legal November 2021

legal@lists.fedoraproject.org

11 participants
8 discussions

Brainpool Curves in Fedora (openssl, libgcrypt, gnupg)
by Timothée Ravier 21 May '24

21 May '24

Hi everyone, The ECC Brainpool Curves [1][2] are currently not available in Fedora as according to this BZ [3], this needs Fedora Legal approval. Could someone from the legal team take a look to see if there are any blockers regarding Brainpool Curves inclusion in Fedora? Thanks! [1] https://en.wikipedia.org/wiki/Elliptic-curve_cryptography#Implementation [2] https://tools.ietf.org/html/rfc5639 [3] https://bugzilla.redhat.com/show_bug.cgi?id=1413618

14 31

Henry Spencer's license
by Petr Šabata 06 Mar '23

06 Mar '23

Dear legal, While checking the contents of our `perl' package, I noticed the following: (...) /* NOTE: this is derived from Henry Spencer's regexp code, and should not * confused with the original package (see point 3 below). Thanks, Henry! */ /* Additional note: this code is very heavily munged from Henry's version * in places. In some spots I've traded clarity for efficiency, so don't * blame Henry for some of the lack of readability. */ /* The names of the functions have been changed from regcomp and * regexec to pregcomp and pregexec in order to avoid conflicts * with the POSIX routines of the same names. */ (...) * pregcomp and pregexec -- regsub and regerror are not used in perl * * Copyright (c) 1986 by University of Toronto. * Written by Henry Spencer. Not derived from licensed software. * * Permission is granted to anyone to use this software for any * purpose on any computer system, and to redistribute it freely, * subject to the following restrictions: * * 1. The author is not responsible for the consequences of use of * this software, no matter how awful, even if they arise * from defects in it. * * 2. The origin of this software must not be misrepresented, either * by explicit claim or by omission. * * 3. Altered versions must be plainly marked as such, and must not * be misrepresented as being the original software. * **** Alterations to Henry's code are... **** **** Copyright (C) 1991, 1992, 1993, 1994, 1995, 1996, 1997, 1998, 1999, **** 2000, 2001, 2002, 2003, 2004, 2005, 2006, 2007, 2008 **** by Larry Wall and others **** **** You may distribute under the terms of either the GNU General Public **** License or the Artistic License, as specified in the README file. (...) You can see the whole file here: https://metacpan.org/source/SHAY/perl-5.20.1/regexec.c I looked but couldn't find any common name for this license of Henry's. Is it on our list? Is it free? What name should I use in the License tag? Thank you, Petr

5 9

about openssl we may enable and build all elliptic curves on corp ?
by Sérgio Basto 05 Nov '22

05 Nov '22

Hello, I reopen or start thinking again on this question of enable elliptic curves of openssl [1] So going directly to the point, may I built all source of openssl in copr [2] ? or at least some other curves that fedora package don't ship? [1] https://bugzilla.redhat.com/show_bug.cgi?id=1405843 [2] Version: 1.0.2k %global fips_version 2.0.14 I mean sources: http://ftp.o penssl.org/source/openssl-%{version}.tar.gz and http://ftp.openssl.org/s ource/openssl-fips-%{fips_version}.tar.gz Thanks , -- Sérgio M. B.

4 6

FIGlet fonts
by Lyes Saadi 25 Jul '22

25 Jul '22

Hello Legal, I'm bringing back a discussion from 2012[1]: Figlet fonts! Indeed, I am trying to package python-pyfiglet[2] as a dependency for other packages. But, after the review, it came up that a lot of weird fonts were included. At the time, I didn't know anything about the discussion, and decided to abort everything. Recently though, a developer contacted me through the bug report, and proposed to help on the issue. He triaged the fonts and separated them depending on whether they were Open-Source or not, and we were thus able to create a clean package with none of the problematic fonts in it. In that discussion[3], emerged the fact that a discussion over this already happened ([1]), but it seems that either no consensus was reached, or that such consensus was lost to time as I wasn't able to find any conversation on figlet either on legal or devel mailing lists archives. And, it seems that the issue was just simply avoided since figlet ended up removing the problematic fonts anyway. But, upstream would like to keep the problematic fonts if possible in Fedora. And so, I would like to ask Legal to either give me the answer, if it actually was a settled matter, or to reach a consensus on Figlet fonts. To resume the situation (as I understand it, I am not a lawyer, obviously): In the US, fonts glyphs are not copyright-able as it is considered insufficiently creative. For the same reason, Bitmap fonts (fonts defined pixel by pixel) are also not copyright-able, as they are only considered as data which represents glyphs. But, Vector fonts (fonts defined using drawing instructions and code), is, on the other hand, copyright-able because it is defined through a software code. Then, we come to Figlet fonts. For those not aware of what Figlet fonts, they are also known as ASCII fonts: __ __ ____ __ ____ / / / /__ / / /___ / / ___ ____ _____ _/ / / / /_/ / _ \/ / / __ \ / / / _ \/ __ `/ __ `/ / / / __ / __/ / / /_/ / / /___/ __/ /_/ / /_/ / /_/ /_/ /_/\___/_/_/\____( ) /_____/\___/\__, /\__,_/_(_) |/ /____/ The issue with those is that no ruling (as far as I know) ever concerned that type of font in US Court. Though, one argument would be that Figlet fonts are similar to Bitmap fonts, as they only contain data about glyphs, and do not, in the same way as Vector fonts do, contain code giving to the computer drawing instructions for the fonts. As such Figlet fonts are not modular, or extensible, they just contain raw data about a font. But still, all this is speculation, and, as I said, I am not a lawyer, so I don't have any slight idea if such a defense would hold in court. I hope to have resumed the situation clearly enough and that I didn't make any mistake. Greetings, Lyes Saadi [1]: https://bugzilla.redhat.com/show_bug.cgi?id=820642 [2]: https://bugzilla.redhat.com/show_bug.cgi?id=1876108 [3]: https://github.com/pwaller/pyfiglet/issues/89 PS: Can we remove the FE-legal blocker from the review request now that all the fonts have been sorted out?

