Search results for "spdx" - legal - Fedora Mailing-Lists

Fwd: SPDX Statistics - Human Space Flight edition

by Miroslav Suchý

-------- Přeposlaná zpráva -------- Předmět: SPDX Statistics - Human Space Flight edition Datum: Fri, 12 Apr 2024 08:06:46 +0200 Od: Miroslav Suchý <msuchy(a)redhat.com> Společnost: Red Hat Czech, s.r.o. Komu: Development discussions related to Fedora <devel(a)lists.fedoraproject.org> Hot news: https://docs.fedoraproject.org/en-US/legal/allowed-licenses/ contains usage column for licenses that are allowed for something (documentation, firmware...) Automated migration of "trivial" conversions have started (see other threads in this mailing list). Two weeks ago we had: > * 23849spec files in Fedora > > * 30493license tags in all spec files > > * 11026 tags have not been converted to SPDX yet > > * 5004 tags can be trivially converted using `license-fedora2spdx` > > * Progress: 63,84% ░░░░░░████ 100% > > ELN subset: > > 100 out of 2395 packages are not converted yet (progress 95.82%) > Today we have: * 23901spec files in Fedora * 30551license tags in all spec files * 10964 tags have not been converted to SPDX yet * 4964 tags can be trivially converted using `license-fedora2spdx` * Progress: 64,11% ░░░░░░████ 100% ELN subset: 100 out of 2397 packages are not converted yet (progress 95.83%) Graph of these data with the burndown chart: https://docs.google.com/spreadsheets/d/1QVMEzXWML-6_Mrlln02axFAaRKCQ8zE80... The list of packages needed to be converted is here: https://pagure.io/copr/license-validate/blob/main/f/packages-without-spdx... List by package maintainers is here https://pagure.io/copr/license-validate/blob/main/f/packages-without-spdx... List of packages from ELN subset that needs to be converted: https://pagure.io/copr/license-validate/blob/main/f/eln-not-migrated.txt New version of fedora-license-data has been released. With: 1 new license (plus two public domain declarations). 14 licenses are waiting to be review by SPDX.org (and then to be added to fedora-license-data) https://gitlab.com/fedora/legal/fedora-license-data/-/issues/?label_name%... Legal docs and especially https://docs.fedoraproject.org/en-US/legal/allowed-licenses/ was updated too. License analysis of remaining packages: http://miroslav.suchy.cz/fedora/spdx-reports/ New projection when we will be finished is 2025-04-01 (+20 days from last report). Pure linear approximation. If your package does not have neither git-log entry nor spec-changelog entry mentioning SPDX and you know your license tag matches SPDX formula, you can put your package on ignore list https://pagure.io/copr/license-validate/blob/main/f/ignore-packages.txt Either pull-request or direct email to me is fine. Why Human Space Flight edition? On today's date at 1961 Yuri Gagarin flew to the space in Vostok 1. Since 1963 this day is celebrated as International Day of Human Space Flight. Also on this day at 1981 the first Space Shuttle (Columbia) was lunched. https://en.wikipedia.org/wiki/International_Day_of_Human_Space_Flight https://en.wikipedia.org/wiki/Vostok_1 And you may also learn about Oleg Ivanovsky https://www.telegraph.co.uk/news/obituaries/11111713/Oleg-Ivanovsky-obitu... Miroslav

