Return-Path: Delivered-To: apmail-apr-dev-archive@www.apache.org Received: (qmail 51086 invoked from network); 10 Sep 2008 08:26:23 -0000 Received: from hermes.apache.org (HELO mail.apache.org) (140.211.11.2) by minotaur.apache.org with SMTP; 10 Sep 2008 08:26:23 -0000 Received: (qmail 80554 invoked by uid 500); 10 Sep 2008 08:26:20 -0000 Delivered-To: apmail-apr-dev-archive@apr.apache.org Received: (qmail 79679 invoked by uid 500); 10 Sep 2008 08:26:15 -0000 Mailing-List: contact dev-help@apr.apache.org; run by ezmlm Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Id: Delivered-To: mailing list dev@apr.apache.org Received: (qmail 79656 invoked by uid 99); 10 Sep 2008 08:26:15 -0000 Received: from athena.apache.org (HELO athena.apache.org) (140.211.11.136) by apache.org (qpsmtpd/0.29) with ESMTP; Wed, 10 Sep 2008 01:26:15 -0700 X-ASF-Spam-Status: No, hits=-0.0 required=10.0 tests=SPF_HELO_PASS,SPF_PASS X-Spam-Check-By: apache.org Received-SPF: pass (athena.apache.org: domain of jorton@redhat.com designates 66.187.237.31 as permitted sender) Received: from [66.187.237.31] (HELO mx2.redhat.com) (66.187.237.31) by apache.org (qpsmtpd/0.29) with ESMTP; Wed, 10 Sep 2008 08:25:12 +0000 Received: from int-mx2.corp.redhat.com (int-mx2.corp.redhat.com [172.16.27.26]) by mx2.redhat.com (8.13.8/8.13.8) with ESMTP id m8A8OawQ023672; Wed, 10 Sep 2008 04:24:56 -0400 Received: from ns3.rdu.redhat.com (ns3.rdu.redhat.com [10.11.255.199]) by int-mx2.corp.redhat.com (8.13.1/8.13.1) with ESMTP id m8A8OPMV021698; Wed, 10 Sep 2008 04:24:25 -0400 Received: from turnip.manyfish.co.uk (vpn-12-44.rdu.redhat.com [10.11.12.44]) by ns3.rdu.redhat.com (8.13.8/8.13.8) with ESMTP id m8A8ON64001042; Wed, 10 Sep 2008 04:24:24 -0400 Received: from jorton by turnip.manyfish.co.uk with local (Exim 4.69) (envelope-from ) id 1KdKzv-0001XX-Dl; Wed, 10 Sep 2008 09:24:23 +0100 Date: Wed, 10 Sep 2008 09:24:23 +0100 From: Joe Orton To: "Tom O'Brien" Cc: dev@apr.apache.org, legal-discuss@apache.org Subject: Re: apr-util removal of md4/md5 algorithms (legal issue) Message-ID: <20080910082423.GA5808@redhat.com> Mail-Followup-To: Tom O'Brien , dev@apr.apache.org, legal-discuss@apache.org References: <355683585f.3585f35568@ncf.ca> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline In-Reply-To: <355683585f.3585f35568@ncf.ca> User-Agent: Mutt/1.5.18 (2008-05-17) Organization: Red Hat UK Ltd, Amberley Place, 107-111 Peascod Street, Windsor, Berkshire, SL4 1TE, United Kingdom. Registered in UK and Wales under Company Registration No. 03798903 Directors: Michael Cunningham (USA), Brendan Lane (Ireland), Matt Parson (USA), Charlie Peters (USA) X-Scanned-By: MIMEDefang 2.58 on 172.16.27.26 X-Virus-Checked: Checked by ClamAV on apache.org On Mon, Sep 08, 2008 at 01:24:58PM -0400, Tom O'Brien wrote: > Hi all: > I'm using the Log4Cxx logging library in a project, and it uses apr and > apr-util as part of the implementation. In reviewing the license to > apr-util, I noticed it contained a reference to the RSA reference > implementation to md4 and md5. The lawyers here got a look at the > license, and were not amused (no specific right to redistribute). I saw > that the Debian team had raised a similar issue in the mailing list archive. I just noticed that this issue is covered in the Fedora licensing FAQ: http://fedoraproject.org/wiki/Licensing/FAQ which references this statement from RSA: http://www.ietf.org/ietf/IPR/RSA-MD-all [plain text sent as text/html, oops] the Fedora FAQ says that based on this, we can simply strip the restrictive licensing statements from the MD4/MD5 implementation, retaining the RSA copyright notice alone. Can legal-discuss@ confirm whether this is an acceptable course of action? Regards, Joe