legal August 2021

legal@lists.fedoraproject.org

10 participants
6 discussions

Brainpool Curves in Fedora (openssl, libgcrypt, gnupg)
by Timothée Ravier 21 May '24

21 May '24

Hi everyone, The ECC Brainpool Curves [1][2] are currently not available in Fedora as according to this BZ [3], this needs Fedora Legal approval. Could someone from the legal team take a look to see if there are any blockers regarding Brainpool Curves inclusion in Fedora? Thanks! [1] https://en.wikipedia.org/wiki/Elliptic-curve_cryptography#Implementation [2] https://tools.ietf.org/html/rfc5639 [3] https://bugzilla.redhat.com/show_bug.cgi?id=1413618

14 31

Henry Spencer's license
by Petr Šabata 06 Mar '23

06 Mar '23

Dear legal, While checking the contents of our `perl' package, I noticed the following: (...) /* NOTE: this is derived from Henry Spencer's regexp code, and should not * confused with the original package (see point 3 below). Thanks, Henry! */ /* Additional note: this code is very heavily munged from Henry's version * in places. In some spots I've traded clarity for efficiency, so don't * blame Henry for some of the lack of readability. */ /* The names of the functions have been changed from regcomp and * regexec to pregcomp and pregexec in order to avoid conflicts * with the POSIX routines of the same names. */ (...) * pregcomp and pregexec -- regsub and regerror are not used in perl * * Copyright (c) 1986 by University of Toronto. * Written by Henry Spencer. Not derived from licensed software. * * Permission is granted to anyone to use this software for any * purpose on any computer system, and to redistribute it freely, * subject to the following restrictions: * * 1. The author is not responsible for the consequences of use of * this software, no matter how awful, even if they arise * from defects in it. * * 2. The origin of this software must not be misrepresented, either * by explicit claim or by omission. * * 3. Altered versions must be plainly marked as such, and must not * be misrepresented as being the original software. * **** Alterations to Henry's code are... **** **** Copyright (C) 1991, 1992, 1993, 1994, 1995, 1996, 1997, 1998, 1999, **** 2000, 2001, 2002, 2003, 2004, 2005, 2006, 2007, 2008 **** by Larry Wall and others **** **** You may distribute under the terms of either the GNU General Public **** License or the Artistic License, as specified in the README file. (...) You can see the whole file here: https://metacpan.org/source/SHAY/perl-5.20.1/regexec.c I looked but couldn't find any common name for this license of Henry's. Is it on our list? Is it free? What name should I use in the License tag? Thank you, Petr

5 9

about openssl we may enable and build all elliptic curves on corp ?
by Sérgio Basto 05 Nov '22

05 Nov '22

Hello, I reopen or start thinking again on this question of enable elliptic curves of openssl [1] So going directly to the point, may I built all source of openssl in copr [2] ? or at least some other curves that fedora package don't ship? [1] https://bugzilla.redhat.com/show_bug.cgi?id=1405843 [2] Version: 1.0.2k %global fips_version 2.0.14 I mean sources: http://ftp.o penssl.org/source/openssl-%{version}.tar.gz and http://ftp.openssl.org/s ource/openssl-fips-%{fips_version}.tar.gz Thanks , -- Sérgio M. B.

4 6

The FPCA’s “Moral Rights Clause Waiver” should be updated for CC BY-SA 4.0
by Jason Yundt 18 Oct '21

18 Oct '21

Hello, In the FCPA <https://fedoraproject.org/wiki/Legal:Fedora_Project_Contributor_Agreement#F…>, The definition for “Moral Rights Clause Waiver” references “Section 4d of CC-BY-SA”, but that subsection doesn’t exist <https://creativecommons.org/licenses/by-sa/4.0/legalcode#s4>. Also, the Other FAQs <https://fedoraproject.org/wiki/Legal:Fedora_Project_Contributor_Agreement#O…>’s first two questions still refer to CC BY-SA 3.0 even though the FCPA has been updated to use CC BY-SA 4.0. Jason Yundt

