legal

legal@lists.fedoraproject.org

9 participants
1364 discussions

Re: [SPDX] Mass license change GPLv2 to GPL-2.0-only
by Miro Hrončok 26 Jun '24

26 Jun '24

On 18. 06. 24 18:46, Miroslav Suchý wrote: > Hi. > > I am going to do the mass change of the license from GPLv2 to GPL-2.0-only Hi. How do you know the License tag is not supposed to be e.g. "GPL-2.0-only AND MIT" or similar? Converting "GPLv2" (which could mean any number of "weaker" licenses are hidden under the "stronger" GPL in the old notation) to "GPL-2.0-only" (which means all the code is exactly GPL 2.0 only) cannot be done automatically. Same for the other thread about LGPLv3 to LGPL-3.0-only conversion. -- Miro Hrončok -- Phone: +420777974800 Fedora Matrix: mhroncok

9 30

EXIV2 BMFF Patents situation : we need an official answer
by Robert-André Mauchin 26 May '24

26 May '24

Hello, Follow-up from : https://gitlab.com/fedora/legal/fedora-license-data/-/issues/406 In order to update Exiv2, we need to know if this is okay to enable BMFF support. Patents have theoretically expired and it is enabled by default in the latest version. https://bugzilla.redhat.com/show_bug.cgi?id=1979565 https://github.com/Exiv2/exiv2/issues/1679 Upstream seems to think it is okay because it is over 20 years old. Also other packages in Fedora are already using it, av1, jpeg-xl, any mp4 decoding... By Jon Sneyers, one of the author of JPEG-XL: I think this caution is erring on the side of paranoia, and possibly based on a misunderstanding. ISOBMFF is pretty old, old enough for it to be impossible to still have applicable patents (patents expire after 20 years). It is a simple box-based container format that is used by many formats, including MP4, JPEG 2000, and JPEG XL. One particular use of ISOBMFF is HEIF, which is more recent, and for which there actually are known patent claims by Nokia. HEIF does use the generic ISOBMFF box structure and extends it by defining mechanisms to do cropping, layering, grids, rotation etc, which are described in the HEIF spec. HEIF can be used with various payloads: when used with HEVC it is called HEIC, when used with AV1 it is called AVIF. While most people would consider patents on a container format ridiculous, it is a fact that, at least in theory, if you use HEIF, you might risk patent litigation. Note that it would not be the application implementor who could be sued, but the end-user who uses the implementation and thereby possibly needs a patent license from Nokia. This is only true specifically for HEIF though, not for ISOBMFF in general. Parsing the MP4 or JPEG 2000 container (which do not use HEIF) carries absolutely no risk in terms of patents, since they only use ISOBMFF, not HEIF. The same is true for JPEG XL, which has explicitly avoided using the HEIF container exactly for this reason. TL;DR: ISOBMFF is OK, HEIF might be risky. So just to be clear: reading BMFF is not an issue, it is over 20 years old so even if it was an issue in the past (it wasn't) it now certainly isn't anymore. Reading HEIF-specific boxes is something else, but as long as Exiv2 is not doing that, there obviously is no issue either. Note that other FOSS tools like libheif and libavif actually do read those boxes, and they do seem to get away with it (but I can understand why you wouldn't want to do that; those boxes are from 2015 and Nokia does claim patents on them so it will only really be 'safe' to use that functionality in 2035). So while I appreciate the caution, I think it's OK to just enable the BMFF code by default (perhaps have an option to disable it, if someone is still for some reason worried, but imo that would be an unfounded worry). Otherwise most of the modern image codecs (jp2, jxl, avif and heic) end up being unsupported by default, for no good reason, which seems a sub-optimal situation. Thank you for your time. Best regards, Robert-André Mauchin, FAS: eclipseo

2 1

bmff and exiv2 update - can we have a clear reply?
by Mattia Verga 25 May '24

25 May '24

I'm sorry to post the question again, but we never received a clear reply from RH Legal team (in 3 years...) Are we finally allowed to enable support in exiv2 for file formats using the BMFF format? https://lists.fedoraproject.org/archives/list/legal@lists.fedoraproject.org… https://lists.fedoraproject.org/archives/list/legal@lists.fedoraproject.org… https://bugzilla.redhat.com/show_bug.cgi?id=1979565 It would be nice to have an official GO/NO-GO before the F41 change deadline. Also consider that if BMFF support is not allowed in Fedora, according to @eclipseo we have several other packages using it that must be retired/stripped of: https://gitlab.com/fedora/legal/fedora-license-data/-/issues/406 Thanks Mattia

