Re: [PATCH 0/4] faster SHA-1 collision detection

From: Todd Zullinger <tmz@pobox.com>
Date: Oct 10, 2026, 15:37 UTC
Message-ID: <20261010153721.943RqWnW@teonanacatl.net>
In-Reply-To: <CALnO6CAEcjieW48DkA9Pt1eqZ5hctwihmTXMxZ29YBrmzrp1QA@mail.gmail.com>

D. Ben Knoble wrote:

Show 9 quoted lines

> On Fri, Oct 9, 2026 at 4:37 PM Todd Zullinger <tmz@pobox.com> wrote:
>> Fedora's Git package has:
>>
>>     BSD-3-Clause AND GPL-2.0-only AND GPL-2.0-or-later AND LGPL-2.1-or-later AND MIT
> 
> Oh, curious! Where are the (using Gentoo identifiers for the moment)
> BSD and LGPL-2.1+ sources? I guess I assume by looking at our COPYING
> that the GPL-2+ came from contributions that said they were willing to
> be 2+?

There are various bits of code imported that are under difference licenses, among other things. The code in reftable/ is BSD-3-Clause (using the SPDX naming), for example, while xdiff/xhistogram.c is BSD-3-Clause and/or EDL-1.0 while most of the rest of it is LGPL-2.1-or-later; ewah/ is GPL-2.0-or-later; compat/obstack.[ch] and compat/regex/ are also LGPL-2.1-or-later.

I used the perl licensecheck tool¹ to generate the initial list, then reviewed it and filtered out some bits from the test suite which are not shipped in the binary packages for Fedora.

The command to do that is (without the filtering of any code):

    find -type f -exec licensecheck --shortname-scheme spdx {} + |
    grep -v 'UNKNOWN$' | LANG=C sort >licensecheck

A more complete analysis would require reviewing all of the files which are UNKNOWN to ensure none have a copyright that licensecheck simply didn't find (or isn't in the file but can be found from the git history). I was a bit lazy and didn't do all of that work. :)

> Anyway, thanks all! I'll assume the Gentoo maintainers knew what they
> were doing :)

Yeah, I've found most distribution packagers try to be diligent about this. Though it can be a somewhat tedious tasks and can change if the distribution switches from expecting packages to list the "effective" license to some other method.

Fedora used to do (or allow) that license simplification, e.g.: boiling down our distributing Git to GPL-2-only, but clarified things a number of years ago to not do so. It ends up slightly easier to just enumerate all the licenses of the code which goes into the binary packages we ship.

¹ https://metacpan.org/release/App-Licensecheck

-- 
Todd