Hi! I’m working on including a now-retired dependency inside the golang-x-perf package. The dependency is licensed under CC-BY-4.0[0], but it clearly contains code. As far as I understand, CC-BY-4.0 is only permitted for content, not code. But the original package, which was shipped until Fedora 40, also had CC-BY-4.0 as its license.
So, my questions are: where can I see if this was an exception? And what would be the next step to request an exception?
[0] https://src.fedoraproject.org/rpms/golang-github-ajstarks-svgo/blob/f40/f/g…
-------- Přeposlaná zpráva --------
Předmět: SPDX Statistics - 108 packages remaining
Datum: Fri, 2 May 2025 11:27:52 +0200
Od: Miroslav Suchý <msuchy(a)redhat.com>
Společnost: Red Hat Czech, s.r.o.
Komu: Development discussions related to Fedora <devel(a)lists.fedoraproject.org>
Hot news:
- SPDX upstream finally got approved some of our licenses waiting in the queue.
- in fedora-license-data - Richard and I are working together on old and painful issues. The number of open issues is
now 52. I am so happy about it, because it was over 60 for ages.
- almost every week I notice maintainer who has local copy of spec file and when they rebase package they overwrite the
migrated license tag. If you have such workflow, please check for the changes in dist-git first.
- legal documentations got several updates:
https://docs.fedoraproject.org/en-US/legal/update-existing-packages/#_publi…https://docs.fedoraproject.org/en-US/legal/update-existing-packages/#_licen…https://docs.fedoraproject.org/en-US/legal/license-review-process/ (note about funny licenses being treated seriously)
- kernel was documented as exception to BSD-3-Clause-Clear so kernel package is finally reported as OK.
- There are 3 packages in Fedora with not-allowed license. Despite my reports and ping they does not seems to have a
plan. I plan to open FESCO issue and retire these packages. For list of packages see tracking bug
https://bugzilla.redhat.com/show_bug.cgi?id=2310597
Five weeks ago we had:
> * 24495 spec files in Fedora
>
> * 31150license tags in all spec files
>
> * 115 tags are not SPDX compliant (number from line bellow minus packages with LicenseRef-Callaway-*)
>
> * 2184tags have not been converted to SPDX yet
>
> * 12 tags can be trivially converted using `license-fedora2spdx`
>
> * Progress: 99.83% ░░░░░░░░░█100%
>
> ELN subset:
>
> 54 out of 2301 packages are not converted yet (progress 97.50%)
>
Today we have:
* 24479 spec files in Fedora
* 31088license tags in all spec files
* 108 tags are not SPDX compliant (number from line bellow minus packages with LicenseRef-Callaway-*)
* 2143tags have not been converted to SPDX yet
* 11 tags can be trivially converted using `license-fedora2spdx`
* Progress: 99.63% ░░░░░░░░░█100%
ELN subset:
58 out of 2322 packages are not converted yet (progress 97.65%)
Graph of these data with the burndown chart:
https://docs.google.com/spreadsheets/d/1QVMEzXWML-6_Mrlln02axFAaRKCQ8zE807r…
The list of packages needed to be converted is here:
https://pagure.io/copr/license-validate/blob/main/f/packages-without-spdx-f…
List by package maintainers is here
https://pagure.io/copr/license-validate/blob/main/f/packages-without-spdx-f…
Packages that are neither in SPDX nor in Callaway format (highest priority for now) - 31 packages:
https://pagure.io/copr/license-validate/blob/main/f/neither-nor-remaining-p…
Most of such packages has open issue in fedora-license-data. A lot of them are waiting for SPDX to approved the license
and assign ID.
I released new version of fedora-license-data with 10 new license and bunch of public domain or ultra permissive findings.
6 licenses are waiting to be reviewed by SPDX.org (and then to be added to fedora-license-data)
https://gitlab.com/fedora/legal/fedora-license-data/-/issues/?label_name%5B…
If your package does not have neither git-log entry nor spec-changelog entry mentioning SPDX and you know your license
tag matches SPDX formula, you can put your package on ignore list
https://pagure.io/copr/license-validate/blob/main/f/ignore-packages.txt
Either pull-request or direct email to me is fine.
