legal

legal@lists.fedoraproject.org

4 participants
1439 discussions

Fedora's ban on CC0 license is irrational and unfounded
by a bakh 05 Oct '26

05 Oct '26

The concern seems to be with a clause that states "No trademark or patent rights held by Affirmer are waived, abandoned, surrendered, licensed or otherwise affected by this document." One shouldn't be scared away by the word "patent". This clause clarifies for CC0 affirmers that their other IP is not affected by this license and the effect of this license is limited to the reproduction, change and use of the published work. It doesn't open the way for any patent litigation disrupting Free use of the software and precludes any such action because it is explicitly stating that: Affirmer hereby overtly, fully, permanently, irrevocably and unconditionally waives, abandons, and surrenders all of Affirmer's Copyright and Related Rights and associated claims and causes of action, whether now known or unknown (including existing as well as future claims and causes of action), in the Work (i) in all territories worldwide, (ii) for the maximum duration provided by applicable law or treaty (including future time extensions), (iii) in any current or future medium and for any number of copies, and (iv) for any purpose whatsoever, including without limitation commercial, advertising or promotional purposes (the "Waiver"). Affirmer makes the Waiver for the benefit of each member of the public at large and to the detriment of Affirmer's heirs and successors, fully intending that such Waiver shall not be subject to revocation, rescission, cancellation, termination, or >>>>>>>> any other legal or equitable action to disrupt the quiet enjoyment of the Work by the public as contemplated by Affirmer's express Statement of Purpose. The said "Statement of Purpose" says that: ...the public can reliably and without fear of later claims of infringement build upon, modify, incorporate in other works, reuse and redistribute as freely as possible in any form whatsoever and for any purposes, including without limitation commercial purposes. These owners may contribute to the Commons to promote the ideal of a free culture and the further production of creative, cultural and scientific works, or to gain reputation or greater distribution for their Work in part through the use and efforts of others. For these and/or other purposes and motivations, and without any expectation of additional consideration or compensation, the person associating CC0 with a Work (the "Affirmer"), to the extent that he or she is an owner of Copyright and Related Rights in the Work, voluntarily elects to apply CC0 to the Work and publicly distribute the Work under its terms, with knowledge of his or her Copyright and Related Rights in the Work and the meaning and intended legal effect of CC0 on those rights. CC0 is much more permissive than Fedora's permitted licenses. If you don't consider CC0 free, you should be banning all BSD, MIT, OSC, Zlib-licensed code first, to say the least. Those don't revoke and license patents and don't offer such assurances against legal action either.

2 1

Licensing questions regarding the Slint UI Framework
by Fabio Valentini 05 Oct '26

05 Oct '26

Hi all, I'm looking at packaging (part of) the Slint UI Framework: https://github.com/slint-ui/slint But I'm slightly confused by what the project says about its license: https://github.com/slint-ui/slint/blob/master/LICENSE.md The SPDX identifier they use is "GPL-3.0-only OR LicenseRef-Slint-Royalty-free-2.0 OR LicenseRef-Slint-Software-3.0" - so I *think* using it under just "GPL-3.0-only" should be OK even if the other two options aren't OK for Fedora? Something I don't understand at all though is what's written under "Contributions": https://github.com/slint-ui/slint/blob/master/LICENSE.md#contributions "Contributions to this repository are licensed under the MIT No Attribution license (MIT-0). This does not assign copyright or transfer ownership; contributors keep full rights to their own code. See CONTRIBUTING.md for details." How is this compatible with saying that the project is made available under "GPL-3.0-only OR ... "? Is this just "taking in" contributions under MIT-0 since that's compatible with all three of their "giving out" license options? Fabio

2 1

Fwd: Re: Copr hosting question: package that downloads NVIDIA CUDA toolkit
by Gary Buhrmaster 15 Sep '26