1 0

Brainpool Curves in Fedora (openssl, libgcrypt, gnupg)
by Timothée Ravier 21 May '24

21 May '24

Hi everyone, The ECC Brainpool Curves [1][2] are currently not available in Fedora as according to this BZ [3], this needs Fedora Legal approval. Could someone from the legal team take a look to see if there are any blockers regarding Brainpool Curves inclusion in Fedora? Thanks! [1] https://en.wikipedia.org/wiki/Elliptic-curve_cryptography#Implementation [2] https://tools.ietf.org/html/rfc5639 [3] https://bugzilla.redhat.com/show_bug.cgi?id=1413618

14 31

GlobalProtect-openconnect - License violation or not?
by Jakub Kadlcik 16 May '24

16 May '24

Hello Fedora Legal, a piece of software was recently discovered in Fedora Copr and it is now causing a contention about whether it should be allowed to be there or not. I am kindly asking for your ruling. The project in question is here: https://copr.fedorainfracloud.org/coprs/yuezk/globalprotect-openconnect/ And its upstream: https://github.com/yuezk/GlobalProtect-openconnect Both the upstream project and the package that is built in Copr claim to be under the GPLv3 license. The package provides several executables: /usr/bin/gpauth /usr/bin/gpclient /usr/bin/gpgui-helper /usr/bin/gpservice All of these seem to be compiled from the mentioned upstream sources. So far, no problem. However, when executing some of them (with the exception of gpclient) the following tarball is being downloaded to the user machine: INFO gpgui_helper::updater] Downloading file: https://github.com/yuezk/GlobalProtect-openconnect/releases/download/v2.1.4… It contains just a single binary called gpgui which is licensed under a proprietary license and developed in a private repository, according to the author: https://github.com/yuezk/GlobalProtect-openconnect/issues/296#issuecomment-… When running the program, it says it is a 10-day trial and prompts for buying a license here https://yuezk.lemonsqueezy.com/checkout I would like to ask you whether this is just a shady practice (but OK from a legal perspective) or whether this is a violation of either GPLv3 or Copr conditions https://docs.pagure.org/copr.copr/user_documentation.html#what-i-can-build-… Thank you very much for your help, Jakub

3 2

Unicode licensing of finl_unicode
by Cristian Le 08 May '24

08 May '24

Hi legal team, I am trying to package finl_unicode [1][2], but we are having some issues with the ambiguous Copyright notice stating that it is licensed under Unicode license with "All rights reserved". The project uses generated source code and it is a bit unclear what license these belong to and what part of the code carries the Unicode license. We are trying to ask for clarification if some of the code is actually "Unicode-DFS-2016" licensed, and we are waiting for their reply. So far we have made 2 PRs [3][4] that can side-step the obvious files that are under the Unicode license, but we need advice on whether those are sufficient or do we need to wait for more explicit confirmation form upstream? [1]: https://bugzilla.redhat.com/show_bug.cgi?id=2279514 [2]: https://github.com/dahosek/finl_unicode [3]: https://github.com/dahosek/finl_unicode/pull/17 [4]: https://github.com/dahosek/finl_unicode/pull/19

1 0

License for Sublime Text language definitions for syntax highlighting
by Fabio Valentini 02 May '24

02 May '24

Hi all, I noticed that there are some packages that bundle data from Sublime Text, notably data for how to apply syntax highlighting for various programming languages. The license that applies to this data is in this file: https://github.com/sublimehq/Packages/blob/759d6eed9b4beed87e602a23303a121c… (Yes, in one case that I'm looking at, the bundled data is a 5 years old snapshot. Apparently only the Sublime Text v3 format is supported by syntect.) The contents of this LICENSE file are very short, so I'll just include it verbatim for convenience: ``` If not otherwise specified (see below), files in this repository fall under the following license: Permission to copy, use, modify, sell and distribute this software is granted. This software is provided "as is" without express or implied warranty, and with no claim as to its suitability for any purpose. An exception is made for files in readable text which contain their own license information, or files where an accompanying file exists (in the same directory) with a “-license” suffix added to the base-name name of the original file, and an extension of txt, html, or similar. For example “tidy” is accompanied by “tidy-license.txt”. ``` I could not find any SPDX license that matches this text. It looks very permissive to me, so it should be acceptable for content, but I would need to know how to classify it - both for existing packages where this was missed during package review, as well for a new package for a library that I need to package in order to be able to update an existing package to the latest version. Fabio

