Hey all,
As part of the discussion going on about Mesa on devel@, the situation
around OpenSSL was brought up, and Adam Williamson brought up that we
might not need to hobble OpenSSL anymore[1]. A quick check seems to
indicate we no longer do it for GnuTLS either, and haven't for many
years[2].
Could we just drop all this stuff and use pristine OpenSSL sources?
All the crypto algorithm usability stuff is controlled through
crypto-policies, so I don't think it makes sense to do this anymore
for OpenSSL since all the patents indicated in the script have expired
for a couple of years now[3].
Dropping this will eliminate a chunk of cruft that nobody needs around
anymore and simplify OpenSSL maintenance.
[1]: https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org…
[2]: https://src.fedoraproject.org/rpms/gnutls/c/46d865d8451be0f4576dcc56841175a…
[3]: https://src.fedoraproject.org/rpms/openssl//blob/rawhide/f/hobble-openssl
--
真実はいつも一つ!/ Always, there's only one truth!
Hi,
valgrind as a whole is licensed under the GPLv2+, but has a couple of
development headers, all separately packaged in the valgrind-devel
subpackage) with a lax-permissive license. Since they are meant to
embed valgrind specific (code) annotations into other
programs/libraries they carry an explicit exception from the GPL.
There are 7 such files, all exactly the same, except for the embedded
file name, "This file is part of..." description and Copyright notice.
See below for the exact text and variants.
It would be nice to give this binary subpackage its own License tag.
But I have some trouble figuring out which (SPDX) tag to use.
The closest seems to be what SPDX calls "bzip2-1.0.6" (which kind of
makes sense since Julian Seward started both the bzip2 and valgrind
projects). https://spdx.org/licenses/bzip2-1.0.6.html
I could use that identifier. But it seems to be an oddly specific
identifier, for an older version of bzip2. And the Fedora bzip2 package
just uses BSD-4-Clause. I could also use BSD-4-Clause since that is
more generic. But the text of what SPDX calls BSD-4-Clause doesn't
really match (so maybe the Fedora bzip2 package got that wrong?)
What would be to best license tag to use here?
They all look as follows:
/* -*- c -*-
----------------------------------------------------------------
Notice that the following BSD-style license applies to this one
file (valgrind.h) only. The rest of Valgrind is licensed under the
terms of the GNU General Public License, version 2, unless
otherwise indicated. See the COPYING file in the source
distribution for details.
----------------------------------------------------------------
This file is part of Valgrind, a dynamic binary instrumentation
framework.
Copyright (C) 2000-2017 Julian Seward. All rights reserved.
Redistribution and use in source and binary forms, with or without
modification, are permitted provided that the following conditions
are met:
1. Redistributions of source code must retain the above copyright
notice, this list of conditions and the following disclaimer.
2. The origin of this software must not be misrepresented; you must
not claim that you wrote the original software. If you use this
software in a product, an acknowledgment in the product
documentation would be appreciated but is not required.
3. Altered source versions must be plainly marked as such, and must
not be misrepresented as being the original software.
4. The name of the author may not be used to endorse or promote
products derived from this software without specific prior written
permission.
THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS
OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE
GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
----------------------------------------------------------------
Notice that the above BSD-style license applies to this one file
(valgrind.h) only. The entire rest of Valgrind is licensed under
the terms of the GNU General Public License, version 2. See the
COPYING file in the source distribution for details.
----------------------------------------------------------------
*/
They only differ in "this one file
([valgrind|cachegrind|callgrind|drd|helgrind|memcheck|dhat].h) only" at
the top and the bottom. And the description and Copyright notice.
This file is part of Cachegrind, a high-precision tracing profiler
built with Valgrind.
Copyright (C) 2023-2023 Nicholas Nethercote. All rights reserved.
--
This file is part of callgrind, a valgrind tool for cache simulation
and call tree tracing.
Copyright (C) 2003-2017 Josef Weidendorfer. All rights reserved.
--
This file is part of DRD, a Valgrind tool for verification of
multithreaded programs.
Copyright (C) 2006-2020 Bart Van Assche <bvanassche(a)acm.org>.
All rights reserved.
--
This file is part of Helgrind, a Valgrind tool for detecting errors
in threaded programs.
Copyright (C) 2007-2017 OpenWorks LLP
info(a)open-works.co.uk
--
This file is part of MemCheck, a heavyweight Valgrind tool for
detecting memory errors.
Copyright (C) 2000-2017 Julian Seward. All rights reserved.
--
This file is part of DHAT, a Valgrind tool for profiling the
heap usage of programs.
