legal June 2020

legal@lists.fedoraproject.org

13 participants
12 discussions

Sleepycat license with SaaS restriction
by Florian Weimer 08 Jul '25

08 Jul '25

cryptlib is licensed under the Sleepycat license with a SaaS restriction: “Note that decoupling the software from the user, for example by running in a SaaS configuration, does not exempt you from these requirements.” (Full text attached.) This was not part of the original Sleepycat license, so a new license tag is required. Maybe this license is not even free; this additional clause seems to be a restriction on use. But perhaps it is not so different from the AGPL. Thanks, Florian

6 8

Henry Spencer's license
by Petr Šabata 06 Mar '23

06 Mar '23

Dear legal, While checking the contents of our `perl' package, I noticed the following: (...) /* NOTE: this is derived from Henry Spencer's regexp code, and should not * confused with the original package (see point 3 below). Thanks, Henry! */ /* Additional note: this code is very heavily munged from Henry's version * in places. In some spots I've traded clarity for efficiency, so don't * blame Henry for some of the lack of readability. */ /* The names of the functions have been changed from regcomp and * regexec to pregcomp and pregexec in order to avoid conflicts * with the POSIX routines of the same names. */ (...) * pregcomp and pregexec -- regsub and regerror are not used in perl * * Copyright (c) 1986 by University of Toronto. * Written by Henry Spencer. Not derived from licensed software. * * Permission is granted to anyone to use this software for any * purpose on any computer system, and to redistribute it freely, * subject to the following restrictions: * * 1. The author is not responsible for the consequences of use of * this software, no matter how awful, even if they arise * from defects in it. * * 2. The origin of this software must not be misrepresented, either * by explicit claim or by omission. * * 3. Altered versions must be plainly marked as such, and must not * be misrepresented as being the original software. * **** Alterations to Henry's code are... **** **** Copyright (C) 1991, 1992, 1993, 1994, 1995, 1996, 1997, 1998, 1999, **** 2000, 2001, 2002, 2003, 2004, 2005, 2006, 2007, 2008 **** by Larry Wall and others **** **** You may distribute under the terms of either the GNU General Public **** License or the Artistic License, as specified in the README file. (...) You can see the whole file here: https://metacpan.org/source/SHAY/perl-5.20.1/regexec.c I looked but couldn't find any common name for this license of Henry's. Is it on our list? Is it free? What name should I use in the License tag? Thank you, Petr

5 9

about openssl we may enable and build all elliptic curves on corp ?
by Sérgio Basto 05 Nov '22

05 Nov '22

Hello, I reopen or start thinking again on this question of enable elliptic curves of openssl [1] So going directly to the point, may I built all source of openssl in copr [2] ? or at least some other curves that fedora package don't ship? [1] https://bugzilla.redhat.com/show_bug.cgi?id=1405843 [2] Version: 1.0.2k %global fips_version 2.0.14 I mean sources: http://ftp.o penssl.org/source/openssl-%{version}.tar.gz and http://ftp.openssl.org/s ource/openssl-fips-%{fips_version}.tar.gz Thanks , -- Sérgio M. B.

4 6

Lua Logo license text (restricted modifications)
by Miro Hrončok 08 Sep '20

08 Sep '20

Hello. I try to package a software that shows the Lua logo in it. https://bugzilla.redhat.com/show_bug.cgi?id=1834280 The logo's license is: Copyright © 1998 Lua.org. Graphic design by Alexandre Nakonechnyj. Permission is hereby granted, without written agreement and without license or royalty fees, to use, copy, and distribute this logo for any purpose, including commercial applications, subject to the following conditions: - The origin of this logo must not be misrepresented; you must not claim that you drew the original logo. - The only modification you can make is to adapt the orbiting text to your product name. - The logo can be used in any scale as long as the relative proportions of its elements are maintained. ---end--- Clearly, this does not allow modifications, but do we have some exceptions for branding? Or do I need to strip the logo out of the package? -- Miro Hrončok -- Phone: +420777974800 IRC: mhroncok

