Some of Fedora's packages are using an MD5 implementation which is under
a GPLv2/v3 incompatible license, specifically, the RSA implementation
which is under BSD with advertising.
You can look at this code here:
We've identified packages which are possibly using this implementation,
and all maintainers are on CC. Please take a moment to look at your
packages and check to see if this md5 implementation is used.
If your package is on this list, please email me back and let me know
once you've checked the md5 implementation. If it is the RSA
implementation, we're going to need to replace it (coreutils has a GPL
compatible implementation that should be a drop in). If your package is
not under GPL or LGPL, then there is no problem, and you can just email
me and let me know that.
Thanks in advance,
There been a number of projects moving to this license especially ones
that prefer stronger attribution. While GPL and others which are
considered Free software licenses have attribution requirements too,
this goes a bit beyond that.
Do we want to send this to FSF to confirm?
Can you run another status report on the Licensing?
Also, please run another report showing just those packages (and owners)
who are License: Artistic (not GPL* or Artistic), just Artistic.
Several of your perl packages have an incorrect license tag:
The correct license tag should be:
License: GPL+ or Artistic
(The Fedora perl package is special, because the upstream perl tarball
includes several addon components under GPLv2+ or Artistic, but you do
not need to reflect that in your packages.)
m2crypto uses the following variant of the MIT license:
> Permission to use, copy, modify, and distribute this software and its
> documentation for any purpose and without fee is hereby granted,
> provided that the above copyright notice appear in all copies and that
> both that copyright notice and this permission notice appear in
> supporting documentation.
> THE AUTHOR PROVIDES THIS SOFTWARE ``AS IS'' AND ANY EXPRESSED OR
> IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
> OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
> IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
> INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
> NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
> DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
> THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
> (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
> OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
The first paragraph is "Old style with legal disclaimer", without the
MIT advertising clause. The warranty disclaimer is different from the
licenses at http://fedoraproject.org/wiki/Licensing/MIT .
Is this license OK for Fedora?
Below is the license file of the Korean Baekmuk fonts (currently part of
fonts-korean). Naively it looks BSD'ish to me but could please take a look?
Copyright (c) 1986-2002 Kim Jeong-Hwan
All rights reserved.
Permission to use, copy, modify and distribute this font is
hereby granted, provided that both the copyright notice and
this permission notice appear in all copies of the font,
derivative works or modified versions, and that the following
acknowledgement appear in supporting documentation:
Baekmuk Batang, Baekmuk Dotum, Baekmuk Gulim, and
Baekmuk Headline are registered trademarks owned by
thanks for your quick reply. I'll keep fedora-legal-list on copy,
perhaps they want to comment.
On Wed, 2007-09-05 at 20:39 -0400, dcoffin(a)cybercom.net wrote:
> Hi Nils,
> I changed the text because some customers are paranoid
> about the letters "GPL". It seems that Debian is bothered by:
> > (a) include full source code*
> Now I don't need to exactly match the GPL, but I must
> require something that commercial software companies would
> never accept, without creating problems for distributors of
> free software.
> How about changing "include" to "offer, at no extra
I'm not a lawyer ;-), but the source code provisions in the GPL are a
bit complicated -- to stay compatible, one would have to formulate
something compatible to 32 lines of legalese in the GPL license ;-). I
don't know about your customers, but I think an easy way to stay
compatible to the GPL would be dual-licensing, e.g. extend the text to
"... *If you have not modified dcraw.c in any way, a link to my homepage
qualifies as "full source code". ALTERNATIVELY, at your option, you may
distribute the code under the conditions of the GNU [Lesser] General
Public License Version 2[.1] [(or, at your option, any later version)]
[continue with standard GPL blurb]"
Of course, the version of the [L]GPL and whether you allow later
versions is up to you (it's your code). Would your customers be scared
away by that?
> Dave Coffin 9/5/2007
> On Wed, Sep 05, 2007 at 05:08:33PM +0200, Nils Philippsen wrote:
> > Hi Dave,
> > I'm the Fedora/Red Hat Enterprise Linux package maintainer for dcraw and
> > when going over the licenses of some of my packages I found that the
> > licensing blurb of dcraw.c has changed like this ("-": old, "+": new
> > version):
> > --- 8< ---
> > - Attention! Some parts of this program are restricted under the
> > - terms of the GNU General Public License. Such code is enclosed
> > - in "BEGIN GPL BLOCK" and "END GPL BLOCK" declarations.
> > - Any code not declared GPL is free for all uses.
> > + No license is required to download and use dcraw.c. However,
> > + to lawfully redistribute this code, you must either (a) include
> > + full source code* for all executable files containing RESTRICTED
> > + functions, (b) remove all RESTRICTED functions, re-implement them,
> > + or copy them from an earlier, unrestricted Revision of dcraw.c,
> > + or (c) purchase a license from the author.
> > - Starting in Revision 1.237, the code to support Foveon cameras
> > - is under GPL.
> > + The functions that process Foveon images have been RESTRICTED
> > + since Revision 1.237. All other code remains free for all uses.
> > - To lawfully redistribute dcraw.c, you must either (a) include
> > - full source code for all executable files containing restricted
> > - functions, (b) remove these functions, re-implement them, or
> > - copy them from an earlier, non-GPL Revision of dcraw.c, or (c)
> > - purchase a license from the author.
> > + *If you have not modified dcraw.c in any way, a link to my
> > + homepage qualifies as "full source code".
> > --- >8 ---
> > With the upcoming Fedora version 8, we want all packages' licensing
> > terms be listed in the package (e.g. "GPLv2+" for GNU GPL Version 2 or
> > later"). Now I'm a bit unsure about what to do about the terms of
> > dcraw.c and whether they are still GPL compatible(*) and so forth.
> > (*): IIRC, GPL allows distribution of a binary without source code but a
> > written offer to ship it on request. The source code provisions in the
> > dcraw terms might be "additional restrictions" that aren't GPL
> > compatible.
> > Would you please shed some light on this? I'd very much appreciate it.
> > Thanks in advance,
> > Nils
> > --
> > Nils Philippsen / Red Hat / nphilipp(a)redhat.com
> > "Those who would give up Essential Liberty to purchase a little Temporary
> > Safety, deserve neither Liberty nor Safety." -- B. Franklin, 1759
> > PGP fingerprint: C4A8 9474 5C4C ADE3 2B8F 656D 47D8 9B65 6951 3011
Nils Philippsen / Red Hat / nphilipp(a)redhat.com
"Those who would give up Essential Liberty to purchase a little Temporary
Safety, deserve neither Liberty nor Safety." -- B. Franklin, 1759
PGP fingerprint: C4A8 9474 5C4C ADE3 2B8F 656D 47D8 9B65 6951 3011
There is no release of LGPLv2, so the short names for LGPL listed on
the Licensing page are a bit unclear.
Would it be better to use LGPLv2.1, LGPLv2.1+ etc. as opposed to
LGPLv2 et. al.? It seems odd to refer to a non-existent license.