Dealing with patented code included in tarballs

[Igor Gnatenko]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Hi,

I maintain some package and it used to include some patented stuff
before. Now I sanitize tarball, but what's the deal with old versions?
- -- 
- -Igor Gnatenko
> -----BEGIN PGP SIGNATURE-----
>
> iQIzBAEBCAAdFiEEhLFO09aHZVqO+CM6aVcUvRu8X0wFAloFs2YACgkQaVcUvRu8
> X0zJsxAAonqdBKx8eKt4pnYHZc323DNWJQ4H11JPwxmFJBk2/GGwTT8veMo9znn6
> Mk3cofDmJttvom/DBM2gequjVOtiGgqlH0a7M4pXxmNXy4+cU2ktjaduKTmgT+th
> RJL8qjvp3Wpwz/SoutwJN3DCJ1B/7fEjtaFXLXXvmNNqClSlkYGr2T3OWUfIp0z9
> hAtVCsPqh625w6HdeSpISxxRfkWNtWao6d5kIA2+Cmce+odT+oPdZhc+WNLzBTpd
> //EHEeXoOHJxhWcTJOVO9d8Civ+0+1jh6gTGWuy8wXEe0DiSiwG/XY1Gx6jeSeBH
> 01xzPs2Qo6Fn/VMbwX7SH0UC8IUshuWVhhx4EqI/KdWj+a2+XKk+jnxa70wVpCIb
> b0uHJW0PyRxN+K+8bYej98e5u/6GSP1O+Ftf44DKlEzwf+32tiMqqTHxdHww8/z1
> gMxP7jFzeeFvf3pQB4ctpzOMnRlGhIX3X1oWkgHXYiQLfcMJC7HGfpIUreWz89vQ
> hRRTdF/vnT3veSXR/2SHD9pN1vzOrZY4dDmX3T6tIE1iFbksDkD0s2srrEYBdMtC
> MiwiXTRgl3mlFiRO6X3r29NnvQOnDI3wXjLcQmoWV7TrageHlKcjraIw5qaNxQs9
> 5uRaxY8Z5GFA2LOY87JDPuP2PY/RlelvfDqZYm5ExXDofav2LJ8=
> =+QpI
> -----END PGP SIGNATURE-----

[Tom Callaway]

On 11/10/2017 09:10 AM, Igor Gnatenko wrote:
>  Hi,
>  
>  I maintain some package and it used to include some patented stuff
>  before. Now I sanitize tarball, but what's the deal with old versions? 
You've made a clean tarball, that's the first step. Make sure your
SOURCES does not contain the unclean tarball. Be sure that none of the
active Fedora branches (including EPEL) contain the problematic code in
the latest update (this may mean that you need to push updates just for
this change).

You do not need to worry about any files in the lookaside which are not
referenced in SOURCES.

hth,

~tom