legal November 2020

legal@lists.fedoraproject.org

8 participants
5 discussions

Brainpool Curves in Fedora (openssl, libgcrypt, gnupg)
by Timothée Ravier 21 May '24

21 May '24

Hi everyone, The ECC Brainpool Curves [1][2] are currently not available in Fedora as according to this BZ [3], this needs Fedora Legal approval. Could someone from the legal team take a look to see if there are any blockers regarding Brainpool Curves inclusion in Fedora? Thanks! [1] https://en.wikipedia.org/wiki/Elliptic-curve_cryptography#Implementation [2] https://tools.ietf.org/html/rfc5639 [3] https://bugzilla.redhat.com/show_bug.cgi?id=1413618

14 31

Henry Spencer's license
by Petr Šabata 06 Mar '23

06 Mar '23

Dear legal, While checking the contents of our `perl' package, I noticed the following: (...) /* NOTE: this is derived from Henry Spencer's regexp code, and should not * confused with the original package (see point 3 below). Thanks, Henry! */ /* Additional note: this code is very heavily munged from Henry's version * in places. In some spots I've traded clarity for efficiency, so don't * blame Henry for some of the lack of readability. */ /* The names of the functions have been changed from regcomp and * regexec to pregcomp and pregexec in order to avoid conflicts * with the POSIX routines of the same names. */ (...) * pregcomp and pregexec -- regsub and regerror are not used in perl * * Copyright (c) 1986 by University of Toronto. * Written by Henry Spencer. Not derived from licensed software. * * Permission is granted to anyone to use this software for any * purpose on any computer system, and to redistribute it freely, * subject to the following restrictions: * * 1. The author is not responsible for the consequences of use of * this software, no matter how awful, even if they arise * from defects in it. * * 2. The origin of this software must not be misrepresented, either * by explicit claim or by omission. * * 3. Altered versions must be plainly marked as such, and must not * be misrepresented as being the original software. * **** Alterations to Henry's code are... **** **** Copyright (C) 1991, 1992, 1993, 1994, 1995, 1996, 1997, 1998, 1999, **** 2000, 2001, 2002, 2003, 2004, 2005, 2006, 2007, 2008 **** by Larry Wall and others **** **** You may distribute under the terms of either the GNU General Public **** License or the Artistic License, as specified in the README file. (...) You can see the whole file here: https://metacpan.org/source/SHAY/perl-5.20.1/regexec.c I looked but couldn't find any common name for this license of Henry's. Is it on our list? Is it free? What name should I use in the License tag? Thank you, Petr

5 9

about openssl we may enable and build all elliptic curves on corp ?
by Sérgio Basto 05 Nov '22

05 Nov '22

Hello, I reopen or start thinking again on this question of enable elliptic curves of openssl [1] So going directly to the point, may I built all source of openssl in copr [2] ? or at least some other curves that fedora package don't ship? [1] https://bugzilla.redhat.com/show_bug.cgi?id=1405843 [2] Version: 1.0.2k %global fips_version 2.0.14 I mean sources: http://ftp.o penssl.org/source/openssl-%{version}.tar.gz and http://ftp.openssl.org/s ource/openssl-fips-%{fips_version}.tar.gz Thanks , -- Sérgio M. B.

4 6

ASL 2.0 with exceptions
by Zdenek Dohnal 24 Nov '20

24 Nov '20

Hi all, I'm trying to package lprint https://github.com/michaelrsweet/lprint which has Apache Software License 2.0 with exceptions for GPLv2 and LGPLv2. CUPS has a similar license and it was marked as fine for Fedora in this thread [1] . Unfortunately, there isn't a valid short name for 'ASL 2.0 with exceptions' at [2] - would it be possible to add the short name into the table or should I just use simple 'ASL 2.0'? Thank you in advance and have a nice day, Zdenek [1] https://lists.fedoraproject.org/archives/list/legal@lists.fedoraproject.org… [2] https://fedoraproject.org/wiki/Licensing:Main#Good_Licenses -- Zdenek Dohnal Software Engineer Red Hat Czech - Brno TPB-C

8 17

License for package scummvm
by Christian Krause 15 Nov '20

15 Nov '20

Hi, during the update of the package scummvm I reviewed its license and stumbled over some difficulties: - the main parts of the source code seem to be GPLv2+: https://github.com/scummvm/scummvm/blob/branch-2-2/COPYING - however, parts of scummvm are using a variety of BSD-like licenses as well as LGPLv2+, please see the various COPYING.* files here: https://github.com/scummvm/scummvm/tree/branch-2-2 As far as I understand, these additional licenses are compatible with GPLv2+. My concrete question is: Is there a need to list the other licenses in the "License" tag as well or is "GPLv2+" sufficient? If all licenses need to be listed, would that be in this case: "GPLv2+ and BSD and LGPLv2.1+ and OFL" ? Note 1: It looks like that the TTF fonts under GPLv3+ (COPYING.FREEFONT) are not installed in Fedora (but they are present in the src package). Note 2: The Suse distribution seems to use "GPL-2.0+" and Debian has references to all licenses: https://metadata.ftp-master.debian.org/changelogs//main /s/scummvm/scummvm_2.2.0+dfsg1-1_copyright Thank you very much in advance for the advice. Best regards, Christian

3 3

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

legal November 2020