Miroslav
Hi,
why LicenseRef-Callaway-CC-BY-SA, LicenseRef-Callaway-BSD ,
LicenseRef-Callaway-MIT , LicenseRef-Callaway-OFL are not valid for
license-validate command anh what is need to validate
marker ( https://bugzilla.redhat.com/show_bug.cgi?id=2362370#c2 ) ?
Thank you
--
Sérgio M. B.
Fedora has a code of conduct which begins:
"In the interest of fostering an open and welcoming environment, we as the Fedora community pledge to collaborate in a respectful and constructive manner, and welcome everyone willing to join us in that pledge. We welcome individuals regardless of ability, age, background, body size, education, ethnicity, family status, gender identity and expression, geographic location, level of experience, marital status, nationality, national origin, native language, personal appearance, race and/or ethnicity, religion, sexual identity and orientation, socioeconomic status, or any other dimension of diversity."
However, Fedora is also sponsored by companies domiciled in the USA:
https://docs.fedoraproject.org/en-US/legal/export/
If these policies should be in conflict, which one supersedes the other?
Portions of GCC are distributed under the following license:
====================================================
Copyright (C) 1993 by Sun Microsystems, Inc. All rights reserved.
Developed at SunPro, a Sun Microsystems, Inc. business.
Permission to use, copy, modify, and distribute this
software is freely granted, provided that this notice
is preserved.
====================================================
However, this notice does not seem to exist anywhere in binary distributions. I suspect the *intent* was similar to a BSD-style license, and my impression is that corporate lawyers tend to argue for that interpretation; i.e. "preserved" means that the notice is present somewhere in derivative works. Upstream, however, seems to feel that the notice is "preserved" because it hasn't been removed from the source file, i.e. it is *not* necessary to include the notice in binary distributions or other derived works.
If I ship compiled code which includes code under the above license, what are my obligations? Do I need to include the above notice? Can I omit it entirely? Something else?
(See also https://bugzilla.redhat.com/show_bug.cgi?id=2353932.)
Dear legal list,
I just filed
https://gitlab.com/fedora/legal/fedora-license-data/-/issues/640
requesting review request for 7zip's license.
TL;DR - this is blocking the review of 7zip, which we want to have as a
replacement for p7zip which is dead upstream (and is needed by e.g. the
Fedora Asahi Remix)
The specific worry is
- the language dedicating this to the public domain is very spartan
(all of them are one-liners, see the issue)
- some of these are done by other people and not the main project
author, with no reference to where the sources are obtained from
Related question: as I understand it public domain dedications have to
be vetted before use, but where is this requirement documented? e.g.
https://docs.fedoraproject.org/en-US/legal/license-approval/#_overview
does not specifically mention a special process for LicenseRef-Fedora-
Public-Domain.
Thanks,
--
_o) Michel Lind
_( ) identities:
https://keyoxide.org/5dce2e7e9c3b1cffd335c1d78b229d2f7ccc04f2
README: https://fedoraproject.org/wiki/User:Salimma#README
---------- Forwarded message ---------
From: Dario Presutti <dario(a)fsfe.org>
Date: Thu, Mar 13, 2025 at 11:06 AM
Subject: Invitation from FSFE to Online Q&A Session about DMA & Free Software
To: <rfontana(a)redhat.com>
Cc: Lucas Lasota <lucas.lasota(a)fsfe.org>
Dear Richard,
I hope this email finds you well.
My name is Dario, and I am a project manager at the Free Software
Foundation Europe (FSFE).
I received your contact from Matthias Kirschner - pleased to e-meet you!
