legal September 2024

legal@lists.fedoraproject.org

7 participants
3 discussions

Licensing BIP derived files
by Cristian Le 04 Oct '24

04 Oct '24

Hi, This issue came up when trying to package rust-tiny-bip39 [1]. Basically there are some projects that are spun off of Bitcoin Improvement Proposals (BIP), in this case BIP39 [2] which establishes a wordlist which can be use as mnemonic to encode/decode a long series of bits. Te issue is that typically these BIPs are licensed [3], but (maybe) because BIP39 has not passed the proposed stage, it did not receive a proper license. So the question is, how to deal with the wordlist defined in BIP39? Contacting the upstream developer is difficult as they don't have an open issue page, and the main means of external people to get in touch with them is through their google mailing list, which would require exposing my personal gmail account to who knows what (given the association with bitcoin), which I am not comfortable of doing. In Fedora there is another BIP39 based project, python-mnemonic [4], which is the reference code for BIP39, where the only license specified is MIT. I have looked at the review request ticket [5], but the licensing of BIP39 was not discussed there. Any advice on this situation? [1]: https://bugzilla.redhat.com/show_bug.cgi?id=2297307 [2]: https://github.com/bitcoin/bips/blob/master/bip-0039.mediawiki [3]: https://github.com/bitcoin/bips/blob/master/bip-0002.mediawiki#bip-licensing [4]: https://src.fedoraproject.org/rpms/python-mnemonic [5]: https://bugzilla.redhat.com/show_bug.cgi?id=1395867

2 1

Request to stop hobbling crypto libraries
by Neal Gompa 12 Sep '24

12 Sep '24

Hey all, As part of the discussion going on about Mesa on devel@, the situation around OpenSSL was brought up, and Adam Williamson brought up that we might not need to hobble OpenSSL anymore[1]. A quick check seems to indicate we no longer do it for GnuTLS either, and haven't for many years[2]. Could we just drop all this stuff and use pristine OpenSSL sources? All the crypto algorithm usability stuff is controlled through crypto-policies, so I don't think it makes sense to do this anymore for OpenSSL since all the patents indicated in the script have expired for a couple of years now[3]. Dropping this will eliminate a chunk of cruft that nobody needs around anymore and simplify OpenSSL maintenance. [1]: https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org… [2]: https://src.fedoraproject.org/rpms/gnutls/c/46d865d8451be0f4576dcc56841175a… [3]: https://src.fedoraproject.org/rpms/openssl//blob/rawhide/f/hobble-openssl -- 真実はいつも一つ！/ Always, there's only one truth!

7 16

MIT without copyright notice, requires to include the copyright notice
by Miro Hrončok 03 Sep '24

03 Sep '24

Hello. I see an important project has decided it's good idea to remove their own copyright notice from the top of their MIT license file while preserving the requirement for distributors to keep the copyright notice. """ The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. """ But there is no such copyright notice to include. Is it OK for a Fedora package to distribute the project or is it impossible to comply with the license terms and hence not allowed? https://github.com/pypa/setuptools/commit/5957d58266e479f124b31f30e4322e798… https://github.com/jaraco/skeleton/issues/78 https://github.com/jaraco/inflect/issues/197 Note that this is not the case of MIT-0. -- Miro Hrončok -- Phone: +420777974800 Fedora Matrix: mhroncok

2 3

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

legal September 2024