4 8

Approval of license exception for new Fedora packages: raft/dqlite
by Reto Gantenbein 02 Dec '21

02 Dec '21

Hi everyone I'm in the course of adding two new packages raft [1] (sources: [2]) and dqlite [3] (sources: [4]) to Fedora. According to the LICENSE files [5][6] I would choose the Fedora license short name "LGPLv3 with exception" for these packages. The exception goes as following: "As a special exception to the GNU Lesser General Public License version 3 ("LGPL3"), the copyright holders of this Library give you permission to convey to a third party a Combined Work that links statically or dynamically to this Library without providing any Minimal Corresponding Source or Minimal Application Code as set out in 4d or providing the installation information set out in section 4e, provided that you comply with the other provisions of LGPL3 and provided that you meet, for the Application the terms and conditions of the license(s) which apply to the Application. Except as stated in this special exception, the provisions of LGPL3 will continue to comply in full to this Library. If you modify this Library, you may apply this exception to your version of this Library, but you are not obliged to do so. If you do not wish to do so, delete this exception statement from your version. This exception does not (and cannot) modify any license terms which apply to the Application, with which you must still comply." According to the rules that I found in the documentation [7] I'm asking you for approval of this exception. Kind regards and cheers, Reto [1]: https://bugzilla.redhat.com/show_bug.cgi?id=2017459 [2]: https://github.com/canonical/raft [3]: https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=2017476 [4]: https://github.com/canonical/dqlite [5]: https://github.com/canonical/raft/blob/v0.11.2/LICENSE [6]: https://github.com/canonical/dqlite/blob/v1.9.0/LICENSE [7]: https://fedoraproject.org/wiki/Licensing:Main?rd=Licensing#Software_License…

3 5

Bytepath packaging question
by Dennis Payne 21 Nov '21

21 Nov '21

Bytepath is a commercial game which has been released open source. I’ve avoided packaging commercial games since that might decrease sales. However the official release requires love 10.2 and can’t be run directly from steam. I forked the code to make it run on love 11. Do you think packaging it for Fedora is a good idea? I’ve tracked down the license for some of the sound files but I don’t know the source for most. I don’t doubt that the creator followed the license requirement but can’t confirm. I’ve debated replacing all the sounds. -- Dennis Payne dulsi(a)identicalsoftware.com https://mastodon.gamedev.place/@dulsi

2 2

ttyp0 font license
by Artur Frenszek-Iwicki 14 Nov '21

14 Nov '21

I maintain the easyrpg-player package [0]. Recently, it had a v0.7.0 release [1]. As it often happens, this release added some new dependencies. One of those is the "ttyp0" font [2], which uses its own, custom license. Reading through, it seems to me that it's basically MIT with one extra clause: > If the design of any glyphs in the fonts that are contained in the > Software or generated during the installation process is modified > or if additional glyphs are added to the fonts, the fonts > must be renamed. The new names may not contain the word "UW", > irrespective of capitalisation; the new names may contain the word > "ttyp0", irrespective of capitalisation, only if preceded by a > foundry name different from "UW". I'm posting here because I'd like to confirm that the license is OK with Fedora. A.FI. [0] https://src.fedoraproject.org/rpms/easyrpg-player [1] https://github.com/EasyRPG/Player/releases/tag/0.7.0 [2] https://people.mpi-inf.mpg.de/~uwe/misc/uw-ttyp0/

6 12

website blurb about licensing of iso downloads
by Zbigniew Jędrzejewski-Szmek 05 Nov '21

05 Nov '21

Hi, [see https://pagure.io/fedora-web/websites/issue/215 for the original issue] I hope that this is the right venue for this question/review request: https://getfedora.org/ currently says > Fedora is always free for anyone to use, modify, and distribute. > It is built and used by people across the globe who work together as a community. There is a pull request open to amend the text to include: <small>{% trans trimmed %}It is a compilation of software packages, each under its own license. Images that can be downloaded here are available under the combination of licenses of the constituent software packages and the license of the Fedora project itself. <a href="https://fedoraproject.org/wiki/Legal:Licenses/LicenseAgreement#License">View License</a>{% endtrans %}</small> Are we happy with this text? Zbyszek

4 6

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

legal November 2021