Re: [PATCH 0/4] faster SHA-1 collision detection

From: Todd Zullinger <tmz@pobox.com>
Date: Oct 9, 2026, 20:37 UTC
Message-ID: <20261009203749.x4V9kN18@teonanacatl.net>
In-Reply-To: <CALnO6CBbtKomawqc81MPV5Ngtc9J3M1ej4enGD3ZUzWnPSfsgw@mail.gmail.com>

D. Ben Knoble wrote:

> Interestingly, Gentoo claims Git's license is only GPL-2, but I think
> they compile in the sha1dc code since it's the default in meson.
> Should we be claiming the Git package (with sha1dc) is actually GPL-2
> and MIT?

I _think_ that that depends on whether Gentoo's license tag is meant to be the "effective" license they are distributing their Git package or attempting to encompass the license of all of the code which goes into the Git package.

Fedora's Git package has:

    BSD-3-Clause AND GPL-2.0-only AND GPL-2.0-or-later AND LGPL-2.1-or-later AND MIT

I think I was the last to touch that, in ef75bcd (update license data and convert to SPDX format, 2022-11-07). I attempted to capture all of the licensing, but I most certainly could have missed some things. And things may have changed since then too.

Fedora's guidelines have a lengthy page on the License tagï¿½. It includes a 'No "effective license" analysis' section discussing this.

I don't know if any of that helps. :)

ï¿½ https://src.fedoraproject.org/rpms/git/c/ef75bcd ï¿½ https://docs.fedoraproject.org/en-US/legal/license-field/

-- 
Todd