legal May 2021

legal@lists.fedoraproject.org

7 participants
7 discussions

Brainpool Curves in Fedora (openssl, libgcrypt, gnupg)
by Timothée Ravier 21 May '24

21 May '24

Hi everyone, The ECC Brainpool Curves [1][2] are currently not available in Fedora as according to this BZ [3], this needs Fedora Legal approval. Could someone from the legal team take a look to see if there are any blockers regarding Brainpool Curves inclusion in Fedora? Thanks! [1] https://en.wikipedia.org/wiki/Elliptic-curve_cryptography#Implementation [2] https://tools.ietf.org/html/rfc5639 [3] https://bugzilla.redhat.com/show_bug.cgi?id=1413618

14 31

Henry Spencer's license
by Petr Šabata 06 Mar '23

06 Mar '23

Dear legal, While checking the contents of our `perl' package, I noticed the following: (...) /* NOTE: this is derived from Henry Spencer's regexp code, and should not * confused with the original package (see point 3 below). Thanks, Henry! */ /* Additional note: this code is very heavily munged from Henry's version * in places. In some spots I've traded clarity for efficiency, so don't * blame Henry for some of the lack of readability. */ /* The names of the functions have been changed from regcomp and * regexec to pregcomp and pregexec in order to avoid conflicts * with the POSIX routines of the same names. */ (...) * pregcomp and pregexec -- regsub and regerror are not used in perl * * Copyright (c) 1986 by University of Toronto. * Written by Henry Spencer. Not derived from licensed software. * * Permission is granted to anyone to use this software for any * purpose on any computer system, and to redistribute it freely, * subject to the following restrictions: * * 1. The author is not responsible for the consequences of use of * this software, no matter how awful, even if they arise * from defects in it. * * 2. The origin of this software must not be misrepresented, either * by explicit claim or by omission. * * 3. Altered versions must be plainly marked as such, and must not * be misrepresented as being the original software. * **** Alterations to Henry's code are... **** **** Copyright (C) 1991, 1992, 1993, 1994, 1995, 1996, 1997, 1998, 1999, **** 2000, 2001, 2002, 2003, 2004, 2005, 2006, 2007, 2008 **** by Larry Wall and others **** **** You may distribute under the terms of either the GNU General Public **** License or the Artistic License, as specified in the README file. (...) You can see the whole file here: https://metacpan.org/source/SHAY/perl-5.20.1/regexec.c I looked but couldn't find any common name for this license of Henry's. Is it on our list? Is it free? What name should I use in the License tag? Thank you, Petr

5 9

about openssl we may enable and build all elliptic curves on corp ?
by Sérgio Basto 05 Nov '22

05 Nov '22

Hello, I reopen or start thinking again on this question of enable elliptic curves of openssl [1] So going directly to the point, may I built all source of openssl in copr [2] ? or at least some other curves that fedora package don't ship? [1] https://bugzilla.redhat.com/show_bug.cgi?id=1405843 [2] Version: 1.0.2k %global fips_version 2.0.14 I mean sources: http://ftp.o penssl.org/source/openssl-%{version}.tar.gz and http://ftp.openssl.org/s ource/openssl-fips-%{fips_version}.tar.gz Thanks , -- Sérgio M. B.

4 6

Curious maybe FOSS license that I can't identify
by Robert-André Mauchin 01 Jun '21

01 Jun '21

Hello, In a review I came across this License: © Copyright 2000 UserLand Software, Inc. All Rights Reserved. © Copyright 2006-2007 Scripting News, Inc. All Rights Reserved. UserLand Software, Inc. and Scripting News, Inc. are refererred to in the following as "the Companies." This document and translations of it may be copied and furnished to others, and derivative works that comment on or otherwise explain it or assist in its implementation may be prepared, copied, published and distributed, in whole or in part, without restriction of any kind, provided that the above copyright notice and these paragraphs are included on all such copies and derivative works. This document may not be modified in any way, such as by removing the copyright notice or references to the Companies or other organizations. Further, while these copyright restrictions apply to the written OPML specification, no claim of ownership is made by the Companies to the format it describes. Any party may, for commercial or non-commercial purposes, implement this format without royalty or license fee to the Companies. The limited permissions granted herein are perpetual and will not be revoked by the Companies or their successors or assigns. This document and the information contained herein is provided on an "AS IS" basis and THE COMPANIES DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. I've found some RFC example like: http://dev.opml.org/spec1.html https://www.w3.org/Protocols/rfc2616/rfc2616-sec21.html https://tools.ietf.org/html/rfc2549 It seems to refer to translation these specifications. I don't know the name of that license. Can anyone identify it and tell me if it's acceptable in Fedora? Best regards, Robert-André

4 3

Please add Minpack license to the list of Good Licenses
by Jiri Kucera 27 May '21

27 May '21

Hello, eigen3-devel rpm contains files[1] distributed under the Minpack license[2] (permissive BSD-like license). Currently, Minpack is not on the list of Good Licenses[3]. Please add this license to the list so eigen3.spec License field can be fixed. Regards, Jiri [1] https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org… [2] http://www.netlib.org/minpack/disclaimer [3] https://fedoraproject.org/wiki/Licensing:Main#Good_Licenses

2 2

New font license in TeXLive 2021: Atkinson Hyperlegible Font License
by Tom Callaway 27 May '21

27 May '21

Hi friends, In packaging up TeXLive 2021, I've come across a new font license, the Atkinson Hyperlegible Font License. It is derived from the SIL Open Font License, but contains enough changes that it deserves its own tag. As it grants the same rights, with the same restrictions as SIL OFL, I believe it to be Free and acceptable for Fedora. I humbly suggest "AHFL" as the short name identifier for this license, as neither this license, nor that shortname are in SPDX at this time. License text can be found here: https://www.brailleinstitute.org/wp-content/uploads/2020/11/Atkinson-Hyperl… Thanks, ~spot

2 1

AppStream metainfo license in package license
by Parag Nemade 14 May '21

14 May '21

Hi, There are some packages where packager ships their own Source: files which are AppStream metainfo xml files under "CC0" license but do not list it in the package license tag. We have a guidelines page https://docs.fedoraproject.org/en-US/packaging-guidelines/AppData/ for AppStream metainfo files. Some such package examples are https://src.fedoraproject.org/rpms/liberation-fonts/ https://src.fedoraproject.org/rpms/langpacks/ https://src.fedoraproject.org/rpms/firefox/ There are other 2 examples where upstream itself provides xml files in CC0 license but it is also not listed in its package license tag. https://gitlab.gnome.org/GNOME/NetworkManager-openvpn/-/blob/master/appdata… https://github.com/virt-manager/virt-manager/blob/master/data/virt-manager.… My question is these xml files are in "CC0" license and the package has its own license already in the SPEC file. Should SPEC file License: tag add "and CC0" for those packages? I do not remember why AppStream xml file's license was not considered in SPEC file License: tag. Anyone knows why listing "CC0" is not needed? Regards, Parag.

2 2

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

legal May 2021