legal January 2022

legal@lists.fedoraproject.org

15 participants
7 discussions

FIGlet fonts
by Lyes Saadi 25 Jul '22

25 Jul '22

Hello Legal, I'm bringing back a discussion from 2012[1]: Figlet fonts! Indeed, I am trying to package python-pyfiglet[2] as a dependency for other packages. But, after the review, it came up that a lot of weird fonts were included. At the time, I didn't know anything about the discussion, and decided to abort everything. Recently though, a developer contacted me through the bug report, and proposed to help on the issue. He triaged the fonts and separated them depending on whether they were Open-Source or not, and we were thus able to create a clean package with none of the problematic fonts in it. In that discussion[3], emerged the fact that a discussion over this already happened ([1]), but it seems that either no consensus was reached, or that such consensus was lost to time as I wasn't able to find any conversation on figlet either on legal or devel mailing lists archives. And, it seems that the issue was just simply avoided since figlet ended up removing the problematic fonts anyway. But, upstream would like to keep the problematic fonts if possible in Fedora. And so, I would like to ask Legal to either give me the answer, if it actually was a settled matter, or to reach a consensus on Figlet fonts. To resume the situation (as I understand it, I am not a lawyer, obviously): In the US, fonts glyphs are not copyright-able as it is considered insufficiently creative. For the same reason, Bitmap fonts (fonts defined pixel by pixel) are also not copyright-able, as they are only considered as data which represents glyphs. But, Vector fonts (fonts defined using drawing instructions and code), is, on the other hand, copyright-able because it is defined through a software code. Then, we come to Figlet fonts. For those not aware of what Figlet fonts, they are also known as ASCII fonts: __ __ ____ __ ____ / / / /__ / / /___ / / ___ ____ _____ _/ / / / /_/ / _ \/ / / __ \ / / / _ \/ __ `/ __ `/ / / / __ / __/ / / /_/ / / /___/ __/ /_/ / /_/ / /_/ /_/ /_/\___/_/_/\____( ) /_____/\___/\__, /\__,_/_(_) |/ /____/ The issue with those is that no ruling (as far as I know) ever concerned that type of font in US Court. Though, one argument would be that Figlet fonts are similar to Bitmap fonts, as they only contain data about glyphs, and do not, in the same way as Vector fonts do, contain code giving to the computer drawing instructions for the fonts. As such Figlet fonts are not modular, or extensible, they just contain raw data about a font. But still, all this is speculation, and, as I said, I am not a lawyer, so I don't have any slight idea if such a defense would hold in court. I hope to have resumed the situation clearly enough and that I didn't make any mistake. Greetings, Lyes Saadi [1]: https://bugzilla.redhat.com/show_bug.cgi?id=820642 [2]: https://bugzilla.redhat.com/show_bug.cgi?id=1876108 [3]: https://github.com/pwaller/pyfiglet/issues/89 PS: Can we remove the FE-legal blocker from the review request now that all the fonts have been sorted out?

4 8

Brainpool Curves in Fedora (openssl, libgcrypt, gnupg)
by Timothée Ravier 06 Apr '22

06 Apr '22

Hi everyone, The ECC Brainpool Curves [1][2] are currently not available in Fedora as according to this BZ [3], this needs Fedora Legal approval. Could someone from the legal team take a look to see if there are any blockers regarding Brainpool Curves inclusion in Fedora? Thanks! [1] https://en.wikipedia.org/wiki/Elliptic-curve_cryptography#Implementation [2] https://tools.ietf.org/html/rfc5639 [3] https://bugzilla.redhat.com/show_bug.cgi?id=1413618

9 21

concerning who can change code licence
by Germano Massullo 02 Feb '22

02 Feb '22

Italian identity card middleware for Linux cannot be packaged for Fedora because a developer assigned an "all rights reserved" licence to his code. In the ticket [1] where I raised this problem, some developers of the project said that they will investigate to find out if the lines of code of the "wrong" license maybe erased. My personal opinion is that only THE author must be the one allowed to change the licence of his own code, not another person. Is that correct? Best regards [1]: https://github.com/italia/cie-middleware-linux/issues/16