2 weeks

Fwd: SPDX Statistics - Book Smugglers edition

by Miroslav Suchý

-------- Přeposlaná zpráva -------- Předmět: SPDX Statistics - Book Smugglers edition Datum: Sat, 16 Mar 2024 11:03:00 +0100 Od: Miroslav Suchý <msuchy(a)redhat.com> Společnost: Red Hat Czech, s.r.o. Komu: Development discussions related to Fedora <devel(a)lists.fedoraproject.org> Hot news: The last phase has been announce https://fedoraproject.org/wiki/Changes/SPDX_Licenses_Phase_4 and we will proceed when approved with FESCO. RC2 of SPDX <https://rodina-sucha.cz/tags/SPDX> v.3 specification has been published. https://spdx.github.io/spdx-spec/v3.0/ <https://spdx.github.io/spdx-spec/v3.0/><https://spdx.github.io/spdx-spec/v3.0/>. Two weeks ago we had: > * 23786spec files in Fedora > > * 30396license tags in all spec files > > * 11182 tags have not been converted to SPDX yet > > * 5044 tags can be trivially converted using `license-fedora2spdx` > > * Progress: 63,21% ░░░░░░████ 100% > > ELN subset: > > 112 out of 2411 packages are not converted yet (progress 95.35%) > Today we have: * 23821spec files in Fedora * 30463license tags in all spec files * 11091 tags have not been converted to SPDX yet * 4996 tags can be trivially converted using `license-fedora2spdx` * Progress: 63,59% ░░░░░░████ 100% ELN subset: 105 out of 2411 packages are not converted yet (progress 95.64%) Graph of these data with the burndown chart: https://docs.google.com/spreadsheets/d/1QVMEzXWML-6_Mrlln02axFAaRKCQ8zE80... The list of packages needed to be converted is here: https://pagure.io/copr/license-validate/blob/main/f/packages-without-spdx... List by package maintainers is here https://pagure.io/copr/license-validate/blob/main/f/packages-without-spdx... List of packages from ELN subset that needs to be converted: https://pagure.io/copr/license-validate/blob/main/f/eln-not-migrated.txt New version of fedora-license-data has been released. With: 1 new license (plus two public domain declarations). 16 licenses are waiting to be review by SPDX.org (and then to be added to fedora-license-data) https://gitlab.com/fedora/legal/fedora-license-data/-/issues/?label_name%... Legal docs and especially https://docs.fedoraproject.org/en-US/legal/allowed-licenses/ was updated too. License analysis of remaining packages: http://miroslav.suchy.cz/fedora/spdx-reports/ New projection when we will be finished is 2025-02-22 (+21 days from last report). Pure linear approximation. If your package does not have neither git-log entry nor spec-changelog entry mentioning SPDX and you know your license tag matches SPDX formula, you can put your package on ignore list https://pagure.io/copr/license-validate/blob/main/f/ignore-packages.txt Either pull-request or direct email to me is fine. Why Book Smugglers? On this date, at 1846 was born Jurgis Bielinis who become successful book smugglers and even founded Garšviai Book Smuggling Society at the time of Lithuanian press ban. Bielinis is informally referred to as the King of Book Smugglers. Bielinis's birthday is commemorated as the Day of Book Smugglers. More reading about Lithuanian book smugglers: https://www.atlasobscura.com/articles/lithuanian-book-smugglers https://en.wikipedia.org/wiki/Jurgis_Bielinis (my favourite part is when he hid from police under his wife's skirt) Does it inspired you? You can become book smuggler even nowadays: https://wordsrated.com/global-book-banning-statistics/ Miroslav

1 month, 1 week

Re: Trivy for licenses

by Philippe Ombredanne

Hi Maxwell: On Sun, Mar 3, 2024, Maxwell G wrote: > Has anyone every used trivy [1] to scan for licenses? It appears more > robust and better maintained than askalono-cli and can detect files with > multiple licenses and licenses embedded in file headers. I have been > running it with "trivy fs --scanners license --license-full ." > > [1] https://github.com/aquasecurity/trivy IMHO trivy is not a robust tool for license detection from me trying it. It is mostly based on google/licenseclassifier which had a single commit in the last 17 months, and this means this is not more maintained than askalono (and frankly both are fairly lightweight tools for license detection). Trivy adds SPDX expression parsing on top of the google/licenseclassifier and that's it. I would not rely on these for anything serious and certainly not to scan code for license prior to its inclusion in Fedora. If you want robust license detection, consider using ScanCode [2] and Scancode.io [3] for more complex pipelines. Both are tools that I co-maintain and are considered as better tools for this. Do not hesitate to reach out for help! Not directly related, I just found out ScanCode has been used for building large code LLMs [4] [1] https://github.com/google/licenseclassifier [2] https://github.com/nexB/scancode-toolkit [3] https://github.com/nexB/scancode.io [4] https://huggingface.co/papers/2402.19173 -- Cordially Philippe Ombredanne +1 650 799 0949 | pombredanne(a)nexB.com AboutCode - Open source for open source - https://www.aboutcode.org VulnerableCode - the open code and open data vulnerability database - https://github.com/nexb/vulnerablecode ScanCode - scan your code, for origin/license/vulnerabilities, report SBOMs - https://github.com/nexB/scancode-toolkit https://github.com/nexB/scancode.io package-url - the mostly universal SBOM identifier for packages - https://github.com/package-url DejaCode - What's in your code?! - http://www.dejacode.com

