legal October 2022

legal@lists.fedoraproject.org

13 participants
11 discussions

Request to stop hobbling crypto libraries
by Neal Gompa 12 Sep '24

12 Sep '24

Hey all, As part of the discussion going on about Mesa on devel@, the situation around OpenSSL was brought up, and Adam Williamson brought up that we might not need to hobble OpenSSL anymore[1]. A quick check seems to indicate we no longer do it for GnuTLS either, and haven't for many years[2]. Could we just drop all this stuff and use pristine OpenSSL sources? All the crypto algorithm usability stuff is controlled through crypto-policies, so I don't think it makes sense to do this anymore for OpenSSL since all the patents indicated in the script have expired for a couple of years now[3]. Dropping this will eliminate a chunk of cruft that nobody needs around anymore and simplify OpenSSL maintenance. [1]: https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org… [2]: https://src.fedoraproject.org/rpms/gnutls/c/46d865d8451be0f4576dcc56841175a… [3]: https://src.fedoraproject.org/rpms/openssl//blob/rawhide/f/hobble-openssl -- 真実はいつも一つ！/ Always, there's only one truth!

7 16

Brainpool Curves in Fedora (openssl, libgcrypt, gnupg)
by Timothée Ravier 21 May '24

21 May '24

Hi everyone, The ECC Brainpool Curves [1][2] are currently not available in Fedora as according to this BZ [3], this needs Fedora Legal approval. Could someone from the legal team take a look to see if there are any blockers regarding Brainpool Curves inclusion in Fedora? Thanks! [1] https://en.wikipedia.org/wiki/Elliptic-curve_cryptography#Implementation [2] https://tools.ietf.org/html/rfc5639 [3] https://bugzilla.redhat.com/show_bug.cgi?id=1413618

14 31

Henry Spencer's license
by Petr Šabata 06 Mar '23

06 Mar '23

Dear legal, While checking the contents of our `perl' package, I noticed the following: (...) /* NOTE: this is derived from Henry Spencer's regexp code, and should not * confused with the original package (see point 3 below). Thanks, Henry! */ /* Additional note: this code is very heavily munged from Henry's version * in places. In some spots I've traded clarity for efficiency, so don't * blame Henry for some of the lack of readability. */ /* The names of the functions have been changed from regcomp and * regexec to pregcomp and pregexec in order to avoid conflicts * with the POSIX routines of the same names. */ (...) * pregcomp and pregexec -- regsub and regerror are not used in perl * * Copyright (c) 1986 by University of Toronto. * Written by Henry Spencer. Not derived from licensed software. * * Permission is granted to anyone to use this software for any * purpose on any computer system, and to redistribute it freely, * subject to the following restrictions: * * 1. The author is not responsible for the consequences of use of * this software, no matter how awful, even if they arise * from defects in it. * * 2. The origin of this software must not be misrepresented, either * by explicit claim or by omission. * * 3. Altered versions must be plainly marked as such, and must not * be misrepresented as being the original software. * **** Alterations to Henry's code are... **** **** Copyright (C) 1991, 1992, 1993, 1994, 1995, 1996, 1997, 1998, 1999, **** 2000, 2001, 2002, 2003, 2004, 2005, 2006, 2007, 2008 **** by Larry Wall and others **** **** You may distribute under the terms of either the GNU General Public **** License or the Artistic License, as specified in the README file. (...) You can see the whole file here: https://metacpan.org/source/SHAY/perl-5.20.1/regexec.c I looked but couldn't find any common name for this license of Henry's. Is it on our list? Is it free? What name should I use in the License tag? Thank you, Petr

5 9

about openssl we may enable and build all elliptic curves on corp ?
by Sérgio Basto 05 Nov '22

05 Nov '22

Hello, I reopen or start thinking again on this question of enable elliptic curves of openssl [1] So going directly to the point, may I built all source of openssl in copr [2] ? or at least some other curves that fedora package don't ship? [1] https://bugzilla.redhat.com/show_bug.cgi?id=1405843 [2] Version: 1.0.2k %global fips_version 2.0.14 I mean sources: http://ftp.o penssl.org/source/openssl-%{version}.tar.gz and http://ftp.openssl.org/s ource/openssl-fips-%{fips_version}.tar.gz Thanks , -- Sérgio M. B.

