Requesting license review of 7zip (also: question about public domain review requirements)

[Michel Lind]

Dear legal list,

I just filed
https://gitlab.com/fedora/legal/fedora-license-data/-/issues/640
requesting review request for 7zip's license.

TL;DR - this is blocking the review of 7zip, which we want to have as a
replacement for p7zip which is dead upstream (and is needed by e.g. the
Fedora Asahi Remix)

The specific worry is
- the language dedicating this to the public domain is very spartan
(all of them are one-liners, see the issue)
- some of these are done by other people and not the main project
author, with no reference to where the sources are obtained from

Related question: as I understand it public domain dedications have to
be vetted before use, but where is this requirement documented? e.g.
https://docs.fedoraproject.org/en-US/legal/license-approval/#_overview
does not specifically mention a special process for LicenseRef-Fedora-
Public-Domain.

Thanks,

[Michel Lind]

On Thu, 2025-03-20 at 12:39 -0500, Michel Lind via legal wrote:
> Dear legal list,
>
> I just filed
> https://gitlab.com/fedora/legal/fedora-license-data/-/issues/640
> requesting review request for 7zip's license.
>
> TL;DR - this is blocking the review of 7zip, which we want to have as
> a
> replacement for p7zip which is dead upstream (and is needed by e.g.
> the
> Fedora Asahi Remix)
>
> The specific worry is
> the language dedicating this to the public domain is very spartan
>
> (all of them are one-liners, see the issue)
> some of these are done by other people and not the main project
>
> author, with no reference to where the sources are obtained from
>
> Related question: as I understand it public domain dedications have
> to
> be vetted before use, but where is this requirement documented? e.g.
> https://docs.fedoraproject.org/en-US/legal/license-approval/#_overview
> does not specifically mention a special process for LicenseRef-
> Fedora-
> Public-Domain.

One thing to note - it also has unrar files, which we need a decision
on
- is it fine if they are in the source tarballs but deleted in prep and
support not compiled in
- or do we need to ship a stripped tarball

Best regards,

[Daniel P. Berrangé]

On Thu, Mar 20, 2025 at 01:49:28PM -0500, Michel Lind via legal wrote:
> On Thu, 2025-03-20 at 12:39 -0500, Michel Lind via legal wrote:
> > Dear legal list,
> >
> > I just filed
> > https://gitlab.com/fedora/legal/fedora-license-data/-/issues/640
> > requesting review request for 7zip's license.
> >
> > TL;DR - this is blocking the review of 7zip, which we want to have as
> > a
> > replacement for p7zip which is dead upstream (and is needed by e.g.
> > the
> > Fedora Asahi Remix)
> >
> > The specific worry is
> > the language dedicating this to the public domain is very spartan
> >
> > (all of them are one-liners, see the issue)
> > some of these are done by other people and not the main project
> >
> > author, with no reference to where the sources are obtained from
> >
> > Related question: as I understand it public domain dedications have
> > to
> > be vetted before use, but where is this requirement documented? e.g.
> > https://docs.fedoraproject.org/en-US/legal/license-approval/#_overview
> > does not specifically mention a special process for LicenseRef-
> > Fedora-
> > Public-Domain.
>
> One thing to note - it also has unrar files, which we need a decision
> on
> is it fine if they are in the source tarballs but deleted in prep and
>
> support not compiled in
> or do we need to ship a stripped tarball

https://fedoraproject.org/wiki/Licensing:Unrar

"the license requires that you agree to these use restrictions,
   or you must remove the software (source and binary) from your
   hard disks. Accordingly, this means that any code under this
   license can not be shipped as part of Fedora in source or
   binary form."

This indicates you'll need to strip it from the original upstream
tarballs & repack them.  Best practice would be to include a shell
script in dist-git which takes the upstream tarball, purges the
files, and creates the new tarball, so that the re-packing process
is verifiable.

With regards,
Daniel

[Sérgio Basto]

On Fri, 2025-03-21 at 08:26 +0000, Daniel P. Berrangé via legal wrote:
> On Thu, Mar 20, 2025 at 01:49:28PM -0500, Michel Lind via legal
> wrote:
> > On Thu, 2025-03-20 at 12:39 -0500, Michel Lind via legal wrote:
> > > Dear legal list,
> > >
> > > I just filed
> > > https://gitlab.com/fedora/legal/fedora-license-data/-/issues/640
> > > requesting review request for 7zip's license.
> > >
> > > TL;DR - this is blocking the review of 7zip, which we want to
> > > have as
> > > a
> > > replacement for p7zip which is dead upstream (and is needed by
> > > e.g.
> > > the
> > > Fedora Asahi Remix)
> > >
> > > The specific worry is
> > > the language dedicating this to the public domain is very
> > >
> > > spartan
> > > (all of them are one-liners, see the issue)
> > > some of these are done by other people and not the main project
> > >
> > > author, with no reference to where the sources are obtained from
> > >
> > > Related question: as I understand it public domain dedications
> > > have
> > > to
> > > be vetted before use, but where is this requirement documented?
> > > e.g.
> > > https://docs.fedoraproject.org/en-US/legal/license-approval/#_overview
> > > does not specifically mention a special process for LicenseRef-
> > > Fedora-
> > > Public-Domain.
> >
> > One thing to note - it also has unrar files, which we need a
> > decision
> > on
> > is it fine if they are in the source tarballs but deleted in prep
> >
> > and
> > support not compiled in
> > or do we need to ship a stripped tarball
>
> https://fedoraproject.org/wiki/Licensing:Unrar
>
> "the license requires that you agree to these use restrictions,
>    or you must remove the software (source and binary) from your
>    hard disks. Accordingly, this means that any code under this
>    license can not be shipped as part of Fedora in source or
>    binary form."
>
> This indicates you'll need to strip it from the original upstream
> tarballs & repack them.  Best practice would be to include a shell
> script in dist-git which takes the upstream tarball, purges the
> files, and creates the new tarball, so that the re-packing process
> is verifiable.

It's pity, 7zip now supports build without rar

Best regards,

[Ben Beasley]

On Thu, Mar 20, 2025, at 1:39 PM, Michel Lind via legal wrote:
> Related question: as I understand it public domain dedications have to
> be vetted before use, but where is this requirement documented? e.g.
> https://docs.fedoraproject.org/en-US/legal/license-approval/#_overview
> does not specifically mention a special process for LicenseRef-Fedora-
> Public-Domain.

This is documented in the “Updating Existing Packages” section, which probably isn’t currently the best place for it.

https://docs.fedoraproject.org/en-US/legal/update-existing-packages/#_public...

[Michel Lind]

On Thu, 2025-03-20 at 15:04 -0400, Ben Beasley via legal wrote:
> On Thu, Mar 20, 2025, at 1:39 PM, Michel Lind via legal wrote:
> > Related question: as I understand it public domain dedications have
> > to
> > be vetted before use, but where is this requirement documented?
> > e.g.
> > https://docs.fedoraproject.org/en-US/legal/license-approval/#_overview
> > does not specifically mention a special process for LicenseRef-
> > Fedora-
> > Public-Domain.
>
> This is documented in the “Updating Existing Packages” section, which
> probably isn’t currently the best place for it.
>
> https://docs.fedoraproject.org/en-US/legal/update-existing-packages/#_public...

Ahh, thanks. Yes, I agree. Especially since... new package review is
when we catch most of these issues

We really need better ways of tracking issues affecting existing
packages. Maybe once we move to forgejo we can look having a Debian
style tracker flagging both bugs and nits (e.g. hey you're not using
the new Python guidelines!)

Best regards,