1 month, 3 weeks

Fwd: SPDX Statistics - Beginning of the year edition

by Miroslav Suchý

-------- Přeposlaná zpráva -------- Předmět: SPDX Statistics - Beginning of the year edition Datum: Fri, 1 Mar 2024 09:27:48 +0100 Od: Miroslav Suchý <msuchy(a)redhat.com> Společnost: Red Hat Czech, s.r.o. Komu: Development discussions related to Fedora <devel(a)lists.fedoraproject.org> Hot news: fedora-license-data has Copr project https://copr.fedorainfracloud.org/coprs/g/osci/fedora-license-data where new package is built whenever new PR is merged The last phase is ready for wrangler https://fedoraproject.org/wiki/Changes/SPDX_Licenses_Phase_4 and we will proceed when approved with FESCO. I corrected lots of SPDX formula where you used lowercase "and", "or". The specification allows only "AND", "OR". This will likely change in specification version 3, but now the operator has to be upper case. Two weeks ago we had: > * 23737spec files in Fedora > > * 30335license tags in all spec files > > * 11314 tags have not been converted to SPDX yet > > * 5105 tags can be trivially converted using `license-fedora2spdx` > > * Progress: 62,70% ░░░░░░████ 100% > > ELN subset: > > 128 out of 2412 packages are not converted yet (progress 94.69%) > Today we have: * 23786spec files in Fedora * 30396license tags in all spec files * 11182 tags have not been converted to SPDX yet * 5044 tags can be trivially converted using `license-fedora2spdx` * Progress: 63,21% ░░░░░░████ 100% ELN subset: 112 out of 2411 packages are not converted yet (progress 95.35%) Graph of these data with the burndown chart: https://docs.google.com/spreadsheets/d/1QVMEzXWML-6_Mrlln02axFAaRKCQ8zE80... The list of packages needed to be converted is here: https://pagure.io/copr/license-validate/blob/main/f/packages-without-spdx... List by package maintainers is here https://pagure.io/copr/license-validate/blob/main/f/packages-without-spdx... List of packages from ELN subset that needs to be converted: https://pagure.io/copr/license-validate/blob/main/f/eln-not-migrated.txt New version of fedora-license-data has been released. With: 7 new licenses (plus some public domain declarations). 17 licenses are waiting to be review by SPDX.org (and then to be added to fedora-license-data) https://gitlab.com/fedora/legal/fedora-license-data/-/issues/?label_name%... Legal docs and especially https://docs.fedoraproject.org/en-US/legal/allowed-licenses/ was updated too. License analysis of remaining packages: http://miroslav.suchy.cz/fedora/spdx-reports/ New projection when we will be finished is 2025-02-01 (+17 days from last report). Pure linear approximation. If your package does not have neither git-log entry nor spec-changelog entry mentioning SPDX and you know your license tag matches SPDX formula, you can put your package on ignore list https://pagure.io/copr/license-validate/blob/main/f/ignore-packages.txt Either pull-request or direct email to me is fine. Why Beggining of the year? That should be January 1st, right? Before the advent of the Gregorian calendar, March 1st was considered the beginning of the year. Hence Septemeber as the "seventh month" despite the fact it is 9th now. But in the Republic of Venice, for example, March was considered the beginning of the year until 1797. So in Venice, March 1790 < January 1790. For more interesting facts about time (and time zones) see this legendary video https://www.youtube.com/watch?v=-5wpm-gesOY Miroslav

