legal August 2024

legal@lists.fedoraproject.org

12 participants
7 discussions

Licensing BIP derived files
by Cristian Le 04 Oct '24

04 Oct '24

Hi, This issue came up when trying to package rust-tiny-bip39 [1]. Basically there are some projects that are spun off of Bitcoin Improvement Proposals (BIP), in this case BIP39 [2] which establishes a wordlist which can be use as mnemonic to encode/decode a long series of bits. Te issue is that typically these BIPs are licensed [3], but (maybe) because BIP39 has not passed the proposed stage, it did not receive a proper license. So the question is, how to deal with the wordlist defined in BIP39? Contacting the upstream developer is difficult as they don't have an open issue page, and the main means of external people to get in touch with them is through their google mailing list, which would require exposing my personal gmail account to who knows what (given the association with bitcoin), which I am not comfortable of doing. In Fedora there is another BIP39 based project, python-mnemonic [4], which is the reference code for BIP39, where the only license specified is MIT. I have looked at the review request ticket [5], but the licensing of BIP39 was not discussed there. Any advice on this situation? [1]: https://bugzilla.redhat.com/show_bug.cgi?id=2297307 [2]: https://github.com/bitcoin/bips/blob/master/bip-0039.mediawiki [3]: https://github.com/bitcoin/bips/blob/master/bip-0002.mediawiki#bip-licensing [4]: https://src.fedoraproject.org/rpms/python-mnemonic [5]: https://bugzilla.redhat.com/show_bug.cgi?id=1395867

2 1

Request to stop hobbling crypto libraries
by Neal Gompa 12 Sep '24

12 Sep '24

Hey all, As part of the discussion going on about Mesa on devel@, the situation around OpenSSL was brought up, and Adam Williamson brought up that we might not need to hobble OpenSSL anymore[1]. A quick check seems to indicate we no longer do it for GnuTLS either, and haven't for many years[2]. Could we just drop all this stuff and use pristine OpenSSL sources? All the crypto algorithm usability stuff is controlled through crypto-policies, so I don't think it makes sense to do this anymore for OpenSSL since all the patents indicated in the script have expired for a couple of years now[3]. Dropping this will eliminate a chunk of cruft that nobody needs around anymore and simplify OpenSSL maintenance. [1]: https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org… [2]: https://src.fedoraproject.org/rpms/gnutls/c/46d865d8451be0f4576dcc56841175a… [3]: https://src.fedoraproject.org/rpms/openssl//blob/rawhide/f/hobble-openssl -- 真実はいつも一つ！/ Always, there's only one truth!

7 16

tcplay generic_xts* file licenses
by Ian McInerney 26 Aug '24

26 Aug '24

I am working on the Zulucrypt 7.0.0 update and SPDX license audit at the same time, and there is one license listed in their copyright file that isn't obvious to me. Specifically, it is the generic_xts files included in the bundled tcplay (https://github.com/mhogomchungu/zuluCrypt/blob/master/external_libraries/tc…) It is bundled because upstream has made changes to it, and also we no longer have tcplay in Fedora (it was retired 5 years ago for FTBFS). The file header says: /* * Copyright (C) 2008, Damien Miller * Copyright (C) 2011, Alex Hornung * * Permission to use, copy, and modify this software with or without fee * is hereby granted, provided that this entire notice is included in * all copies of any software which is or includes a copy or * modification of this software. * You may use this code under the GNU public license if you so wish. Please * contribute changes back to the authors under this freer than GPL license * so that we may further the use of strong encryption without limitations to * all. * * THIS SOFTWARE IS BEING PROVIDED "AS IS", WITHOUT ANY EXPRESS OR * IMPLIED WARRANTY. IN PARTICULAR, NONE OF THE AUTHORS MAKES ANY * REPRESENTATION OR WARRANTY OF ANY KIND CONCERNING THE * MERCHANTABILITY OF THIS SOFTWARE OR ITS FITNESS FOR ANY PARTICULAR * PURPOSE. */ Is it appropriate to list this under the GPL in the license tag, or does this need its own licenseref in Fedora? (I already have tags for GPL-3.0-or-later AND GPL-2.0-or-later anyway).