I am reaching out because my colleague Lucas (CC’d) and I are actively
working
on the implementation of the Digital Markets Act (DMA) and its
implications for
Free Software. Recently, we have received many questions from other Free
Software
organisations regarding this topic. To address these, at the FSFE, we
have decided
to host an online Q&A session specifically for representatives of FOSS
organisations,
We would be delighted if you could participate. We would also
appreciated if you
could post this invitation to the Fedora Legal Mailing List
(https://docs.fedoraproject.org/en-US/legal/)
because we think this might be of interest. Below, you’ll find key
details about
the event. Thank you in advance!
---
# Online Q&A session – DMA & Free Software: what Free Software
organisations need to know
Date: 24 March 2025
Time: 17:30 CET
Location: Online (FSFE’s instance)
Registration required:
https://share.fsfe.org/apps/forms/s/riaMwgdMcgTnpHTTX3g92bkk
As you may already know, the DMA is a landmark regulation by the
European Union,
designed to limit the power of large technology companies acting as
“gatekeepers”
and to foster fairer competition. Among its key provisions, the DMA
establishes
obligations for these dominant platforms, including the right to install
and
uninstall software freely, access to third-party app stores, and enhanced
interoperability measures. These provisions have the potential to create
new
opportunities for Free Software development, distribution, and adoption.
This session will provide Free Software organisation representatives
the opportunity to:
- Gain a deeper understanding of how the DMA’s enforcement impacts
the Free
Software ecosystem and the FSFE’s role in this process
- Learn about FSFE’s legal efforts, including its ongoing litigation
against
Apple at the Court of Justice of the European Union. (If you
attended FOSDEM,
you may have seen FSFE Legal Programme Manager Lucas Lasota’s
keynote on this topic [1])
- Engage directly with the FSFE team working on these issues.
Event page: https://fsfe.org/news/2025/news-20250306-01.en.html
----
If you have any questions or need further information, please don’t
hesitate to reach out!
Thank you again.
Best regards,
Dario
[1]
https://fosdem.org/2025/schedule/event/fosdem-2025-5084-how-we-are-defendin…
--
Dario Presutti (he/him/none) | Project Manager
Free Software Foundation Europe e.V.
Schönhauser Allee 6/7, 10119 Berlin, Germany
Matrix: @dario:fsfe.org | Email: dario(a)fsfe.org
-------- Přeposlaná zpráva --------
Hot news:
- the review of licenses in queue has been stalled for several weeks
Two weeks ago we had:
> * 24347spec files in Fedora
>
> * 30986license tags in all spec files
>
> * 127 tags are not SPDX compliant (number from line bellow minus packages with LicenseRef-Callaway-*)
>
> * 2246tags have not been converted to SPDX yet
>
> * 15 tags can be trivially converted using `license-fedora2spdx`
>
> * Progress: 99.48% ░░░░░░░░░█100%
>
> ELN subset:
>
> 57 out of 2317 packages are not converted yet (progress 97.54%)
>
Today we have:
* 24379 spec files in Fedora
* 31024license tags in all spec files
* 123 tags are not SPDX compliant (number from line bellow minus packages with LicenseRef-Callaway-*)
* 2220tags have not been converted to SPDX yet
* 16 tags can be trivially converted using `license-fedora2spdx`
* Progress: 99.60% ░░░░░░░░░█100%
ELN subset:
57 out of 2316 packages are not converted yet (progress 97.54%)
Graph of these data with the burndown chart:
https://docs.google.com/spreadsheets/d/1QVMEzXWML-6_Mrlln02axFAaRKCQ8zE807r…
The list of packages needed to be converted is here:
https://pagure.io/copr/license-validate/blob/main/f/packages-without-spdx-f…
List by package maintainers is here
https://pagure.io/copr/license-validate/blob/main/f/packages-without-spdx-f…
Packages that are neither in SPDX nor in Callaway format (highest priority for now) - 35 packages:
https://pagure.io/copr/license-validate/blob/main/f/neither-nor-remaining-p…
Most of such packages has open issue in fedora-license-data. A lot of them are waiting for SPDX to approved the license
and assign ID.