6 5

Boolean logic in license
by Miroslav Suchý 19 Jan '22

19 Jan '22

I want to clarify one thing I am working on. When I have this string in License tag in spec: Good License or Bad license Then the result is Good license and the package is allowed to be in Fedora, right? Miroslav

8 34

SPDX identifiers
by Miroslav Suchý 17 Jan '22

17 Jan '22

Mathew and Richard several times in past days mentioned intention to migrate to SPDX identifiers in Fedora. Is somebody actually working on this? Is there some ETA? Or is it just "intention". Miroslav

5 5

Re: List of packages with problematic license
by Matthew Miller 05 Jan '22

05 Jan '22

On Mon, Jan 03, 2022 at 01:26:33PM +0100, Miroslav Suchý wrote: > The License tag was never formally defined. If we agree that there can be > anything, then let it be. The Pending PR here updates that to: SPDX License identifier or expression (from our "Good" list). https://pagure.io/packaging-committee/pull-request/1142#_1__38 Although given the context here, I note that that's ambiguous about whether the _whole expression_ must be on the list — I don't think that's the intention! [CC'ing this to the legal list, btw.] -- Matthew Miller <mattdm(a)fedoraproject.org> Fedora Project Leader

4 3

Fedora license categories
by Richard Fontana 05 Jan '22

05 Jan '22

A bunch of us are looking into various possible changes in how the information on Fedora good/bad licenses is maintained, reviewed, classified and represented. One aspect of this is the likely effective replacement of such wiki pages as https://fedoraproject.org/wiki/Licensing:Main with a repository (such as https://pagure.io/fedora-legal/license-data). Among other things this has prompted a review of how licenses are currently categorized by Fedora. In particular, Fedora has separate lists of good and bad licenses for content https://fedoraproject.org/wiki/Licensing:Main#Good_Licenses_3 https://fedoraproject.org/wiki/Licensing:Main#Bad_Licenses_3 and for documentation https://fedoraproject.org/wiki/Licensing:Main#Good_Licenses_2 https://fedoraproject.org/wiki/Licensing:Main#Bad_Licenses_2 A question that has arisen is whether we actually need to treat documentation and content as separate categories. "Content" (and documentation, software, fonts, etc.) are not defined in that wiki page as far as I can tell. (FWIW the FPCA defines "Content" in a way that includes documentation: "any copyrightable material that is not Code, such as, without limitation, (i) non-functional data sets, (ii) documentation, (iii) wiki edits, (iv) music files, (v) graphic image files, (vi) help files, and (vii) other kinds of copyrightable material that the Fedora Council has classified as "content" rather than "code".") There is some overlap in the content and documentation license lists and the other lists as well -- for example, CC-BY is given as a good documentation license and a good content license. I think the answer is "yes", because of this policy: "Note that content must be freely distributable without restriction for inclusion in Fedora, and that a written statement from the content owner granting this is considered an approved license for Fedora. The one exception is that we permit content (but only content) which restricts modification as long as that is the only restriction." And indeed the content license lists includes a few non-libre licenses including at least one well known one that does not permit derivative works -- CC BY-ND. I'm assuming that Fedora would not allow documentation under a non-libre license, if only because there isn't a similar caveat in the documentation license section and all the good documentation licenses appear to be assumed to be libre. I think there may be some arguable counterexamples that might be explained away as covering things that are non-documentation content as opposed to documentation. I also am pretty sure that Fedora has not attempted to officially list all the approved non-libre licenses for "content" but I'm not sure if this is something intentional. (The categorical example that comes to mind is the inclusion of certain kinds of files from standards documents, such as schemas and the like.) Separately, I wonder if Fedora really needs separate categories for software and documentation, if the criteria for approval are basically the same -- essentially, whether the license is libre (by Fedora's own assessment) -- except that documentation licenses are seen as normally unsuitable for software. It is clear (to me at least) that any good Fedora software license should be good for documentation as well, if only because in practice documentation in packages is often covered by the software license -- indeed, this is probably much more common than cases where a special documentation license is used. Anyway, I was just wondering if anyone had any thoughts or comments on this. Richard

5 6

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

legal January 2022