2 2

Fwd: SPDX Statistics - Gold Rush Edition
by Miroslav Suchý 16 Aug '24

16 Aug '24

-------- Přeposlaná zpráva -------- Předmět: SPDX Statistics - Gold Rush Edition Datum: Fri, 16 Aug 2024 17:14:03 +0200 Od: Miroslav Suchý <msuchy(a)redhat.com> Společnost: Red Hat Czech, s.r.o. Komu: Development discussions related to Fedora <devel(a)lists.fedoraproject.org> Hot news: * Almost all trivial conversion has been done. Only 208 "trivial" cases remains. I will not continue converting them to SPDX counterpart as there are various caveats hidden there. I will go over the remaining cases one by one. But it is likely that most of them will be converted to some form of LicenseRef-* * I sent email about my intention to convert all remaining 5k licenses to LicenseRef-Callaway-*. In upcoming days I will send a proper diff in smaller batches that can be easier for review. Two weeks ago we had: > * 24248spec files in Fedora > > * 30924license tags in all spec files > > * 7016 tags have not been converted to SPDX yet > > * 1383 tags can be trivially converted using `license-fedora2spdx` > > * Progress: 77,31% ░░░░░░░███ 100% > > ELN subset: > > 60 out of 2345 packages are not converted yet (progress 97.44%) > Today we have: * 24312spec files in Fedora * 30925license tags in all spec files * 5740 tags have not been converted to SPDX yet * 208 tags can be trivially converted using `license-fedora2spdx` * Progress: 81,31% ░░░░░░░░██ 100% ELN subset: 57 out of 2337 packages are not converted yet (progress 97.56%) Graph of these data with the burndown chart: https://docs.google.com/spreadsheets/d/1QVMEzXWML-6_Mrlln02axFAaRKCQ8zE807r… The list of packages needed to be converted is here: https://pagure.io/copr/license-validate/blob/main/f/packages-without-spdx-f… List by package maintainers is here https://pagure.io/copr/license-validate/blob/main/f/packages-without-spdx-f… New version of fedora-license-data has been released. With: 1 new licenses, 1 correction and several public domain dedications 8 licenses are waiting to be reviewed by SPDX.org (and then to be added to fedora-license-data) https://gitlab.com/fedora/legal/fedora-license-data/-/issues/?label_name%5B… Legal docs and especially https://docs.fedoraproject.org/en-US/legal/allowed-licenses/ was updated too. New projection when we will be finished is 2025-02-02 (-31 days from last report). Pure linear approximation. If your package does not have neither git-log entry nor spec-changelog entry mentioning SPDX and you know your license tag matches SPDX formula, you can put your package on ignore list https://pagure.io/copr/license-validate/blob/main/f/ignore-packages.txt Either pull-request or direct email to me is fine. Why Gold Rush Edition? Because on today's date in 1896 prospectors discovered gold in Klondike river. This discovery started Gold Rush. It is estimated that around 100 000 people tried to reach Klondike. We can learn from the rush and stampede even nowadays. https://en.wikipedia.org/wiki/Klondike_Gold_Rush#Discovery_(1896) Miroslav

1 0

Should I mention Build-scripts' licensing terms in a spec's License field?
by Peter Lemenkov 05 Aug '24

05 Aug '24

Hello! I stumbled upon the following situation. I am packaging a library under MIT license. However the upstream-provided build-script in a tarball explicitly licensed under ISC license (has a header with ISC license). If it matters I do not use this script for building at all. So I have two questions. 1. If a tarball has a differently licensed file which is not going to a final RPM should I still list its license in a spec's %license field? 2. Does it change anything if this file wasn't used at all during RPM build process? -- With best regards, Peter Lemenkov.

8 21

Dealing with snippets credited to StackOverflow?
by Ben Beasley 01 Aug '24

01 Aug '24

Although I haven’t signed up to do the official review, I was looking at python-meshio[1], and I found that it contains a function substantially derived from a StackOverflow answer[2]. While I’m impressed that upstream cared enough to give credit, this leaves me with a question. Normally I would suggest that, to be strictly correct, the license of the copied-and-modified snippet should be added to the package’s License expression. But all answers on StackOverflow are, depending on when they are posted[3], licensed CC-BY-SA-2.5, CC-BY-SA-3.0, or CC-BY-SA-4.0. In this case, the applicable license is CC-BY-SA-3.0[4]. All of these licenses are listed as allowed in Fedora for content, but not for code. Strictly speaking, then, this appears to be code under a not-allowed-for-code license. At the same time, it is hard to believe that prohibiting packages containing snippets from StackOverflow would be an intended outcome. Since code copied or heavily inspired by StackOverflow answers is extremely widespread, and the only thing that is perhaps unusual here is that proper attribution is present, I’m curious how cases like this *ought* to be handled. – Ben Beasley (FAS: music) [1] https://bugzilla.redhat.com/show_bug.cgi?id=2283539 [2] https://github.com/nschloe/meshio/blob/b2ee99842e119901349fdeee06b5bf61e01f… [3] https://stackoverflow.com/help/licensing [4] https://stackoverflow.com/posts/8964779/timeline

