March 2023 - legal - Fedora Mailing-Lists

by Jitka Plesnikova

Hi, the package perl-MemHandle doesn't contain any license/copyright text. It was already reported to upstream: https://rt.cpan.org/Public/Bug/Display.html?id=75350 The previous owner set the License tag to 'Public domain'. I want to knowas if I can use 'LicenseRef-Fedora-Public-Domain' or anything else? Thank for any help, Jitka -- Jitka Plesnikova Senior Software Engineer Red Hat

6 days, 17 hours

2
1
0 / 0

W3C Community Final Specification Agreement

by Jerry James

I have a followup question to a gitlab issue [1]. There are 3 files in the SMuFL repository [2], classes.json, glyphnames.json, and ranges.json, that are currently bundled in the mscore package. It would be advantageous to break those files out into a separate package for consumption by other SMuFL-aware software. The determination in [1] is that the presence of those files does not require a change to the mscore package License field. What about if they are in their own package? What would the License field of that package be? References: [1] https://gitlab.com/fedora/legal/fedora-license-data/-/issues/170 [2] https://github.com/w3c/smufl -- Jerry James http://www.jamezone.org/

1 week

2
1
0 / 0

CoPilot and Fedora packages

by Vitaly Zaitsev

Hello. I'm asking the Fedora Legal team for a position on open source projects containing GitHub CoPilot AI generated code. We need to solve this problem for the electrum update[1]. I think this is not a problem for OSS projects, because even if CoPilot copy-pastes GPL-licensed fragments, the license will be GPL. [1]: https://src.fedoraproject.org/rpms/electrum/pull-request/5 -- Sincerely, Vitaly Zaitsev (vitaly(a)easycoding.org)

1 week, 4 days

2
3
0 / 0

Fwd: SPDX Statistics - Independence of Lithuania edition

by Miroslav Suchý

-------- Přeposlaná zpráva -------- Předmět: SPDX Statistics - Independence of Lithuania edition Datum: Sat, 11 Mar 2023 07:10:57 +0100 Od: Miroslav Suchý <msuchy(a)redhat.com> Společnost: Red Hat Czech, s.r.o. Komu: Development discussions related to Fedora <devel(a)lists.fedoraproject.org> tl;dr - you converted 892 tags in 14 days, statistics script now does not mention recently introduced packages and you can put your package on ignore list Two weeks ago we had: > * 23060 spec files in Fedora > > * 29449license tags in all spec files > > * 21194 tags have not been converted to SPDX yet > > * 8439 tags can be trivially converted using `license-fedora2spdx` > Today we have: * 23107 spec files in Fedora * 29503license tags in all spec files * 20302 tags have not been converted to SPDX yet * 8096 tags can be trivially converted using `license-fedora2spdx` The list of packages needed to be converted is again here: https://pagure.io/copr/license-validate/blob/main/f/packages-without-spdx... List by package maintainers is here https://pagure.io/copr/license-validate/blob/main/f/packages-without-spdx... New version of fedora-license-data will be released tomorrow Legal docs and especially https://docs.fedoraproject.org/en-US/legal/allowed-licenses/ will be updated too. I updated the progress in this spreadsheet: https://docs.google.com/spreadsheets/d/1QVMEzXWML-6_Mrlln02axFAaRKCQ8zE80... You converted 892 license tags in 14 days. Amazing! New projection when we will be finished is 2024-04-24. Pure linear approximation. Now, the script ignores packages that started after 2022-08-01, because by that time SPDX for License tags has been already mandatory. If your package does not have neither git-log entry nor spec-changelog entry mentioning SPDX and you know your license tag matches SPDX formula, you can put your package on ignore list https://pagure.io/copr/license-validate/blob/main/f/ignore-packages.txt Either pull-request or email to me is fine. I already put there some packages that has been reported in past. Tip: SPDX formula allows to list licenses that are not on SPDX list, is uses LicenseRef-* notation. In Fedora we use it on few places. You can read about it here https://docs.fedoraproject.org/en-US/legal/license-review-process/#_what_... Why Independence of Lithuania? Because today - 11th March 1990 Lithuania declared an independece. It was first republic from Soviet Union. It was not easy and several people had to pay by their life. https://en.wikipedia.org/wiki/Act_of_the_Re-Establishment_of_the_State_of... Do you hesitate how to proceed with the migration? Please follow https://docs.fedoraproject.org/en-US/legal/update-existing-packages/ or attend SPDX office hours (see different thread in this mailing list) Miroslav

1 week, 5 days

1
0
0 / 0

License: GPL-3.0-or-later AND GPL-2.0-or-later

by Tomas Korbar

Hi guys, I am doing the conversion of license tags in my projects and i have a project where some files are under the GPL-2.0-or-later license and other under the GPL-3.0-or-later license. Perhaps this has been mentioned somewhere but i did not notice, but is it possible to merge these 2 into just GPL-3.0-or-later and thus reduce the specification to only one license? Thanks for any help. Tomas Korbar.

