legal January 2026

legal@lists.fedoraproject.org

7 participants
4 discussions

antlr3 and a not-allowed license
by Jerry James 20 Feb '26

20 Feb '26

I've been using scancode to take an in-depth look at packages I maintain. I'm up to packages that start with "a"! While looking at the antlr3 package, I found that it contains 3 files with the LicenseRef-Unicode-legacy-source-code license, which is not allowed for Fedora [1]. The files are part of the C/C++ backend. They have been built into binary RPMs for Fedora since 2010 [2] (Fedora 12?). Repoquery shows that nothing in Fedora uses the C/C++ backend. I will build updates for F42, F43, and Rawhide that disable it. My question is whether I need to do anything more than that. Do I need to scrub the offending files out of the tarball, for example? References: [1] https://gitlab.com/fedora/legal/fedora-license-data/-/blob/main/data/Licens… [2] https://src.fedoraproject.org/rpms/antlr3/c/6398229d293262736484dc0e3d7a87b… -- Jerry James http://www.jamezone.org/

5 8

Dolby Digital Plus (E-AC3) patents have now expired. Time to add it to fedora
by spaceshipgalore＠outlook.com 31 Jan '26

31 Jan '26

The last Dolby Digital Plus (E-AC3) patent US7516064 expired today. Please add it to fedora. more info: https://hydrogenaudio.org/index.php?topic=122053.0

2 1

Re: Question about two Fedora packages that are CC0
by Neal Gompa 16 Jan '26

16 Jan '26

On Fri, Jan 16, 2026 at 7:19 AM Rodolfo Olivieri <rolivier(a)redhat.com> wrote: > Hi, folks! > > Looking at the dependency tree of Goose, I saw that they were pulling a > package that was not needed for their application, thus, pulling > *tiny-keccak* as part of it. I just disabled the default-features for > that single dependency and now *tiny-keccak *is not present anymore 🎉 > > Still, regarding *constant_time_eq*, if my understanding is correct, > since it's multi-licensed we are fine in this case? > Yes, just make sure to omit CC0-1.0 as a choice for code. If non-code stuff is CC0, then the license is still valid and must be identified. I do recommend that you package the dependencies individually though, otherwise it's going to be messy when it comes to auditing, fixing, and upgrading dependencies. -- 真実はいつも一つ！/ Always, there's only one truth!

1 0

Question about two Fedora packages that are CC0
by Máirín Duffy 15 Jan '26

15 Jan '26

Hi Fedora Legal! 👋 I have a question about two packages in Fedora that are dependencies for goose, which our (Rodolfo and I's) team are working on packaging for Fedora. They are: - *constant_time_eq* - https://packages.fedoraproject.org/pkgs/rust-constant_time_eq/ - *tiny-keccak - * https://packages.fedoraproject.org/pkgs/rust-tiny-keccak *constant_time_eq*'s upstream states it may be used under CC0, Apache 2.0, or MIT at the user's option: https://github.com/cesarb/constant_time_eq (see README) *tiny-keccak *is CC0 only, though: https://github.com/debris/tiny-keccak Goose is built in Rust, and we're looking at packaging it as a bundle and vendoring dependencies like these. They already exist in Fedora, but not sure what the policy is on pre-existing libraries like these. Questions: - Assuming just because these are already packaged in Fedora, doesn't mean they're ok to vendor in another Fedora package. Correct? - Can we use one of the other licenses for *constant_time_eq* which are acceptable for Fedora packages? Or are there any concerns there? - Do you have any advice on how to handle *tiny-keccak*'s license? Greatly appreciate your help in advance!! Thanks, ~m

3 4

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

legal January 2026