Copyright (C) 2020 Nicholas Nethercote. All rights reserved.
--
Thanks,
Mark
-------- Přeposlaná zpráva --------
Předmět: SPDX Statistics - Lisa edition
Datum: Fri, 19 Jan 2024 16:57:15 +0100
Od: Miroslav Suchý <msuchy(a)redhat.com>
Společnost: Red Hat Czech, s.r.o.
Komu: Development discussions related to Fedora <devel(a)lists.fedoraproject.org>
Hot news:
https://fedoraproject.org/wiki/Changes/SPDX_Licenses_Phase_3 was approved.
I generated license analysis using scancode-toolkit for all remaining packages http://miroslav.suchy.cz/fedora/spdx-reports/
Now lets dive into numbers:
Two weeks ago we had:
> * 23542 spec files in Fedora
>
> * 30058license tags in all spec files
>
> * 11715 tags have not been converted to SPDX yet
>
> * 5266tags can be trivially converted using `license-fedora2spdx`
>
> * Progress: 61,03% ░░░░░░████ 100%
>
> ELN subset:
>
> 290 out of 2457 packages are not converted yet (progress 88.20%)
>
Today we have:
* 23681 spec files in Fedora
* 30232license tags in all spec files
* 11697 tags have not been converted to SPDX yet
* 5264tags can be trivially converted using `license-fedora2spdx`
* Progress: 61,31% ░░░░░░████ 100%
ELN subset:
250 out of 2439 packages are not converted yet (progress 89.75%)
Graph of these data with the burndown chart:
https://docs.google.com/spreadsheets/d/1QVMEzXWML-6_Mrlln02axFAaRKCQ8zE807r…
The list of packages needed to be converted is here:
https://pagure.io/copr/license-validate/blob/main/f/packages-without-spdx-f…
List by package maintainers is here
https://pagure.io/copr/license-validate/blob/main/f/packages-without-spdx-f…
List of packages from ELN subset that needs to be converted:
https://pagure.io/copr/license-validate/blob/main/f/eln-not-migrated.txt
New version of fedora-license-data has been released. With 9 new licenses (plus some public domain declarations). 22
licenses are waiting to be review by SPDX.org (and then to be added to fedora-license-data)
https://gitlab.com/fedora/legal/fedora-license-data/-/issues/?label_name%5B…
Legal docs and especially
https://docs.fedoraproject.org/en-US/legal/allowed-licenses/
was updated too.
New projection when we will be finished is 2024-12-21 (+21 days from last report). Pure linear approximation.
If your package does not have neither git-log entry nor spec-changelog entry mentioning SPDX and you know your license
tag matches SPDX formula, you can put your package on ignore list
https://pagure.io/copr/license-validate/blob/main/f/ignore-packages.txt
Either pull-request or direct email to me is fine.
Why Lisa edition? On this day, in 1983 Apple released Apple Lisa - first personal computer with a GUI. Read about it on
https://en.wikipedia.org/wiki/Apple_Lisa It is reminder that Apple was not always successful. And that revolutionary
products does not mean economical success and can be obsoleted by products that are "good-enough".
Miroslav
Greetings,
In hopes of eventually packaging DPS8M (https://dps8m.gitlab.io) the 36‑bit GE Large Systems / Honeywell / Bull 600/6000‑series mainframe computer simulator (and the associated Multics operating system files), I'd like to request that some license details be reviewed by the Fedora project.
Of the source code licenses used, only the Multics License is not currently listed as allowed for Fedora. The Multics License is an OSI approved open source license (and a Blue Oak Council Certified permissive license). See https://opensource.org/license/multics-txt/ for details.
As an aside, the use of the Multics license in DPS8M might be unique amongst software distributed by Fedora, if DPS8M would eventually be packaged. The Multics License covers **only** some of the simulator’s source code comments, and is **not** applicable to compiled object code or binary distributions of the simulator, so the compiled packages would be allowed in Fedora, but not the source code, which would be a weird Catch-22 indeed.
In addition, I'd like to request that the CF-GAL ([Copyfree] General Attribution License) be allowed as a content and documentation license. See https://gitlab.com/dps8m/dps8m/-/blob/master/LICENSES/LicenseRef-CF-GAL.txt for the license text. This license originates from https://copyfree.org/content/standard/licenses/gal/license.txt, and is a variant of the SAL (https://copyfree.org/content/standard/licenses/sal/license.txt) which is not specific to software, and is similar to the already allowed zlib license. This license covers the use of certain logos, artwork, and documentation.
I apologize if I've misrouted this request, and if so, please let me know the most appropriate way to submit the GAL and Multics licenses for consideration.