15 Sep '26

Forwarding to all ... ---------- Forwarded message --------- From: Gary Buhrmaster <gary.buhrmaster(a)gmail.com> Date: Wed, Sep 16, 2026 at 12:56 AM Subject: Re: [Fedora-legal-list] Re: Copr hosting question: package that downloads NVIDIA CUDA toolkit To: Cristian Le <fedora(a)lecris.me> On Tue, Sep 15, 2026 at 3:08 PM Cristian Le via legal <legal(a)lists.fedoraproject.org> wrote: > Indeed, proprietary software is still accessed during the build sure, but aren't the end artifacts fine to distribute as-is with the license that the authors specified? Nvidia folks at the cuda-python project seem to conclude that these same binaries distributed in PyPI are licensed under Apache-2.0, as it does not bundle the actual cuda library. Presumable not if the proprietary software is included (directly, or indirectly, via cuda headers). Perhaps if you can get nvidia to release the cuda headers under GPL (or Apache, or MIT, or any other approved license) things will get easier, but the requirement that Fedora software be installable without non-Fedora repos still make it problematic for Fedora proper in my opinion. This (as with other proprietary based software), should probably be packaged in RPMFusion (or equivalent).

1 0

Copr hosting question: package that downloads NVIDIA CUDA toolkit
by Pavel Raiskup 15 Sep '26

15 Sep '26

Dear legal team, we received a report regarding the Copr project lecris/cuda-example (https://copr.fedorainfracloud.org/coprs/lecris/cuda-example/) The reporter states that the package downloads and includes the NVIDIA CUDA toolkit during the build process). The CUDA toolkit is not free/open-source software. The maintainer, Cristian, is in CC (please correct this statement if it's not truth). Per the Copr usage policy (https://docs.pagure.org/copr.copr/user_documentation.html#what-i-can-build-…) material built in Copr must be governed by a license contained in the list of acceptable licenses for Fedora (https://docs.fedoraproject.org/en-US/legal/allowed-licenses/) We would like your guidance on whether packages that download and bundle proprietary NVIDIA CUDA components fall within or outside this policy. Specifically: - Is hosting such packages in Copr acceptable under the current legal guidelines? - If not, would there be conditions under which it could become acceptable? The maintainer of the project has also expressed willingness to reach out to NVIDIA directly to clarify redistribution terms, should that be helpful for your assessment. Thank you for your time. Best regards, Pavel Raiskup Copr Team

6 14

SPDX license list inclusion potential updates (for firmware)
by Jilayne Lovejoy 04 Sep '26

04 Sep '26

Hi all, I wanted to draw your attention to something going on over at SPDX that you may all have input/opinions on: There is a proposed update to the SPDX license inclusion guidelines that would enable linux-firmare licenses to possibly have an SPDX license id. See all the details and links here: https://lists.spdx.org/g/Spdx-legal/message/3778 Notably - if you want to weigh in, please join and comment on the spdx-legal mailing list and/or attend the Sept 10th SPDX-legal call at noon US eastern time. Also, if you have an SPDX license list submission, please make sure to clarify if it is from/a license included in Fedora, as that helps us prioritize those requests. Thanks! Jilayne

1 0

JS port of CPython's argparse — PSF-2.0 instead of Python-2.0.1?
by Vitaly 18 Aug '26

18 Aug '26

Hi, https://github.com/nodeca/argparse is a JavaScript port of CPython's Lib/argparse.py. It carries CPython's full license stack, which a Fedora packager ran into: https://github.com/nodeca/argparse/pull/188 argparse was added to CPython in 2010 under the PSF Contributor Agreement, so none of the ported code comes from the CWI, CNRI or BeOpen eras. Can the port be licensed as PSF-2.0 alone, or does CPython-derived code have to carry the whole stack? Thanks, Vitaly Puzrin