1 month, 3 weeks

Re: Question about public domain file in dictd

by Carlos Rodriguez-Fernandez

Hi Jilayne, I have created the MR [1]. Thank you. [1] https://gitlab.com/fedora/legal/fedora-license-data/-/merge_requests/541 On 2/28/24 15:14, Jilayne Lovejoy wrote: > Speaking as a member of the Fedora legal team: What Ben said below > (thanks Ben!) > > I can confirm that this would be considered a public domain dedication > and does not need an issue to review it, but you can make a MR to this > file, see instructions at the top: > https://gitlab.com/fedora/legal/fedora-license-data/-/blob/main/public-do... > > Thanks! > Jilayne > > On 2/28/24 8:14 AM, Ben Beasley wrote: >> Speaking as an experienced packager, not a member of the Fedora legal >> team: >> >> Although some authors conflate it with “public domain,” CC0-1.0 is >> just one type of ultra-permissive license. It is not-allowed for code >> in Fedora due to concerns about patent-related language in the actual >> CC0-1.0 license, not due to a general prohibition on public-domain >> dedications or ultra-permissive licenses. >> >> The md5.c file you mention does not reference CC0-1.0 at all, and is >> in fact under a simple “public-domain dedication” that would be >> assigned the SPDX id LicenseRef-Fedora-PublicDomain. >> >> You do need to submit the text for review and tracking under the >> process outlined in >> https://docs.fedoraproject.org/en-US/legal/update-existing-packages/#_pub..., but I have no doubt that it will be approved; this is a straightforward public-domain dedication, and this particular md5 implementation is very widespread and well-known and already bundled in many of packages in Fedora. In fact, under the old rules for bundling that required explicit exceptions, this MD5 implementation was one of the documented “copylibs,” https://fedoraproject.org/wiki/Bundled_Libraries_Virtual_Provides#cite_no.... >> >> On 2/28/24 9:57 AM, Carlos Rodriguez-Fernandez wrote: >>> Hi, >>> >>> I have been preparing a new update to dictd, and while doing it, I >>> ran the licensecheck to double-check and cleanup the license tag. >>> >>> I found out that the licenses involved in the source code for the new >>> 1.13.1 are more than originally specified in 1.12.x. There is a >>> COPYING file with GPL-2.0-only, but the source code files have more. >>> The final list is: >>> >>> GPL-2.0-only AND GPL-1.0-or-later AND GPL-3.0-or-later >>> AND MIT AND GPL-2.0-or-later AND BSD-3-Clause >>> >>> There is one file in the source code that claims to be "public >>> domain" [1]: >>> >>> >>> This code was written by Colin Plumb in 1993, no copyright is claimed. >>> This code is in the public domain; do with it what you wish >>> >>> >>> This file is indeed code, so the allowed content exception for >>> CC0-1.0 doesn't apply. The file is not written by the upstream >>> maintainer but appears to be authored by someone else not in the >>> maintainer list. I'm not sure how to proceed here. I could request >>> the upstream developer to see if he can change the license but not >>> sure will be able since it is not his. Would this be a valid case for >>> Unlicense? >>> >>> >>> [1] https://github.com/cheusov/dictd/blob/1.13.1/md5.c >>> >>> >>> >>> >>> Thank you, >>> Carlos R.F. >>> >>> -- >>> _______________________________________________ >>> legal mailing list -- legal(a)lists.fedoraproject.org >>> To unsubscribe send an email to legal-leave(a)lists.fedoraproject.org >>> Fedora Code of Conduct: >>> https://docs.fedoraproject.org/en-US/project/code-of-conduct/ >>> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines >>> List Archives: >>> https://lists.fedoraproject.org/archives/list/legal@lists.fedoraproject.org >>> Do not reply to spam, report it: >>> https://pagure.io/fedora-infrastructure/new_issue >> -- >> _______________________________________________ >> legal mailing list -- legal(a)lists.fedoraproject.org >> To unsubscribe send an email to legal-leave(a)lists.fedoraproject.org >> Fedora Code of Conduct: >> https://docs.fedoraproject.org/en-US/project/code-of-conduct/ >> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines >> List Archives: >> https://lists.fedoraproject.org/archives/list/legal@lists.fedoraproject.org >> Do not reply to spam, report it: >> https://pagure.io/fedora-infrastructure/new_issue > > > -- > _______________________________________________ > legal mailing list -- legal(a)lists.fedoraproject.org > To unsubscribe send an email to legal-leave(a)lists.fedoraproject.org > Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines > List Archives: https://lists.fedoraproject.org/archives/list/legal@lists.fedoraproject.org > Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue

1 month, 3 weeks

Re: Question about public domain file in dictd

by Carlos Rodriguez-Fernandez

Ben, and Jilayne, Thank you for the guidance on this. Best Regards, Carlos R.F. On 2/28/24 15:14, Jilayne Lovejoy wrote: > Speaking as a member of the Fedora legal team: What Ben said below > (thanks Ben!) > > I can confirm that this would be considered a public domain dedication > and does not need an issue to review it, but you can make a MR to this > file, see instructions at the top: > https://gitlab.com/fedora/legal/fedora-license-data/-/blob/main/public-do... > > Thanks! > Jilayne > > On 2/28/24 8:14 AM, Ben Beasley wrote: >> Speaking as an experienced packager, not a member of the Fedora legal >> team: >> >> Although some authors conflate it with “public domain,” CC0-1.0 is >> just one type of ultra-permissive license. It is not-allowed for code >> in Fedora due to concerns about patent-related language in the actual >> CC0-1.0 license, not due to a general prohibition on public-domain >> dedications or ultra-permissive licenses. >> >> The md5.c file you mention does not reference CC0-1.0 at all, and is >> in fact under a simple “public-domain dedication” that would be >> assigned the SPDX id LicenseRef-Fedora-PublicDomain. >> >> You do need to submit the text for review and tracking under the >> process outlined in >> https://docs.fedoraproject.org/en-US/legal/update-existing-packages/#_pub..., but I have no doubt that it will be approved; this is a straightforward public-domain dedication, and this particular md5 implementation is very widespread and well-known and already bundled in many of packages in Fedora. In fact, under the old rules for bundling that required explicit exceptions, this MD5 implementation was one of the documented “copylibs,” https://fedoraproject.org/wiki/Bundled_Libraries_Virtual_Provides#cite_no.... >> >> On 2/28/24 9:57 AM, Carlos Rodriguez-Fernandez wrote: >>> Hi, >>> >>> I have been preparing a new update to dictd, and while doing it, I >>> ran the licensecheck to double-check and cleanup the license tag. >>> >>> I found out that the licenses involved in the source code for the new >>> 1.13.1 are more than originally specified in 1.12.x. There is a >>> COPYING file with GPL-2.0-only, but the source code files have more. >>> The final list is: >>> >>> GPL-2.0-only AND GPL-1.0-or-later AND GPL-3.0-or-later >>> AND MIT AND GPL-2.0-or-later AND BSD-3-Clause >>> >>> There is one file in the source code that claims to be "public >>> domain" [1]: >>> >>> >>> This code was written by Colin Plumb in 1993, no copyright is claimed. >>> This code is in the public domain; do with it what you wish >>> >>> >>> This file is indeed code, so the allowed content exception for >>> CC0-1.0 doesn't apply. The file is not written by the upstream >>> maintainer but appears to be authored by someone else not in the >>> maintainer list. I'm not sure how to proceed here. I could request >>> the upstream developer to see if he can change the license but not >>> sure will be able since it is not his. Would this be a valid case for >>> Unlicense? >>> >>> >>> [1] https://github.com/cheusov/dictd/blob/1.13.1/md5.c >>> >>> >>> >>> >>> Thank you, >>> Carlos R.F. >>> >>> -- >>> _______________________________________________ >>> legal mailing list -- legal(a)lists.fedoraproject.org >>> To unsubscribe send an email to legal-leave(a)lists.fedoraproject.org >>> Fedora Code of Conduct: >>> https://docs.fedoraproject.org/en-US/project/code-of-conduct/ >>> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines >>> List Archives: >>> https://lists.fedoraproject.org/archives/list/legal@lists.fedoraproject.org >>> Do not reply to spam, report it: >>> https://pagure.io/fedora-infrastructure/new_issue >> -- >> _______________________________________________ >> legal mailing list -- legal(a)lists.fedoraproject.org >> To unsubscribe send an email to legal-leave(a)lists.fedoraproject.org >> Fedora Code of Conduct: >> https://docs.fedoraproject.org/en-US/project/code-of-conduct/ >> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines >> List Archives: >> https://lists.fedoraproject.org/archives/list/legal@lists.fedoraproject.org >> Do not reply to spam, report it: >> https://pagure.io/fedora-infrastructure/new_issue > > > -- > _______________________________________________ > legal mailing list -- legal(a)lists.fedoraproject.org > To unsubscribe send an email to legal-leave(a)lists.fedoraproject.org > Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines > List Archives: https://lists.fedoraproject.org/archives/list/legal@lists.fedoraproject.org > Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue

1 month, 3 weeks

Re: Question about public domain file in dictd

by Jilayne Lovejoy

Speaking as a member of the Fedora legal team: What Ben said below (thanks Ben!) I can confirm that this would be considered a public domain dedication and does not need an issue to review it, but you can make a MR to this file, see instructions at the top: https://gitlab.com/fedora/legal/fedora-license-data/-/blob/main/public-do... Thanks! Jilayne On 2/28/24 8:14 AM, Ben Beasley wrote: > Speaking as an experienced packager, not a member of the Fedora legal > team: > > Although some authors conflate it with “public domain,” CC0-1.0 is > just one type of ultra-permissive license. It is not-allowed for code > in Fedora due to concerns about patent-related language in the actual > CC0-1.0 license, not due to a general prohibition on public-domain > dedications or ultra-permissive licenses. > > The md5.c file you mention does not reference CC0-1.0 at all, and is > in fact under a simple “public-domain dedication” that would be > assigned the SPDX id LicenseRef-Fedora-PublicDomain. > > You do need to submit the text for review and tracking under the > process outlined in > https://docs.fedoraproject.org/en-US/legal/update-existing-packages/#_pub..., > but I have no doubt that it will be approved; this is a > straightforward public-domain dedication, and this particular md5 > implementation is very widespread and well-known and already bundled > in many of packages in Fedora. In fact, under the old rules for > bundling that required explicit exceptions, this MD5 implementation > was one of the documented “copylibs,” > https://fedoraproject.org/wiki/Bundled_Libraries_Virtual_Provides#cite_no.... > > On 2/28/24 9:57 AM, Carlos Rodriguez-Fernandez wrote: >> Hi, >> >> I have been preparing a new update to dictd, and while doing it, I >> ran the licensecheck to double-check and cleanup the license tag. >> >> I found out that the licenses involved in the source code for the new >> 1.13.1 are more than originally specified in 1.12.x. There is a >> COPYING file with GPL-2.0-only, but the source code files have more. >> The final list is: >> >> GPL-2.0-only AND GPL-1.0-or-later AND GPL-3.0-or-later >> AND MIT AND GPL-2.0-or-later AND BSD-3-Clause >> >> There is one file in the source code that claims to be "public >> domain" [1]: >> >> >> This code was written by Colin Plumb in 1993, no copyright is claimed. >> This code is in the public domain; do with it what you wish >> >> >> This file is indeed code, so the allowed content exception for >> CC0-1.0 doesn't apply. The file is not written by the upstream >> maintainer but appears to be authored by someone else not in the >> maintainer list. I'm not sure how to proceed here. I could request >> the upstream developer to see if he can change the license but not >> sure will be able since it is not his. Would this be a valid case for >> Unlicense? >> >> >> [1] https://github.com/cheusov/dictd/blob/1.13.1/md5.c >> >> >> >> >> Thank you, >> Carlos R.F. >> >> -- >> _______________________________________________ >> legal mailing list -- legal(a)lists.fedoraproject.org >> To unsubscribe send an email to legal-leave(a)lists.fedoraproject.org >> Fedora Code of Conduct: >> https://docs.fedoraproject.org/en-US/project/code-of-conduct/ >> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines >> List Archives: >> https://lists.fedoraproject.org/archives/list/legal@lists.fedoraproject.org >> Do not reply to spam, report it: >> https://pagure.io/fedora-infrastructure/new_issue > -- > _______________________________________________ > legal mailing list -- legal(a)lists.fedoraproject.org > To unsubscribe send an email to legal-leave(a)lists.fedoraproject.org > Fedora Code of Conduct: > https://docs.fedoraproject.org/en-US/project/code-of-conduct/ > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines > List Archives: > https://lists.fedoraproject.org/archives/list/legal@lists.fedoraproject.org > Do not reply to spam, report it: > https://pagure.io/fedora-infrastructure/new_issue

