legal

legal@lists.fedoraproject.org

8 participants
1435 discussions

JS port of CPython's argparse — PSF-2.0 instead of Python-2.0.1?
by Vitaly 18 Aug '26

18 Aug '26

Hi, https://github.com/nodeca/argparse is a JavaScript port of CPython's Lib/argparse.py. It carries CPython's full license stack, which a Fedora packager ran into: https://github.com/nodeca/argparse/pull/188 argparse was added to CPython in 2010 under the PSF Contributor Agreement, so none of the ported code comes from the CWI, CNRI or BeOpen eras. Can the port be licensed as PSF-2.0 alone, or does CPython-derived code have to carry the whole stack? Thanks, Vitaly Puzrin

2 1

Copr hosting question: package that downloads NVIDIA CUDA toolkit
by Pavel Raiskup 14 Aug '26

14 Aug '26

Dear legal team, we received a report regarding the Copr project lecris/cuda-example (https://copr.fedorainfracloud.org/coprs/lecris/cuda-example/) The reporter states that the package downloads and includes the NVIDIA CUDA toolkit during the build process). The CUDA toolkit is not free/open-source software. The maintainer, Cristian, is in CC (please correct this statement if it's not truth). Per the Copr usage policy (https://docs.pagure.org/copr.copr/user_documentation.html#what-i-can-build-…) material built in Copr must be governed by a license contained in the list of acceptable licenses for Fedora (https://docs.fedoraproject.org/en-US/legal/allowed-licenses/) We would like your guidance on whether packages that download and bundle proprietary NVIDIA CUDA components fall within or outside this policy. Specifically: - Is hosting such packages in Copr acceptable under the current legal guidelines? - If not, would there be conditions under which it could become acceptable? The maintainer of the project has also expressed willingness to reach out to NVIDIA directly to clarify redistribution terms, should that be helpful for your assessment. Thank you for your time. Best regards, Pavel Raiskup Copr Team

6 10

foo2zjs printer driver: download of HP printer firmware
by ValdikSS 29 Jul '26

29 Jul '26

Hi list, foo2zjs open-source printer driver provides support for many old (2004-2012 era) printers, including selected HP LaserJet models. These printers require the firmware which needs to be uploaded to the printer on every power on. Firmware files are not bundled in foo2zjs. The upstream includes the script called `getweb` which downloads the firmware files from third-party websites and unpacks them. `getweb` is not packaged in Fedora's foo2zjs, which makes HP LaserJets unable to print. Other source of the firmware files are proprietary hp-plugin packages which are downloaded by `hplip` package. I've changed the script (`getweb-hpplugin`) to download hp-plugin bundles and use files from there. hp-plugin downloads is packaged in Fedora's hplip package. The questions are: - Can Fedora include `getweb`, which downloads the firmware files from elsewhere? - If not, can Fedora include `getweb-hpplugin`, which downloads HP plugin files from official openprinting website and extracts firmware from these, as does HP's hplip? - If none could be done, what else could and should be done? Here's the license.txt found inside hp-plugin: https://gist.githubusercontent.com/ValdikSS/ba01bda36f73e85858fd9899773f18c… Package: https://packages.fedoraproject.org/pkgs/foo2zjs/foo2zjs/ Discussion with xvitaly about this issue: https://src.fedoraproject.org/rpms/foo2zjs/pull-request/2#comment-327537

3 6

What to do when upstream has "All rights reserved"?
by Cristian Le 28 Jul '26

28 Jul '26

I just got hit by another project that is over-eager to add the "All rights reserved" snippet on a FOSS license. I have opened an issue with upstream [1], but I guess we do not actually have a documented guidance or reference to point upstream to? The big thing that spurred me into opening the issues is that that snippet is included in the BSD-3-Clause license text itself, which seems very at odds with the text of the license. What is even more concerning is that when I put it into an spdx license check [2] it says it is a "perfect match" for BSD-3-Clause [1]: https://github.com/hfp/libxs/issues/24 [2]: https://tools.spdx.org/app/check_license/

4 4

License text files in packages
by Mattia Verga 26 Jul '26

26 Jul '26

This is perhaps a silly question... am I right when I say that license text files distributed in packages should reflect just the code used in the final binary (like the License: tag)? My question comes from a ticket [1] I raised against Rawtherapee upstream. As I recently noticed, in the upcoming next version Rawtherapee started to install license files for several things: code used in the project, code optionally used in the final output (such as bundled libraries that we don't use in Fedora as we use system's libraries), but also external libraries which Rawtherapee links to and doesn't bundle at all (I see, for example, gtkmm license text file). If upstream doesn't fix that before the final 5.13 release, I plan to manually remove license that doesn't pertain to Fedora distributed binaries. Is that right? Thanks, Mattia [1] https://github.com/RawTherapee/RawTherapee/issues/7718