11 28

EUPL v1.2
by Björn 'besser82' Esser 24 Aug '20

24 Aug '20

Hello, I wanted to ask in general whether the EUPL v1.2 [1,2] is an acceptable license for Fedora. If it is acceptable, can we please list it in the wiki as a "good license", please? Thanks Björn [1] https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32017D0863 [2] https://opensource.org/licenses/EUPL-1.2

5 9

Question about license of Geant4 and its datasets
by Qiyu Yan 30 Jun '20

30 Jun '20

I am planning to package Geant 4 for Fedora, but I noticed Geant4's license is different from an usual one, which can be found here [1], I don't know if this is acceptable, if so, can you please add this to the 'Good License' list? And this toolkit can be funicational only with a number of datasets, mostly released by National Nuclear Data Center, I can't find any license attached to those data files. National Nuclear Data Center gives a term of use here [2] saying > Users should feel free to use the information from NuDat 2 (tables and plots) in their work, reports, presentations, articles and books. A general citations list of those datasets can be found here [3]. Seems that all of that data is royalty-free but instead of being released as a part of a software, it is more likely to be released as scientific papers. I think the term here [4] can apply here, but unsure. So I need help from the legal team to determine if this is acceptable. [1]: https://github.com/Geant4/geant4/blob/master/LICENSE [2]: https://www.nndc.bnl.gov/nudat2/help/index.jsp [3]: https://geant4.web.cern.ch/support/data_files_citations [4]: https://fedoraproject.org/wiki/Packaging:LicensingGuidelines?rd=Packaging/L…

2 1

Licensing Violation by iControlOne and ADT
by Rob Stitt 28 Jun '20

28 Jun '20

have the ADT Pulse security system (www.adt.com) which uses an iControlOne hub that is managed with software that is written and copyrighted by "iControlOne". The software itself says to go to "[http://www.icontrolone.com/]" to see open source license information. When I go there and then click the link for the "Open Source Attributions" page, that brings up a list of software, licences, and whether or not they have modified the code. One of the entries in the list is: ./external/elfutils http://fedoraproject.org/wiki/Licensing:OSL1.1 Furthermore, the site says "Modified versions of open source software available upon request.", but they have ABSOLUTELY NO contact information nor any method listed to contact them. With no way to actually make the request, their statement about "being available upon request" is nothing short of a fraudulent misstatement. As such, this company is clearly violating the terms of the fedora license, as they provide no method for actually requesting such a copy of the software--and there is no visible way to even find any contact for the actual company itself. Sincerely, ...Rob Stitt rob(a)robstitt.com

3 2

Packaging firmwares
by Robert-André Mauchin 28 Jun '20

28 Jun '20

Hello, I have a review request for a firmware: Boot firmware (ATF, UEFI...) for Mellanox BlueField: https://bugzilla.redhat.com/show_bug.cgi?id=1846139 I would like some opinions on whether this is acceptable firmware. The binary contains open source code for which the license are documented, but no code source is provided, only the resulting binary firmware. Thanks for any help, Robert-André

4 6

License of Go/Rust or any statically linked packages
by Vít Ondruch 26 Jun '20

26 Jun '20

Looking for example at git-lfs: https://src.fedoraproject.org/rpms/git-lfs/blob/master/f/git-lfs.spec I am afraid that the license field is wrong. Since the Go packages are statically linked, that means also content of all the BR is part of the binary packages and therefore should include their licenses. This also applies to Rust and all other statically linked packages. I believe the guidelines should be amended to handle this scenario and all the packages fixed appropriately. Thoughts? Vít

2 3

A non-vanilla GPLv3+ license question
by Qiyu Yan 13 Jun '20

13 Jun '20

In this https://bugzilla.redhat.com/show_bug.cgi?id=1846175 review request, the upstream license is https://github.com/trojan-gfw/trojan/blob/master/LICENSE That is a GPLv3 with the exception: In addition, as a special exception, the copyright holders give permission to link the code of portions of this program with the OpenSSL library under certain conditions as described in each individual source file, and distribute linked combinations including the two. It looks like a GNU General Public License v3.0 only, with Classpath exception, but I can't tell. Anyone can help me? Thanks in advance!

2 1

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

legal June 2020