--
Jeffrey H. Johnson
trnsz(a)pobox.com
Hello!
Heading to FOSDEM? Join us for a one-day workshop for developers and
users of open source SCA, SBOM, and license and security compliance
tools on Friday, February 2nd, 2024 in Brussels just before FOSDEM
2024: https://opencollective.com/aboutcode/events/fosdem-2024-fringe-workshop-on-…
If you are involved with Fedora legal issues around open source
license compliance, you are super welcome to join!
The program will be an unconference with the day split in two: tools
developers share their plans in the morning and users share their
requirements in the afternoon.
Registration is required and free (including a free lunch and free
coffee), but we encourage your contributions to help us pay for the
event's expenses!
We booked at https://www.tricoterie.org/en that some of you may know
from past FOSS events.
We're also looking for generous sponsors to help fund the venue and
catering - you can contribute online directly or email me directly at
pombredanne(a)nexb.com
I look forward to seeing you there.
--
Cordially
Philippe Ombredanne
+1 650 799 0949 | pombredanne(a)nexB.com
AboutCode - Open source for open source - https://www.aboutcode.org
ScanCode - scan your code, for origin/license/vulnerabilities, report
SBOMs - https://github.com/nexB/scancode-toolkithttps://github.com/nexB/scancode.io
package-url - the mostly universal SBOM identifier for packages -
https://github.com/package-url
DejaCode - What's in your code?! - http://www.dejacode.com
-------- Přeposlaná zpráva --------
Předmět: SPDX Statistics - Eight-hour day edition
Datum: Fri, 5 Jan 2024 07:38:50 +0100
Od: Miroslav Suchý <msuchy(a)redhat.com>
Společnost: Red Hat Czech, s.r.o.
Komu: Development discussions related to Fedora <devel(a)lists.fedoraproject.org>
Hot news:
The process of adding licenses is back on track.
https://fedoraproject.org/wiki/Changes/SPDX_Licenses_Phase_3 has been submitted.
Now lets dive into numbers:
Two weeks ago we had:
> * 23562 spec files in Fedora
>
> * 30067license tags in all spec files
>
> * 11907 tags have not been converted to SPDX yet
>
> * 5370tags can be trivially converted using `license-fedora2spdx`
>
> * Progress: 60,04% ░░░░░░████ 100%
>
> ELN subset:
>
> 507 out of 3734 packages are not converted yet (progress 86.42%)
>
Today we have:
* 23542 spec files in Fedora
* 30058license tags in all spec files
* 11715 tags have not been converted to SPDX yet
* 5266tags can be trivially converted using `license-fedora2spdx`
* Progress: 61,03% ░░░░░░████ 100%
ELN subset:
290 out of 2457 packages are not converted yet (progress 88.20%)
Graph of these data with the burndown chart:
https://docs.google.com/spreadsheets/d/1QVMEzXWML-6_Mrlln02axFAaRKCQ8zE807r…
The list of packages needed to be converted is here:
https://pagure.io/copr/license-validate/blob/main/f/packages-without-spdx-f…
List by package maintainers is here
https://pagure.io/copr/license-validate/blob/main/f/packages-without-spdx-f…
List of packages from ELN subset that needs to be converted:
https://pagure.io/copr/license-validate/blob/main/f/eln-not-migrated.txt
New version of fedora-license-data has been released. With 6 new licenses (plus some public domain declarations). 17
licenses are waiting to be review by SPDX.org (and then to be added to fedora-license-data)
https://gitlab.com/fedora/legal/fedora-license-data/-/issues/?label_name%5B…
Legal docs and especially
https://docs.fedoraproject.org/en-US/legal/allowed-licenses/
was updated too.
New projection when we will be finished is 2024-11-30 (+16 days from last report). Pure linear approximation.
If your package does not have neither git-log entry nor spec-changelog entry mentioning SPDX and you know your license
tag matches SPDX formula, you can put your package on ignore list
https://pagure.io/copr/license-validate/blob/main/f/ignore-packages.txt
Either pull-request or direct email to me is fine.
Why Eight-hour day? It is reference to working hours per day. Until early of 20th century it was common that working day
ranged from 10 to 16 hours. There were numerous strikes and fights to lower it to 12 and 10. And later to 8. Until 5
January 1914 when the Ford Motor Company took the radical step of doubling pay to $5 a day (equivalent to $150) and
cutting shifts from nine hours to eight. When their profit margin doubled next year, other companies started to follow.
https://en.wikipedia.org/wiki/Eight-hour_day
Miroslav