3 2

Fwd: SPDX Statistics - Niki Lauda Edition
by Miroslav Suchý 01 Aug '24

01 Aug '24

-------- Přeposlaná zpráva -------- Předmět: SPDX Statistics - Niki Lauda Edition Datum: Thu, 1 Aug 2024 09:06:59 +0200 Od: Miroslav Suchý <msuchy(a)redhat.com> Společnost: Red Hat Czech, s.r.o. Komu: Development discussions related to Fedora <devel(a)lists.fedoraproject.org> Hot news: * Big batch of GPL families was mass converted. * Sent email about packages with problems (licenses neither in SPDX nor in Callaway format). * Still on todo list: convert Perl licenses (already announced) and Public Domain, UltraPermissive, and Firmware. Two weeks ago we had: > * 24223spec files in Fedora > > * 30899license tags in all spec files > > * 10114 tags have not been converted to SPDX yet > > * 4325 tags can be trivially converted using `license-fedora2spdx` > > * Progress: 67,27% ░░░░░░████ 100% > > ELN subset: > > 80 out of 2354 packages are not converted yet (progress 96.59%) > Today we have: * 24248spec files in Fedora * 30924license tags in all spec files * 7016 tags have not been converted to SPDX yet * 1383 tags can be trivially converted using `license-fedora2spdx` * Progress: 77,31% ░░░░░░░███ 100% ELN subset: 60 out of 2345 packages are not converted yet (progress 97.44%) Graph of these data with the burndown chart: https://docs.google.com/spreadsheets/d/1QVMEzXWML-6_Mrlln02axFAaRKCQ8zE807r… The list of packages needed to be converted is here: https://pagure.io/copr/license-validate/blob/main/f/packages-without-spdx-f… List by package maintainers is here https://pagure.io/copr/license-validate/blob/main/f/packages-without-spdx-f… New version of fedora-license-data has been released. With: 4 new licenses. 7 licenses are waiting to be reviewed by SPDX.org (and then to be added to fedora-license-data) https://gitlab.com/fedora/legal/fedora-license-data/-/issues/?label_name%5B… Legal docs and especially https://docs.fedoraproject.org/en-US/legal/allowed-licenses/ was updated too. New projection when we will be finished is 2025-03-05 (-133 days from last report). Pure linear approximation. If your package does not have neither git-log entry nor spec-changelog entry mentioning SPDX and you know your license tag matches SPDX formula, you can put your package on ignore list https://pagure.io/copr/license-validate/blob/main/f/ignore-packages.txt Either pull-request or direct email to me is fine. Why Niki Lauda edition? Because on today's date at 1976 Niki Lauda crashed on the Nurburgring. Two other cars crashed into Niki's car after he crashed guardrail. The fuel tank of his red Ferrari ruptured and his formula was engulfed in a fiery inferno. The Nurburing is a long track, at this point the organisers were missing. So Niki was pulled out by his rivals. Arturo Merzario, a former Ferrari driver who knew how Lauda's seatbelt worked, was the biggest contributor to Niki's rescue. He threw himself into the flames with complete disregard for his own life. Niki fought for his life in hospital for a week. His face was - as Germany's Bild wrote - "My God, where is his face? The world's fastest racing driver, Niki Lauda, no longer has a face. It's nothing but burnt flesh with eyes coming out of it." The priest gave Lauda the last rites and everyone thought he was going to die. So it was unbelievable that just 39 days after the accident, he jumped back into the formula at Monza. He finished the best of the Ferraris - fifth. He arrived at the finish with a hood of blood as his wounds opened and swelled. He went into the last race of the season in Japan with three points to his credit. But it was raining in Suzuka and Niki couldn't wipe the drops from his eyes by blinking as his burnt eyelids were still missing. He fell backwards in the race, not wanting to gamble. "Some things are more important than the championship," he said at the time. https://www.youtube.com/watch?v=f-zk48lN0D0 https://en.wikipedia.org/wiki/Niki_Lauda#1976_N%C3%BCrburgring_crash Miroslav

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

legal August 2024