On Tue, 2008-12-09 at 23:03 +0100, Matthias Saou wrote:
> "TC" == Tom "spot" Callaway <Tom> writes:
TC> Given that it does not give permission for us to redistribute (the TC> cornerstone requirement for Content licenses), this license is not TC> acceptable for Fedora.
I guess I'm glad I looked before approving the package, but I have to wonder: Do the cacert folks actually want anyone to use their certificates? I mean, this prevents basically everyone from using them, because they can't come with the OS or the browser.
Personally, the more I read the document, the more I'm confused.
"You may NOT distribute certificates or root keys under this licence"... does this mean we can distribute under a different license?
Well, sortof. The wording here is strange because you can get a different license from the CA issuer. We can't just pick a license, but the CA issuer might be willing to give us a different one.
Would it be worth getting in contact with CAcert.org in order to try and have them allow us to redistribute the root certs under conditions which are acceptable to the Fedora Project?
Probably, yes. :)
~spot
On Tuesday 09 December 2008 23:17:07 Tom "spot" Callaway wrote:
On Tue, 2008-12-09 at 23:03 +0100, Matthias Saou wrote:
>> "TC" == Tom "spot" Callaway <Tom> writes:
TC> Given that it does not give permission for us to redistribute (the TC> cornerstone requirement for Content licenses), this license is not TC> acceptable for Fedora.
I guess I'm glad I looked before approving the package, but I have to wonder: Do the cacert folks actually want anyone to use their certificates? I mean, this prevents basically everyone from using them, because they can't come with the OS or the browser.
Personally, the more I read the document, the more I'm confused.
"You may NOT distribute certificates or root keys under this licence"... does this mean we can distribute under a different license?
Well, sortof. The wording here is strange because you can get a different license from the CA issuer. We can't just pick a license, but the CA issuer might be willing to give us a different one.
Would it be worth getting in contact with CAcert.org in order to try and have them allow us to redistribute the root certs under conditions which are acceptable to the Fedora Project?
Probably, yes. :)
Just thought I'd chime in on this CACert issue. We at openSUSE have the same problem with the CACert license and we are in contact with them about it. They don't seem to be sure about what to do and are open for suggestions, especially from distributors. They want to get their root certs into our distributions, but worry about possible implications of their private key being compromised.
I think it would make sense to coordinate our efforts here - openSUSE and Fedora want to distribute the CaCert.org root certs and we are both unhappy with the current terms of distribution.
@spot - if you like, I'll forward you our correspondence with the cacert people thus far.
Ciaran
On Wed, 2008-12-10 at 10:20 +0100, Ciaran Farrell wrote:
I think it would make sense to coordinate our efforts here - openSUSE and Fedora want to distribute the CaCert.org root certs and we are both unhappy with the current terms of distribution.
So, given that Fedora has two classes of licensing (Code and Content) and that these CaCert.org root certs would safely fall into the Content category, we really only need permission to copy and redistribute the root certs without restriction. We don't need the right to modify them.
I'm not sure how their private keys come into this, are they distributing them for some odd reason?
@spot - if you like, I'll forward you our correspondence with the cacert people thus far.
Sure, thanks!
~spot
On Wednesday 10 December 2008 15:56:02 Tom "spot" Callaway wrote:
On Wed, 2008-12-10 at 10:20 +0100, Ciaran Farrell wrote:
I think it would make sense to coordinate our efforts here - openSUSE and Fedora want to distribute the CaCert.org root certs and we are both unhappy with the current terms of distribution.
So, given that Fedora has two classes of licensing (Code and Content) and that these CaCert.org root certs would safely fall into the Content category, we really only need permission to copy and redistribute the root certs without restriction. We don't need the right to modify them.
I'm not sure how their private keys come into this, are they distributing them for some odd reason?
Sorry, I should have been more clear about this. One of the discussion points was that the CaCert people were worried about liability if their private key were somehow to be compromised. They were therefore seeking to force end users to accept some type of disclaimer. To do this, they wanted distributors to write it directly into the EULA/SLA.
Ciaran
@spot - if you like, I'll forward you our correspondence with the cacert people thus far.
Sure, thanks!
~spot
On Wed, 2008-12-10 at 16:36 +0100, Ciaran Farrell wrote:
Sorry, I should have been more clear about this. One of the discussion points was that the CaCert people were worried about liability if their private key were somehow to be compromised. They were therefore seeking to force end users to accept some type of disclaimer. To do this, they wanted distributors to write it directly into the EULA/SLA.
Yuck. I'm not sure why they think they would have more liability if Fedora/openSUSE distribute their root certs than they would have if they only distributed them directly to end users. A traditional disclaimer of warranty should suffice in such scenarios.
~spot
I'm sorry to dig up an ancient thread. May somebody deliver a fresh opinion on this subject, considering that the CAcert Official Document (or "COD") 14, known as the 'CACert Root Distribution License' (or "RDL"), and referenced on the Fedora Licensing page [1], and in more details on [2], went from 10-Jul-2010 DRAFT [3] to 31-Jul-2014 POLICY [4], as well as also replaced by itself the now obsolete 'CAcert Non-Related Persons Disclaimer and License', see it mentioned on [1], again. It renders [1] and [2] slightly outdated.
Moreover, on 30-Oct-2011 to the Talk:[2] page referenced thereof, was added a detailed explanation of how CAcert works and how the CA business works; [and that the] conclusions [were] based on false assumption that the Root is Software.
[1] https://fedoraproject.org/wiki/Licensing [2] https://fedoraproject.org/wiki/Licensing/CACert_Root_Distribution_License Talk:[2] https://fedoraproject.org/wiki/Talk:Licensing/CACert_Root_Distribution_Licen... [3] http://svn.cacert.org/CAcert/Policies/Agreements/RootDistributionLicense.htm... [4] http://www.cacert.org/policy/RootDistributionLicense.html
Disclosure: I am a CAcert Certified Assurer. CAcert Inc now licenses its documents back again under open CC-by-sa+DRP license [*].
On Thu, 2016-02-11 at 16:10 +0000, Vasyl Khalak wrote:
I'm sorry to dig up an ancient thread. May somebody deliver a fresh opinion on this subject, considering that the CAcert Official Document (or "COD") 14, known as the 'CACert Root Distribution License' (or "RDL"), and referenced on the Fedora Licensing page [1], and in more details on [2], went from 10-Jul-2010 DRAFT [3] to 31-Jul -2014 POLICY [4], as well as also replaced by itself the now obsolete 'CAcert Non-Related Persons Disclaimer and License', see it mentioned on [1], again. It renders [1] and [2] slightly outdated.
The new licence¹ does seem to be an attempt at an improvement. But it does still contain the same problematic text, in the final paragraph of the disclaimer:
"THIS LICENSE SPECIFICALLY DOES NOT PERMIT YOU TO RELY UPON ANY CERTIFICATES ISSUED BY CACERT INC. IF YOU WISH TO RELY ON CERTIFICATES ISSUED BY CACERT INC, YOU MUST ENTER INTO A SEPARATE AGREEMENT WITH CACERT INC."
That part isn't really "disclaimer" at all. It almost looks like they just forgot to update or remove that wording when they were trying to turn it into a disclaimer. Or didn't get that part of the change past the committee, or whatever :)
It would be useful to *ask* CACert if that can be fixed. ISTR last time they just said "Wait. We don't want you shipping it yet anyway".
-
Ciaran Farrell -
David Woodhouse -
Tom Callaway -
Vasyl Khalak