4 6

Patent question for moodycamel-readerwriterqueue package
by Sergey Mende 01 Nov '22

01 Nov '22

Hi, I have a package in review process that could affect some patents [0]. The author claims that the work was done from scratch [1] though he admits that he did not search for any existing patents. Benson Muite had found a patent that covers the similar topic [2] I am completely dumb in this area, so I kindly ask someone to help identify if the author's implementation violates the rights of any patent owner. [0] https://bugzilla.redhat.com/show_bug.cgi?id=2129304 [1] https://moodycamel.com/blog/2013/a-fast-lock-free-queue-for-c++ [2] https://patents.google.com/patent/US8543743B2/en Thanks in advance, Sergey

1 0

Package log4j 2.17.2 contains strangely-licensed files
by Marián Konček 21 Oct '22

21 Oct '22

Hi, in the Fedora package "log4j" (branch Rawhide) I noticed a file apache-log4j-2.17.2-src/src/site/resources/glyphicons-halflings-2-1.zip It contains "_glyphicons_license.pdf" which also points here https://glyphicons.com/license/ I am asking for a legal review of this license. -- Marián Konček

3 3

can we bundle CNN models for wechat_qrcode ?
by Sérgio Basto 19 Oct '22

19 Oct '22

Hi, Recently opencv add to opencv_contrib "CNN models for wechat_qrcode module, including the detector model and the super scale model." https://github.com/WeChatCV/opencv_3rdparty CNN models is about "Object Detection using CNNs" https://docs.opencv.org/4.x/d2/da2/tutorial_dnn_objdetect.html I proposed add the models https://src.fedoraproject.org/rpms/opencv/pull-request/21# The lack of information of the License of these "models" , make me think I should ask to legal ? if we can bundle these binaries that are in a 3rdparty repo. In the opencv_contrib code we have this License information https://github.com/opencv/opencv_contrib/blob/4.x/modules/wechat_qrcode/LIC… Thanks, -- Sérgio M. B.

3 3

Where are the OFL* licenses?
by Jerry James 18 Oct '22

18 Oct '22

I just ran rpmlint over a package under the OFL-1.1-RFN license, with the rpmlint-fedora-license-data package installed. I got "W: invalid-license OFL-1.1-RFN". I undertook a search on the allowed [1] and not allowed [2] license pages. Only "OFL-1.1" appears anywhere, under the "All licenses" section of [1]. (And, faithfully reproducing this, "OFL-1.1" is the only OFL* license that appears in the rpmlint-fedora-license-data package.) The underlying license data [3] from which [1] and [2] are generated lists all of OFL-1.0, OFL-1.0-RFN, OFL-1.0-no-RFN, OFL-1.1, OFL-1.1-RFN, and OFL-1.1-no-RFN. Why aren't the other licenses showing up on [1] and in rpmlint-fedora-license-data? Is it because "OFL-1.1" is the only one of the six that has a "Y" in both the "OSI?" and "FSFLibre?" columns of licenses.md? If so, what does that imply about the status of the other 5 licenses for Fedora? References: [1] https://docs.fedoraproject.org/en-US/legal/allowed-licenses/ [2] https://docs.fedoraproject.org/en-US/legal/not-allowed-licenses/ [3] https://gitlab.com/fedora/legal/fedora-license-data -- Jerry James http://www.jamezone.org/

3 4

License correction for libIDL-doc
by Ben Beasley 17 Oct '22

17 Oct '22

While converting libIDL to SPDX (LGPLv2+ → LGPL-2.0-or-later), I noticed that the documentation is actually GPLv3+. The libIDL-doc subpackage’s License field is therefore corrected from LGPLv2+ to GPL-3.0-or-later. – Ben Beasley (FAS music)

1 0

SPDX progress
by Miroslav Suchý 10 Oct '22

10 Oct '22

I was curious how many packages are already converted to SPDX. I downloaded all spec files and count how many of them contains "spdx" string (case insensitive). Assuming most packagers mention it either in changelog or in comment near License field. The string is in 347 out of 23155 spec files. That is less than 2% of packages. It is wild guess with many incorrect of assumtions, but I guess the order of magnitude is correct. That is just FYI. I will not do anything to progress faster, because `fedora-license-data` has enough issues (and mainly flow of new issues). Miroslav

6 7

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

legal October 2022