I released new version of fedora-license-data with one new license.
11 licenses are waiting to be reviewed by SPDX.org (and then to be added to fedora-license-data)
https://gitlab.com/fedora/legal/fedora-license-data/-/issues/?label_name%5B…
If your package does not have neither git-log entry nor spec-changelog entry mentioning SPDX and you know your license
tag matches SPDX formula, you can put your package on ignore list
https://pagure.io/copr/license-validate/blob/main/f/ignore-packages.txt
Either pull-request or direct email to me is fine.
Miroslav
I have some pieces of software which I always intended to release to the
public domain. I understand that it not possible in all jurisdictions,
so in the past I would allow CC0 in this case and used the following
license statement:
# Originally written by Jason Tibbitts <j(a)tib.bs> in 2016.
# Donated to the public domain. If you require a statement of license, please
# consider this work to be licensed as "CC0 Universal", any version you choose.
Now, if course Fedora decided a couple of years ago that we can't use
CC0 for code. Is there a Fedora-approved method for disclaiming
copyright? I would like to do this the right way (in part because this
software is used by Fedora and I would like to package it for Fedora),
but it seems contradictory to use something like MIT-0 because the first
line is literally "Copyright <YEAR> <COPYRIGHT HOLDER>". Does 0BSD
work? That's at https://opensource.org/license/0bsd
-------- Přeposlaná zpráva --------
Předmět: SPDX Statistics - 127 packages remaining
Datum: Fri, 7 Feb 2025 06:42:03 +0100
Od: Miroslav Suchý <msuchy(a)redhat.com>
Společnost: Red Hat Czech, s.r.o.
Komu: Development discussions related to Fedora <devel(a)lists.fedoraproject.org>
Hot news:
- the review of licenses in queue has been stalled for several weeks
Two weeks ago we had:
> * 24401spec files in Fedora
>
> * 31038license tags in all spec files
>
> * 142 tags are not SPDX compliant (number from line bellow minus packages with LicenseRef-Callaway-*)
>
> * 2289 tags have not been converted to SPDX yet
>
> * 16 tags can be trivially converted using `license-fedora2spdx`
>
> * Progress: 99.48% ░░░░░░░░░█100%
>
> ELN subset:
>
> 61 out of 2316 packages are not converted yet (progress 97.41%)
>
Today we have:
* 24347spec files in Fedora
* 30986license tags in all spec files
* 127 tags are not SPDX compliant (number from line bellow minus packages with LicenseRef-Callaway-*)
* 2246tags have not been converted to SPDX yet
* 15 tags can be trivially converted using `license-fedora2spdx`
* Progress: 99.48% ░░░░░░░░░█100%
ELN subset:
57 out of 2317 packages are not converted yet (progress 97.54%)
Graph of these data with the burndown chart:
https://docs.google.com/spreadsheets/d/1QVMEzXWML-6_Mrlln02axFAaRKCQ8zE807r…
The list of packages needed to be converted is here:
https://pagure.io/copr/license-validate/blob/main/f/packages-without-spdx-f…
List by package maintainers is here
https://pagure.io/copr/license-validate/blob/main/f/packages-without-spdx-f…
Packages that are neither in SPDX nor in Callaway format (highest priority for now) - 35 packages:
https://pagure.io/copr/license-validate/blob/main/f/neither-nor-remaining-p…
Most of such packages has open issue in fedora-license-data. A lot of them are waiting for SPDX to approved the license
and assign ID.
There was no release of fedora-license-data.
12 licenses are waiting to be reviewed by SPDX.org (and then to be added to fedora-license-data)
https://gitlab.com/fedora/legal/fedora-license-data/-/issues/?label_name%5B…
If your package does not have neither git-log entry nor spec-changelog entry mentioning SPDX and you know your license
tag matches SPDX formula, you can put your package on ignore list
https://pagure.io/copr/license-validate/blob/main/f/ignore-packages.txt
Either pull-request or direct email to me is fine.
Miroslav