1 week, 6 days

2
1
0 / 0

Henry Spencer's license

by Petr Šabata

Dear legal, While checking the contents of our `perl' package, I noticed the following: (...) /* NOTE: this is derived from Henry Spencer's regexp code, and should not * confused with the original package (see point 3 below). Thanks, Henry! */ /* Additional note: this code is very heavily munged from Henry's version * in places. In some spots I've traded clarity for efficiency, so don't * blame Henry for some of the lack of readability. */ /* The names of the functions have been changed from regcomp and * regexec to pregcomp and pregexec in order to avoid conflicts * with the POSIX routines of the same names. */ (...) * pregcomp and pregexec -- regsub and regerror are not used in perl * * Copyright (c) 1986 by University of Toronto. * Written by Henry Spencer. Not derived from licensed software. * * Permission is granted to anyone to use this software for any * purpose on any computer system, and to redistribute it freely, * subject to the following restrictions: * * 1. The author is not responsible for the consequences of use of * this software, no matter how awful, even if they arise * from defects in it. * * 2. The origin of this software must not be misrepresented, either * by explicit claim or by omission. * * 3. Altered versions must be plainly marked as such, and must not * be misrepresented as being the original software. * **** Alterations to Henry's code are... **** **** Copyright (C) 1991, 1992, 1993, 1994, 1995, 1996, 1997, 1998, 1999, **** 2000, 2001, 2002, 2003, 2004, 2005, 2006, 2007, 2008 **** by Larry Wall and others **** **** You may distribute under the terms of either the GNU General Public **** License or the Artistic License, as specified in the README file. (...) You can see the whole file here: https://metacpan.org/source/SHAY/perl-5.20.1/regexec.c I looked but couldn't find any common name for this license of Henry's. Is it on our list? Is it free? What name should I use in the License tag? Thank you, Petr

2 weeks, 2 days

5
9
0 / 0

Fwd: SPDX Statistics - University of Constantinople edition

by Miroslav Suchý

-------- Přeposlaná zpráva -------- Předmět: SPDX Statistics - University of Constantinople edition Datum: Mon, 27 Feb 2023 23:34:52 +0100 Od: Miroslav Suchý <msuchy(a)redhat.com> Společnost: Red Hat Czech, s.r.o. Komu: Development discussions related to Fedora <devel(a)lists.fedoraproject.org> Two weeks ago we had: > * 23029 spec files in Fedora > > * 29405 license tags in all spec files > > * 22401 tags have not been converted to SPDX yet > > * 8795 tags can be trivially converted using `license-fedora2spdx` > Today we have: * 23060 spec files in Fedora * 29449license tags in all spec files * 21194 tags have not been converted to SPDX yet [*] * 8439 tags can be trivially converted using `license-fedora2spdx` [*] I have got some reports of packages that have been converted, but does not have spec/git changelog and I hope I will edit my scripts to work with some filter list. The list of packages needed to be converted is again here: https://pagure.io/copr/license-validate/blob/main/f/packages-without-spdx... List by package maintainers is here https://pagure.io/copr/license-validate/blob/main/f/packages-without-spdx... New version of fedora-license-data has been released. Legal docs and especially https://docs.fedoraproject.org/en-US/legal/allowed-licenses/ has been updated too. I updated the progress in this spreadsheet: https://docs.google.com/spreadsheets/d/1QVMEzXWML-6_Mrlln02axFAaRKCQ8zE80... You converted 1207 license tags in 14 days. Amazing! New projection when we will be finished is 2024-06-04. Pure linear approximation. Did you know?: rpmlint checks if you have correct license. It uses `rpmlint-fedora-license-data` which is a subpackage of `fedora-license-data`. So anytime a new version of `fedora-license-data` is released, rpmlint uses the new data. Why University of Constantinople? Because on today's day in a year 425 a.d. was found University of Constantinople. It lacked the structure of later universities so generally, it is missing in the top of oldest universities, but it was the beggining. https://en.wikipedia.org/wiki/University_of_Constantinople Do you hesitate how to proceed with the migration? Please follow https://docs.fedoraproject.org/en-US/legal/update-existing-packages/ or attend SPDX office hours (see different thread in this mailing list) Miroslav

2 weeks, 5 days

4
7
0 / 0

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

legal March 2023