1 0

Fwd: SPDX Statistics - L'Aigle meteorite edition
by Miroslav Suchý 26 Apr '24

26 Apr '24

-------- Přeposlaná zpráva -------- Předmět: SPDX Statistics - L'Aigle meteorite edition Datum: Fri, 26 Apr 2024 20:20:43 +0200 Od: Miroslav Suchý <msuchy(a)redhat.com> Společnost: Red Hat Czech, s.r.o. Komu: Development discussions related to Fedora <devel(a)lists.fedoraproject.org> Hot news: Automated migration of "trivial" conversions is in process. I migrated bunch of licenses that are only seldomly used. The bigger group (GPL*) are waiting at the starting line, but Jilayne asked me to wait a moment as she wants to check few things. I expect that the progress resumes after Red Hat summit (May 6-9). Two weeks ago we had: > * 23901spec files in Fedora > > * 30551license tags in all spec files > > * 10964 tags have not been converted to SPDX yet > > * 4964 tags can be trivially converted using `license-fedora2spdx` > > * Progress: 64,11% ░░░░░░████ 100% > > ELN subset: > > 100 out of 2397 packages are not converted yet (progress 95.83%) > Today we have: * 23943spec files in Fedora * 30600license tags in all spec files * 10639 tags have not been converted to SPDX yet * 4689 tags can be trivially converted using `license-fedora2spdx` * Progress: 65,23% ░░░░░░████ 100% ELN subset: 94 out of 2394 packages are not converted yet (progress 96.07%) Graph of these data with the burndown chart: https://docs.google.com/spreadsheets/d/1QVMEzXWML-6_Mrlln02axFAaRKCQ8zE807r… The list of packages needed to be converted is here: https://pagure.io/copr/license-validate/blob/main/f/packages-without-spdx-f… List by package maintainers is here https://pagure.io/copr/license-validate/blob/main/f/packages-without-spdx-f… List of packages from ELN subset that needs to be converted: https://pagure.io/copr/license-validate/blob/main/f/eln-not-migrated.txt New version of fedora-license-data has been released. With: 7 new licenses (plus two public domain declarations). 10 licenses are waiting to be review by SPDX.org (and then to be added to fedora-license-data) https://gitlab.com/fedora/legal/fedora-license-data/-/issues/?label_name%5B… Legal docs and especially https://docs.fedoraproject.org/en-US/legal/allowed-licenses/ was updated too. License analysis of remaining packages: http://miroslav.suchy.cz/fedora/spdx-reports/ New projection when we will be finished is 2025-04-06 (+5 days from last report). Pure linear approximation. If your package does not have neither git-log entry nor spec-changelog entry mentioning SPDX and you know your license tag matches SPDX formula, you can put your package on ignore list https://pagure.io/copr/license-validate/blob/main/f/ignore-packages.txt Either pull-request or direct email to me is fine. Why L'Aigle meteorite? On today's date at 1803 meteorite fell upon the town L'Aigle in France. More than 3000 fragments reached ground. Previously scientists believed that meteorites were terrestrial. But this event brought first evidence that meteorites are extraterrestrial. https://en.wikipedia.org/wiki/L%27Aigle_(meteorite)# Miroslav

