legal September 2007

legal@lists.fedoraproject.org

16 participants
14 discussions

Legal Problem: md5 implementation
by Tom Callaway 03 Jan '08

03 Jan '08

Some of Fedora's packages are using an MD5 implementation which is under a GPLv2/v3 incompatible license, specifically, the RSA implementation which is under BSD with advertising. You can look at this code here: http://www.tux.org/pub/security/md5/md5.c http://www.tux.org/pub/security/md5/md5.h We've identified packages which are possibly using this implementation, and all maintainers are on CC. Please take a moment to look at your packages and check to see if this md5 implementation is used. GeoIP abiword cinepaint cook dietlibc dclib fedora-ds-base gammu gnome-pilot-conduits gnumeric htdig inn isdn4k-utils libosip libosip2 mail-notification mysql ser ssmtp wv xdelta If your package is on this list, please email me back and let me know once you've checked the md5 implementation. If it is the RSA implementation, we're going to need to replace it (coreutils has a GPL compatible implementation that should be a drop in). If your package is not under GPL or LGPL, then there is no problem, and you can just email me and let me know that. Thanks in advance, ~spot

6 22

CPAL license acceptable?
by Rahul Sundaram 30 Sep '07

30 Sep '07

Hi http://socialtext.com/cpal There been a number of projects moving to this license especially ones that prefer stronger attribution. While GPL and others which are considered Free software licenses have attribution requirements too, this goes a bit beyond that. Do we want to send this to FSF to confirm? Rahul

2 2

Status report
by Tom Callaway 28 Sep '07

28 Sep '07

Todd, Can you run another status report on the Licensing? Also, please run another report showing just those packages (and owners) who are License: Artistic (not GPL* or Artistic), just Artistic. Thanks, ~spot

2 3

License correction
by Tom Callaway 27 Sep '07

27 Sep '07

Adrian, Several of your perl packages have an incorrect license tag: perl-Jcode perl-Unicode-Map perl-Unicode-Map8 perl-Unicode-MapUTF8 perl-Unicode-String The correct license tag should be: License: GPL+ or Artistic (The Fedora perl package is special, because the upstream perl tarball includes several addon components under GPLv2+ or Artistic, but you do not need to reflect that in your packages.) Thanks, ~spot

2 1

cpan2rpm license
by Todd Zullinger 27 Sep '07

27 Sep '07

Hi Gavin, Looking over package license tags (for fun and profit), I noticed that cpan2rpm has been listed as "License: Artistic" for quite a while. I don't think this is correct now and I'm not sure if it ever was. Looking at: http://search.cpan.org/dist/cpan2rpm/cpan2rpm#LICENCE_AND_COPYRIGHT http://search.cpan.org/src/ECALDER/cpan2rpm-2.028/LICENSE http://search.cpan.org/src/ECALDER/cpan2rpm-2.028/cpan2rpm it seems the license is GPLv2+. If you concur, can you update the license tag? (There's no need to push an update for stable releases just for this fix, but it'd be nice to get it into cvs.) Thanks! -- Todd OpenPGP -> KeyID: 0xBEAF0CE3 | URL: www.pobox.com/~tmz/pgp ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Don't look for me in daylight where robots all assemble. You'll find me in my dark world, in my smoke-filled temple.

1 0

m2crypto license
by Miloslav Trmač 23 Sep '07

23 Sep '07

Hello, m2crypto uses the following variant of the MIT license: > Permission to use, copy, modify, and distribute this software and its > documentation for any purpose and without fee is hereby granted, > provided that the above copyright notice appear in all copies and that > both that copyright notice and this permission notice appear in > supporting documentation. > > THE AUTHOR PROVIDES THIS SOFTWARE ``AS IS'' AND ANY EXPRESSED OR > IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES > OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. > IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, > INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT > NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, > DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY > THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT > (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE > OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. The first paragraph is "Old style with legal disclaimer", without the MIT advertising clause. The warranty disclaimer is different from the licenses at http://fedoraproject.org/wiki/Licensing/MIT . Is this license OK for Fedora? Thank you, Mirek

2 1

baekmuk fonts license
by Jens-Ulrik Petersen 21 Sep '07

21 Sep '07

Hi, Below is the license file of the Korean Baekmuk fonts (currently part of fonts-korean). Naively it looks BSD'ish to me but could please take a look? Thank you, Jens Copyright (c) 1986-2002 Kim Jeong-Hwan All rights reserved. Permission to use, copy, modify and distribute this font is hereby granted, provided that both the copyright notice and this permission notice appear in all copies of the font, derivative works or modified versions, and that the following acknowledgement appear in supporting documentation: Baekmuk Batang, Baekmuk Dotum, Baekmuk Gulim, and Baekmuk Headline are registered trademarks owned by Kim Jeong-Hwan.