2 3

SDL_mixer's bundled timidity
by Artur Frenszek-Iwicki 03 Jun '26

03 Jun '26

Hey all, I'm currently working on getting SDL3_mixer into Fedora. [0] While doing the packaging work, I noticed that SDL_mixer bundles timidity for MIDI playback. [1] The README file attached to the sources says: > If you'd like to continue hacking on TiMidity, feel free. I'm > hereby extending the TiMidity license agreement: you can now > select the most convenient license for your needs from (1) the > GNU GPL, (2) the GNU LGPL, or (3) the Perl Artistic License. This statement is unfortunately a bit ambiguous, since it does not mention which versions of the licences the author had in mind, and the only license text attached is the Perl/Artistic one. Digging through git history, one can see that the bundled code dates all the way back to the initial git commit, hence at least to 1999, i.e. before GPLv3 and LGPLv3 were published (2007). One can also find commits directly mentioning GPLv2 or later. [2] Getting to the point - can we assume (L)GPLv2 here? This would make the applicable license tag be: "GPL-2.0-or-later OR LGPL-2.0-or-later OR Artistic-1.0-Perl" Which, looking at the allowed license list, seems okay for inclusion in Fedora. For extra context, the older SDL_mixer packages (SDL_mixer, SDL2_mixer) do not make note of timidity's license in any way. While SDL2_mixer has "Provides: bundled(timidity)", SDL_mixer doesn't even do that. Thanks in advance, Artur FI [0] https://bugzilla.redhat.com/show_bug.cgi?id=2454358 [1] https://github.com/libsdl-org/SDL_mixer/tree/release-3.2.4/src/timidity [2] https://github.com/libsdl-org/SDL_mixer/commit/db1013fd0aeb884fcae21480a75d…

3 2

BSD-3-Clause vs CMU
by sagitter＠fedoraproject.org 18 May '26

18 May '26

Hi all. Checking the license of next psblas3 release, `licensecheck` tool recognizes this license file [1] as CMU Upstream confirmed that psblas3 is distributed under a BSD-3-Clause instead [2]. Why does it look like `licensecheck` is confused with this license? [1] https://github.com/sfilippone/psblas3/blob/development/LICENSE [2] https://github.com/sfilippone/psblas3/issues/37 --- Antonio Trande Fedora Project, User:Sagitter Website: antoniotrande.blog mailto: sagitter(a)fedoraproject.org GPG key: 0x6ea362cc4c1aeac10b3a5c5402b0e70b4933065a GPG keys server: https://pgp.mit.edu/

8 14

Relicensing controversy in python-chardet
by Ben Beasley 28 Mar '26

28 Mar '26

The current upstream maintainer of python-chardet recently used the Claude Code LLM to completely rewrite the library for version 7.0.0[1]. The source code now has no obvious direct relationship with previous versions. The maintainer used the LLM-based rewrite as justification to unilaterally relicense the project from LGPL-2.1-or-later to MIT. This has prompted a debate about whether or not the maintainer truly has the right to do so, given their deep familiarity with the LGPL code and other considerations. The original author of the library feels that the relicensing was improper[2]. There is no great rush to make a decision about how to handle this particular situation. I can keep python-chardet at 6.0.0 in Fedora for quite a while. However, we in Fedora may end up having to make a decision sooner or later on what to do about cases like this. Even if the question can be somehow sidestepped for chardet, we can expect to be faced with an increasing number of similar situations. [1] https://github.com/chardet/chardet/pull/322 [2] https://github.com/chardet/chardet/issues/327

3 5

License of XSD package
by sagitter＠fedoraproject.org 23 Mar '26

23 Mar '26

Hi all. Please, help me to correctly recognize the license of XSD package [¹] I have attached the files provided by source archive. It looks like a "GPL-2.0-only WITH Universal-FOSS-exception-1.0" [¹] https://src.fedoraproject.org/rpms/xsd --- Antonio Trande Fedora Project, User:Sagitter Website: antoniotrande.blog mailto: sagitter(a)fedoraproject.org GPG key: 0x6ea362cc4c1aeac10b3a5c5402b0e70b4933065a GPG keys server: https://pgp.mit.edu/

2 1

Software origin
by Benson Muite 19 Mar '26

19 Mar '26

Hi, Is it possible to get clarfication whether software of any origin under a license approved to be included in Fedora can be included in Fedora? It applies in particular to: https://bugzilla.redhat.com/show_bug.cgi?id=2425235 See also https://forge.fedoraproject.org/council/tickets/issues/528 Regards, Benson

2 1

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

legal