1 0

Fwd: SPDX Statistics - Human Space Flight edition
by Miroslav Suchý 12 Apr '24

12 Apr '24

-------- Přeposlaná zpráva -------- Předmět: SPDX Statistics - Human Space Flight edition Datum: Fri, 12 Apr 2024 08:06:46 +0200 Od: Miroslav Suchý <msuchy(a)redhat.com> Společnost: Red Hat Czech, s.r.o. Komu: Development discussions related to Fedora <devel(a)lists.fedoraproject.org> Hot news: https://docs.fedoraproject.org/en-US/legal/allowed-licenses/ contains usage column for licenses that are allowed for something (documentation, firmware...) Automated migration of "trivial" conversions have started (see other threads in this mailing list). Two weeks ago we had: > * 23849spec files in Fedora > > * 30493license tags in all spec files > > * 11026 tags have not been converted to SPDX yet > > * 5004 tags can be trivially converted using `license-fedora2spdx` > > * Progress: 63,84% ░░░░░░████ 100% > > ELN subset: > > 100 out of 2395 packages are not converted yet (progress 95.82%) > Today we have: * 23901spec files in Fedora * 30551license tags in all spec files * 10964 tags have not been converted to SPDX yet * 4964 tags can be trivially converted using `license-fedora2spdx` * Progress: 64,11% ░░░░░░████ 100% ELN subset: 100 out of 2397 packages are not converted yet (progress 95.83%) Graph of these data with the burndown chart: https://docs.google.com/spreadsheets/d/1QVMEzXWML-6_Mrlln02axFAaRKCQ8zE807r… The list of packages needed to be converted is here: https://pagure.io/copr/license-validate/blob/main/f/packages-without-spdx-f… List by package maintainers is here https://pagure.io/copr/license-validate/blob/main/f/packages-without-spdx-f… List of packages from ELN subset that needs to be converted: https://pagure.io/copr/license-validate/blob/main/f/eln-not-migrated.txt New version of fedora-license-data has been released. With: 1 new license (plus two public domain declarations). 14 licenses are waiting to be review by SPDX.org (and then to be added to fedora-license-data) https://gitlab.com/fedora/legal/fedora-license-data/-/issues/?label_name%5B… Legal docs and especially https://docs.fedoraproject.org/en-US/legal/allowed-licenses/ was updated too. License analysis of remaining packages: http://miroslav.suchy.cz/fedora/spdx-reports/ New projection when we will be finished is 2025-04-01 (+20 days from last report). Pure linear approximation. If your package does not have neither git-log entry nor spec-changelog entry mentioning SPDX and you know your license tag matches SPDX formula, you can put your package on ignore list https://pagure.io/copr/license-validate/blob/main/f/ignore-packages.txt Either pull-request or direct email to me is fine. Why Human Space Flight edition? On today's date at 1961 Yuri Gagarin flew to the space in Vostok 1. Since 1963 this day is celebrated as International Day of Human Space Flight. Also on this day at 1981 the first Space Shuttle (Columbia) was lunched. https://en.wikipedia.org/wiki/International_Day_of_Human_Space_Flight https://en.wikipedia.org/wiki/Vostok_1 And you may also learn about Oleg Ivanovsky https://www.telegraph.co.uk/news/obituaries/11111713/Oleg-Ivanovsky-obituar… Miroslav

1 0

AI/ML Model and Pre-Trained Weight Packaging in Fedora
by Tim Flink 02 Apr '24

02 Apr '24

These questions came up in a FESCo ticket [1] recently and the primary purpose of this thread is to have some public record of the conversation around the handling of pre-trained weights for AI/ML models as packaged for Fedora. [1] https://pagure.io/fesco/issue/3175 Intro and Definitions ===================== Previous conversations have involved a decent amount of confusion around terminology and I want to be clear about what I'm asking so I'm starting with a few definitions in the context of my questions. Artificial Neural Network (ANN) - effectively structured data consisting of neurons (nodes containing some value) organized into layers with various connections between the neurons. There are connections between neurons which control the flow of data through the entire network. The exact value of how the connections affect flow through the network is found through the training process and these values are generally referred to as weights. Model - A model by itself is a description of a specific ANN - how layers are configured, how they interact with each other, how model training is done, how data needs to be structured for using a trained model and so on. A model by itself is rarely, if ever useful. Models generally need to be trained on data before they can be used but many models offer a mechanism through which weights can be loaded from a model which has already been trained. An untrained model without pre-trained weights or training is pretty much code. Pre-Trined Weights - Pre-trained weights are essentially the data contained in a model after training the model on some input data. Training modern ANN models is a very expensive and time consuming process; pre-trained weights allow people to use models without having to train the model locally or even have access to data needed to train the model. Questions ========= 1. Are pre-trained weights considered to be normal non-code content/data or do they require special handling? 2. If an upstream offers pre-trained weights and indicates that those weights are available under a license which is acceptable for non-code content in Fedora, can those pre-trained weights be included in Fedora packages? 3. Extending question 2, is it considered sufficient for an upstream to have a license on pre-trained weights or would a packager/reviewer need to verify that the data used to train those weights is acceptable? 4. Is it acceptable to package code which downloads pre-trained weights from a non-Fedora source upon first use post-installation by a user if that model and its associated weights are a. For a specific model? b. For a user-defined model which may or may not exist at the time of packaging? I can provide examples of any of these situations if that would be helpful. Thanks, Tim

7 18

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

legal