1 month, 3 weeks

Re: Question about public domain file in dictd

by Ben Beasley

Speaking as an experienced packager, not a member of the Fedora legal team: Although some authors conflate it with “public domain,” CC0-1.0 is just one type of ultra-permissive license. It is not-allowed for code in Fedora due to concerns about patent-related language in the actual CC0-1.0 license, not due to a general prohibition on public-domain dedications or ultra-permissive licenses. The md5.c file you mention does not reference CC0-1.0 at all, and is in fact under a simple “public-domain dedication” that would be assigned the SPDX id LicenseRef-Fedora-PublicDomain. You do need to submit the text for review and tracking under the process outlined in https://docs.fedoraproject.org/en-US/legal/update-existing-packages/#_pub..., but I have no doubt that it will be approved; this is a straightforward public-domain dedication, and this particular md5 implementation is very widespread and well-known and already bundled in many of packages in Fedora. In fact, under the old rules for bundling that required explicit exceptions, this MD5 implementation was one of the documented “copylibs,” https://fedoraproject.org/wiki/Bundled_Libraries_Virtual_Provides#cite_no.... On 2/28/24 9:57 AM, Carlos Rodriguez-Fernandez wrote: > Hi, > > I have been preparing a new update to dictd, and while doing it, I ran > the licensecheck to double-check and cleanup the license tag. > > I found out that the licenses involved in the source code for the new > 1.13.1 are more than originally specified in 1.12.x. There is a > COPYING file with GPL-2.0-only, but the source code files have more. > The final list is: > > GPL-2.0-only AND GPL-1.0-or-later AND GPL-3.0-or-later > AND MIT AND GPL-2.0-or-later AND BSD-3-Clause > > There is one file in the source code that claims to be "public domain" > [1]: > > > This code was written by Colin Plumb in 1993, no copyright is claimed. > This code is in the public domain; do with it what you wish > > > This file is indeed code, so the allowed content exception for CC0-1.0 > doesn't apply. The file is not written by the upstream maintainer but > appears to be authored by someone else not in the maintainer list. I'm > not sure how to proceed here. I could request the upstream developer > to see if he can change the license but not sure will be able since it > is not his. Would this be a valid case for Unlicense? > > > [1] https://github.com/cheusov/dictd/blob/1.13.1/md5.c > > > > > Thank you, > Carlos R.F. > > -- > _______________________________________________ > legal mailing list -- legal(a)lists.fedoraproject.org > To unsubscribe send an email to legal-leave(a)lists.fedoraproject.org > Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines > List Archives: https://lists.fedoraproject.org/archives/list/legal@lists.fedoraproject.org > Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue

1 month, 3 weeks

Re: License review for package scummvm

by Miroslav Suchý

Dne 20. 02. 24 v 1:21 Jilayne Lovejoy napsal(a): > wow, that's a long list ;) It is not so long. You only need to go through first table and last table. The middle one just contains list of files. > - do you have a way to de-dupe? No. I go manually over that and usually stop on first license that I do not have in a list and review if it is false or positive match and go to next one. Skipping licenses that already on list. > what tooling are you using? This report was generated using this command: ~/.local/bin/scancode --license --html /tmp/spdx.html --license-references -n6 scummvm-2.8.0 -- Miroslav Suchy, RHCA Red Hat, Manager, Packit and CPT, #brno, #fedora-buildsys

2 months

Re: License review for package scummvm

by Jilayne Lovejoy

On 2/14/24 6:24 PM, Richard Fontana wrote: > On Wed, Feb 14, 2024 at 8:12 PM Richard Fontana <rfontana(a)redhat.com> wrote: >> On Wed, Feb 14, 2024 at 6:55 PM Christian Krause <chkr(a)fedoraproject.org> wrote: >>> COPYING.GLAD contains: >>> - an MIT license (although "Software" is substituted with "materials") >>> - an Apache 2.0 license >>> - another MIT license >>> -> SPDX: MIT AND Apache-2.0 >> The Khronos license uses "the Materials" instead of "the Software". >> There was a recent issue in github.com/spdx/license-list-XML about >> this, I forget where SPDX ended up on this (whether to revise `MIT` or >> to create a new identifier), check the SPDX issues or wait for Jilayne >> to chime in. :) > There is already this open issue: > https://gitlab.com/fedora/legal/fedora-license-data/-/issues/238 > although that is about a different version of the license with an > additional admonition paragraph. The SPDX issue is: > https://github.com/spdx/license-list-XML/issues/2017 > I'm not clear on whether the SPDX issue is considering the > non-admonition variant. correct the "old" Khronos license has been accepted. I'm not sure if we have a separate issue as to "materials" v. "software" in the regular MIT, but I have a recollection we discussed on one of the SPDX-legal calls. Will check... > > Richard > -- > _______________________________________________ > legal mailing list -- legal(a)lists.fedoraproject.org > To unsubscribe send an email to legal-leave(a)lists.fedoraproject.org > Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines > List Archives: https://lists.fedoraproject.org/archives/list/legal@lists.fedoraproject.org > Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue

2 months

legal search results for query "spdx"