2 1

liberation-fonts
by Jens-Ulrik Petersen 11 Sep '07

11 Sep '07

What should the license field of this package be? I guess the base license is "GPLv2 with exception" (font embedding exception)? Do we need any additional annotation for License.txt? Thanks, Jens

2 1

Re: dcraw.c licensing ambiguity
by Nils Philippsen 09 Sep '07

09 Sep '07

Hi Dave, thanks for your quick reply. I'll keep fedora-legal-list on copy, perhaps they want to comment. On Wed, 2007-09-05 at 20:39 -0400, dcoffin(a)cybercom.net wrote: > Hi Nils, > > I changed the text because some customers are paranoid > about the letters "GPL". It seems that Debian is bothered by: > > > (a) include full source code* > > Now I don't need to exactly match the GPL, but I must > require something that commercial software companies would > never accept, without creating problems for distributors of > free software. > > How about changing "include" to "offer, at no extra > charge,"? I'm not a lawyer ;-), but the source code provisions in the GPL are a bit complicated -- to stay compatible, one would have to formulate something compatible to 32 lines of legalese in the GPL license ;-). I don't know about your customers, but I think an easy way to stay compatible to the GPL would be dual-licensing, e.g. extend the text to something like: "... *If you have not modified dcraw.c in any way, a link to my homepage qualifies as "full source code". ALTERNATIVELY, at your option, you may distribute the code under the conditions of the GNU [Lesser] General Public License Version 2[.1] [(or, at your option, any later version)] [continue with standard GPL blurb]" Of course, the version of the [L]GPL and whether you allow later versions is up to you (it's your code). Would your customers be scared away by that? Thanks, Nils > Dave Coffin 9/5/2007 > > On Wed, Sep 05, 2007 at 05:08:33PM +0200, Nils Philippsen wrote: > > Hi Dave, > > > > I'm the Fedora/Red Hat Enterprise Linux package maintainer for dcraw and > > when going over the licenses of some of my packages I found that the > > licensing blurb of dcraw.c has changed like this ("-": old, "+": new > > version): > > > > --- 8< --- > > - Attention! Some parts of this program are restricted under the > > - terms of the GNU General Public License. Such code is enclosed > > - in "BEGIN GPL BLOCK" and "END GPL BLOCK" declarations. > > - Any code not declared GPL is free for all uses. > > + No license is required to download and use dcraw.c. However, > > + to lawfully redistribute this code, you must either (a) include > > + full source code* for all executable files containing RESTRICTED > > + functions, (b) remove all RESTRICTED functions, re-implement them, > > + or copy them from an earlier, unrestricted Revision of dcraw.c, > > + or (c) purchase a license from the author. > > > > - Starting in Revision 1.237, the code to support Foveon cameras > > - is under GPL. > > + The functions that process Foveon images have been RESTRICTED > > + since Revision 1.237. All other code remains free for all uses. > > > > - To lawfully redistribute dcraw.c, you must either (a) include > > - full source code for all executable files containing restricted > > - functions, (b) remove these functions, re-implement them, or > > - copy them from an earlier, non-GPL Revision of dcraw.c, or (c) > > - purchase a license from the author. > > + *If you have not modified dcraw.c in any way, a link to my > > + homepage qualifies as "full source code". > > --- >8 --- > > > > With the upcoming Fedora version 8, we want all packages' licensing > > terms be listed in the package (e.g. "GPLv2+" for GNU GPL Version 2 or > > later"). Now I'm a bit unsure about what to do about the terms of > > dcraw.c and whether they are still GPL compatible(*) and so forth. > > > > (*): IIRC, GPL allows distribution of a binary without source code but a > > written offer to ship it on request. The source code provisions in the > > dcraw terms might be "additional restrictions" that aren't GPL > > compatible. > > > > Would you please shed some light on this? I'd very much appreciate it. > > > > Thanks in advance, > > Nils > > -- > > Nils Philippsen / Red Hat / nphilipp(a)redhat.com > > "Those who would give up Essential Liberty to purchase a little Temporary > > Safety, deserve neither Liberty nor Safety." -- B. Franklin, 1759 > > PGP fingerprint: C4A8 9474 5C4C ADE3 2B8F 656D 47D8 9B65 6951 3011 -- Nils Philippsen / Red Hat / nphilipp(a)redhat.com "Those who would give up Essential Liberty to purchase a little Temporary Safety, deserve neither Liberty nor Safety." -- B. Franklin, 1759 PGP fingerprint: C4A8 9474 5C4C ADE3 2B8F 656D 47D8 9B65 6951 3011

3 3

License short name: LGPLv2 or LGPLv2.1?
by Michel Salim 08 Sep '07

08 Sep '07

There is no release of LGPLv2, so the short names for LGPL listed on the Licensing page are a bit unclear. Would it be better to use LGPLv2.1, LGPLv2.1+ etc. as opposed to LGPLv2 et. al.? It seems odd to refer to a non-existent license. Thanks, -- Michel Salim

2 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

legal September 2007