6 21

License for NIST datasets
by Davide Cavalca 30 Aug '21

30 Aug '21

Hello! I'm packaging rust-statrs in https://bugzilla.redhat.com/show_bug.cgi?id=1993498 and while reviewing it Fabio (in CC) noticed it includes some NIST datasets under data/nist that don't seem to have a clear attribution. You can see them here: https://github.com/statrs-dev/statrs/tree/master/data/nist After some spelunking, I found these come from one of the NIST SRD datasets: https://www.itl.nist.gov/div898/strd/univ/backgroundinfo.html That page doesn't have a clear license either, but more spelunking reveals https://www.nist.gov/open/copyright-fair-use-and-licensing-statements-srd-d… which is getting closer. Specifically, I'm pretty sure these fall under the "Standard Reference Data (SRD)" license stated there, which says: --- The Standard Reference Data Act, 15 U.S.C. § 290e, empowers the Secretary of Commerce to secure copyright on behalf of the United States in Standard Reference Data (SRD) prepared by NIST. SRD data products should include the following statement: Copyright protection on this compilation of data has been secured by the Secretary of the U.S. Department of Commerce on behalf of the United States in the United States and all countries that are parties to the Universal Copyright Convention, pursuant to Section 290(e) of Title 15 of the United States Code. NIST Standard Reference Data (SRD); ©Copyright [©YEAR] by the U.S. Secretary of Commerce on behalf of the United States of America. All rights reserved. --- To my untrained eye, this looks like a fairly standard copyright attribution thing and should be ok to redistribute and package in Fedora, but I'd like an official blessing as I don't see this license listed on https://fedoraproject.org/wiki/Licensing:Main . Thanks! Cheers Davide

3 5

Acceptability of a documentation license
by Jeffrey H. Johnson 29 Aug '21

29 Aug '21

Greetings, As suggested on the Fedora wiki, I'm contacting the list to inquire regarding the acceptability of the following proposed documentation license, as I'd like to ensure that it will become be an impediment to having documentation included in Fedora (or using Fedora Copr). --- THE DPS8M DOCUMENTATION LICENSE Version 0.9, 29 August 2021 Copyright © 2019‑2021 The DPS8M Development Team All Rights Reserved. This documentation was produced by The DPS8M Development Team and other contributors. Any views or conclusions contained in this documentation are those of the authors, and must not be interpreted as representing official policies, either express or implied, of The DPS8M Development Team. Redistribution and use in ‘source’ (including, but not limited to, TeX, LaTeX, SGML DocBook, reStructuredText, Markdown, RUNOFF, Lout, etc.) and ‘compiled’ forms (including, but not limited to, transformations to other DTDs, conversions to SGML, XHTML, PDF, DjVu, XPS, PostScript, RTF, or other formats, etc.), in whole or in part, for any purpose, including commercial applications, with or without modification, in any medium, is hereby permitted, without fee or royalty, provided that the following conditions are met: 1. Redistributions of ‘source’ forms must retain, unaltered, the above text, copyright notice, any other notices of legal privilege, this list of conditions, and the following disclaimer. 2. Redistributions of ‘compiled’ forms must reproduce, verbatim, the above text, copyright notice, any other notices of legal privilege, this list of conditions, and the following disclaimer prominently in the documentation and/or other human‑readable materials provided with the distribution. 3. The origin of this documentation, including the names of the distributors, assemblers, authors, contributors, and holders of copyright or other legal privilege must not be misrepresented. 4. Except as contained in this notice, the names of the distributors, assemblers, authors, contributors, and holders of copyright or other legal privilege must not be used in advertising or publicity. 5. Any deviation from these conditions requires explicit prior written permission from the distributors, assemblers, authors, contributors, and holders of copyright or other legal privilege. THIS DOCUMENTATION IS PROVIDED “AS IS” AND WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, CORRECTNESS, AND NON‑INFRINGEMENT OF COPYRIGHT, PATENT, TRADEMARK, OR OTHER RIGHT. THE DISTRIBUTORS, ASSEMBLERS, AUTHORS, CONTRIBUTORS, AND HOLDERS OF COPYRIGHT OR OTHER LEGAL PRIVILEGE MAKE NO CLAIMS, PROMISES, OR GUARANTEES REGARDING THE ACCURACY, CURRENCY, COMPLETENESS, AUTHENTICITY, RELIABILITY, USEFULNESS, OR ADEQUACY OF ANY INFORMATION, AND HAVE NO OBLIGATION TO PROVIDE MAINTENANCE, SUPPORT, UPDATES, ENHANCEMENTS, MODIFICATIONS, OR CORRECTIONS TO, AND EXPRESSLY DISCLAIM LIABILITY FOR ANY ERRORS AND OMISSIONS WITHIN THIS DOCUMENTATION. IN NO EVENT SHALL THE DISTRIBUTORS, ASSEMBLERS, AUTHORS, CONTRIBUTORS, AND HOLDERS OF COPYRIGHT OR OTHER LEGAL PRIVILEGE BE LIABLE FOR ANY CLAIM, OR DIRECT, INDIRECT, INCIDENTAL, SPECIAL, GENERAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED, AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE), ARISING FROM, OUT OF, OR IN CONNECTION WITH ANY USE OR PERFORMANCE OF THIS DOCUMENTATION, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. All company names, product names, service names, brand names, service marks, and registered trademarks mentioned herein are for information and identification purposes only and are the property of their respective owners; the use of these names, brands, and marks does not imply affiliation, endorsement, or sponsorship. --- Thank you, -- Jeffrey H. Johnson trnsz(a)pobox.com

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

legal August 2021