2 1

foo2zjs printer driver: download of HP printer firmware
by ValdikSS 29 Jul '26

29 Jul '26

Hi list, foo2zjs open-source printer driver provides support for many old (2004-2012 era) printers, including selected HP LaserJet models. These printers require the firmware which needs to be uploaded to the printer on every power on. Firmware files are not bundled in foo2zjs. The upstream includes the script called `getweb` which downloads the firmware files from third-party websites and unpacks them. `getweb` is not packaged in Fedora's foo2zjs, which makes HP LaserJets unable to print. Other source of the firmware files are proprietary hp-plugin packages which are downloaded by `hplip` package. I've changed the script (`getweb-hpplugin`) to download hp-plugin bundles and use files from there. hp-plugin downloads is packaged in Fedora's hplip package. The questions are: - Can Fedora include `getweb`, which downloads the firmware files from elsewhere? - If not, can Fedora include `getweb-hpplugin`, which downloads HP plugin files from official openprinting website and extracts firmware from these, as does HP's hplip? - If none could be done, what else could and should be done? Here's the license.txt found inside hp-plugin: https://gist.githubusercontent.com/ValdikSS/ba01bda36f73e85858fd9899773f18c… Package: https://packages.fedoraproject.org/pkgs/foo2zjs/foo2zjs/ Discussion with xvitaly about this issue: https://src.fedoraproject.org/rpms/foo2zjs/pull-request/2#comment-327537

3 6

28 Jul '26

I just got hit by another project that is over-eager to add the "All rights reserved" snippet on a FOSS license. I have opened an issue with upstream [1], but I guess we do not actually have a documented guidance or reference to point upstream to? The big thing that spurred me into opening the issues is that that snippet is included in the BSD-3-Clause license text itself, which seems very at odds with the text of the license. What is even more concerning is that when I put it into an spdx license check [2] it says it is a "perfect match" for BSD-3-Clause [1]: https://github.com/hfp/libxs/issues/24 [2]: https://tools.spdx.org/app/check_license/

4 4

License text files in packages
by Mattia Verga 26 Jul '26

26 Jul '26

This is perhaps a silly question... am I right when I say that license text files distributed in packages should reflect just the code used in the final binary (like the License: tag)? My question comes from a ticket [1] I raised against Rawtherapee upstream. As I recently noticed, in the upcoming next version Rawtherapee started to install license files for several things: code used in the project, code optionally used in the final output (such as bundled libraries that we don't use in Fedora as we use system's libraries), but also external libraries which Rawtherapee links to and doesn't bundle at all (I see, for example, gtkmm license text file). If upstream doesn't fix that before the final 5.13 release, I plan to manually remove license that doesn't pertain to Fedora distributed binaries. Is that right? Thanks, Mattia [1] https://github.com/RawTherapee/RawTherapee/issues/7718

2 3

SDL_mixer's bundled timidity
by Artur Frenszek-Iwicki 03 Jun '26

03 Jun '26

Hey all, I'm currently working on getting SDL3_mixer into Fedora. [0] While doing the packaging work, I noticed that SDL_mixer bundles timidity for MIDI playback. [1] The README file attached to the sources says: > If you'd like to continue hacking on TiMidity, feel free. I'm > hereby extending the TiMidity license agreement: you can now > select the most convenient license for your needs from (1) the > GNU GPL, (2) the GNU LGPL, or (3) the Perl Artistic License. This statement is unfortunately a bit ambiguous, since it does not mention which versions of the licences the author had in mind, and the only license text attached is the Perl/Artistic one. Digging through git history, one can see that the bundled code dates all the way back to the initial git commit, hence at least to 1999, i.e. before GPLv3 and LGPLv3 were published (2007). One can also find commits directly mentioning GPLv2 or later. [2] Getting to the point - can we assume (L)GPLv2 here? This would make the applicable license tag be: "GPL-2.0-or-later OR LGPL-2.0-or-later OR Artistic-1.0-Perl" Which, looking at the allowed license list, seems okay for inclusion in Fedora. For extra context, the older SDL_mixer packages (SDL_mixer, SDL2_mixer) do not make note of timidity's license in any way. While SDL2_mixer has "Provides: bundled(timidity)", SDL_mixer doesn't even do that. Thanks in advance, Artur FI [0] https://bugzilla.redhat.com/show_bug.cgi?id=2454358 [1] https://github.com/libsdl-org/SDL_mixer/tree/release-3.2.4/src/timidity [2] https://github.com/libsdl-org/SDL_mixer/commit/db1013fd0aeb884fcae21480a75d…

3 2

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

legal