Package log4j 2.17.2 contains strangely-licensed files

[Marián Konček]

Hi, in the Fedora package "log4j" (branch Rawhide) I noticed a file 
apache-log4j-2.17.2-src/src/site/resources/glyphicons-halflings-2-1.zip

It contains "_glyphicons_license.pdf" which also points here 
https://glyphicons.com/license/

I am asking for a legal review of this license.

[Richard Fontana]

(removing spdx-legal - this is off-topic for that list)

Hi Marián,

Our preference would be for you to submit an issue at
https://gitlab.com/fedora/legal/fedora-license-data . Let us know if
that is not possible.

It's been a long time since I've been aware of a glyphicons license
issue but I remember this coming up a lot at one time, particularly in
the era when Bootstrap seemed to be extraordinarily popular. My vague
recollection is that Twitter was said to have negotiated some
alternative terms for use of these in Bootstrap, in some manner which
I guess was not transparent to Boostrap users, which resulted in the
inclusion of the standard terms in large numbers of projects. On the
face of it this license does not seem to be acceptable for Fedora.
Anyway this will require some research.

Richard

On Thu, Oct 6, 2022 at 6:44 AM Marián Konček  wrote:
> Hi, in the Fedora package "log4j" (branch Rawhide) I noticed a file apache-log4j-2.17.2-src/src/site/resources/glyphicons-halflings-2-1.zip
>
> It contains "_glyphicons_license.pdf" which also points here https://glyphicons.com/license/
>
> I am asking for a legal review of this license.
>
> --
> Marián Konček
>
> legal mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]
> Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives: https://lists.fedoraproject.org/archives/list/[e-mail]
> Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue

[Marián Konček]

I would like to follow-up with a question about what should happen to 
any artifacts that are still being distributed by Fedora as I believe 
the *proper* solution is to stop distributing these problematic files. I 
am talking specifically lookaside caches but I don't know what else 
there is.

I created an issue for this: https://pagure.io/releng/issue/11083

On 6. 10. 2022 14:43, Richard Fontana wrote:
> (removing spdx-legal - this is off-topic for that list)
>
> Hi Marián,
>
> Our preference would be for you to submit an issue at
> https://gitlab.com/fedora/legal/fedora-license-data . Let us know if
> that is not possible.
>
> It's been a long time since I've been aware of a glyphicons license
> issue but I remember this coming up a lot at one time, particularly in
> the era when Bootstrap seemed to be extraordinarily popular. My vague
> recollection is that Twitter was said to have negotiated some
> alternative terms for use of these in Bootstrap, in some manner which
> I guess was not transparent to Boostrap users, which resulted in the
> inclusion of the standard terms in large numbers of projects. On the
> face of it this license does not seem to be acceptable for Fedora.
> Anyway this will require some research.
>
> Richard
>
> On Thu, Oct 6, 2022 at 6:44 AM Marián Konček  wrote:
> > Hi, in the Fedora package "log4j" (branch Rawhide) I noticed a file apache-log4j-2.17.2-src/src/site/resources/glyphicons-halflings-2-1.zip
> >
> > It contains "_glyphicons_license.pdf" which also points here https://glyphicons.com/license/
> >
> > I am asking for a legal review of this license.
> >
> > --
> > Marián Konček
> >
> > legal mailing list -- [e-mail]
> > To unsubscribe send an email to [e-mail]
> > Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> > List Archives: https://lists.fedoraproject.org/archives/list/[e-mail]
> > Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue

[Vít Ondruch]

I think that there also SRPMs available in Koji if nowhere else.

Vít

Dne 21. 10. 22 v 13:28 Marián Konček napsal(a):
> I would like to follow-up with a question about what should happen to 
> any artifacts that are still being distributed by Fedora as I believe 
> the *proper* solution is to stop distributing these problematic files. 
> I am talking specifically lookaside caches but I don't know what else 
> there is.
>
> I created an issue for this: https://pagure.io/releng/issue/11083
>
> On 6. 10. 2022 14:43, Richard Fontana wrote:
> > (removing spdx-legal - this is off-topic for that list)
> >
> > Hi Marián,
> >
> > Our preference would be for you to submit an issue at
> > https://gitlab.com/fedora/legal/fedora-license-data . Let us know if
> > that is not possible.
> >
> > It's been a long time since I've been aware of a glyphicons license
> > issue but I remember this coming up a lot at one time, particularly in
> > the era when Bootstrap seemed to be extraordinarily popular. My vague
> > recollection is that Twitter was said to have negotiated some
> > alternative terms for use of these in Bootstrap, in some manner which
> > I guess was not transparent to Boostrap users, which resulted in the
> > inclusion of the standard terms in large numbers of projects. On the
> > face of it this license does not seem to be acceptable for Fedora.
> > Anyway this will require some research.
> >
> > Richard
> >
> > On Thu, Oct 6, 2022 at 6:44 AM Marián Konček  wrote:
> > > Hi, in the Fedora package "log4j" (branch Rawhide) I noticed a file 
> > > apache-log4j-2.17.2-src/src/site/resources/glyphicons-halflings-2-1.zip
> > >
> > > It contains "_glyphicons_license.pdf" which also points here 
> > > https://glyphicons.com/license/
> > >
> > > I am asking for a legal review of this license.
> > >
> > > -- 
> > > Marián Konček
> > >
> > > legal mailing list -- [e-mail]
> > > To unsubscribe send an email to [e-mail]
> > > Fedora Code of Conduct: 
> > > https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> > > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> > > List Archives: 
> > > https://lists.fedoraproject.org/archives/list/[e-mail]
> > > Do not reply to spam, report it: 
> > > https://pagure.io/fedora-infrastructure/new_issue