under CC0, Apache
> > 2.0, or MIT at the user's option:
> > https://github.com/cesarb/constant_time_eq (see README)
> >
> > *tiny-keccak *is CC0 only, though: https://github.com/debris/tiny-keccak
> >
> > Goose is built in Rust, and we're looking at packaging it as a bundle and
> > vendoring dependencies like these. They already exist in Fedora, but not
> > sure what the policy is on pre-existing libraries like these.
> >
> > Questions:
> > Assuming just because these are already packaged in Fedora, doesn't mean
> >
> > they're ok to vendor in another Fedora package. Correct?
>
> That is correct. If you're pulling them in normally, they are covered by
> the grandfather clause for now, but new stuff (including vendoring) will
> need fixes.
> > Can we use one of the other licenses for *constant_time_eq* which are
> >
> > acceptable for Fedora packages? Or are there any concerns there?
>
> As it is multi-licensed, there's no concern. In practice we'd just consider
> CC0 a null option.

And in terms of the RPM License field this means only listing the subset
of licenses choices that are permitted in Fedora
> > Do you have any advice on how to handle *tiny-keccak*'s license?
>
> Ask the upstream to change to a suitable alternative? Usually I suggest MIT
> instead. If they accept the change, then you can pull that back into Fedora.

There's also MIT-0 / 0BSD as very permissive options if that was their
goal in choosing CC0 originally.

With regards,
Daniel

[Máirín Duffy]

On Thu, Jan 15, 2026 at 10:07 AM Daniel P. Berrangé 
wrote:
> There's also MIT-0 / 0BSD as very permissive options if that was their
> goal in choosing CC0 originally.

Ooh great suggestion Dan!! I filed a request upstream and also emailed the
author with that suggestion (https://github.com/debris/tiny-keccak/issues/62
)

~m