Re: [PATCH 0/4] faster SHA-1 collision detection

From: D. Ben Knoble <ben.knoble@gmail.com>
Date: Oct 10, 2026, 14:10 UTC
Message-ID: <CALnO6CAEcjieW48DkA9Pt1eqZ5hctwihmTXMxZ29YBrmzrp1QA@mail.gmail.com>
In-Reply-To: <20261009203749.x4V9kN18@teonanacatl.net>

On Fri, Oct 9, 2026 at 4:37 PM Todd Zullinger <tmz@pobox.com> wrote:

Show 15 quoted lines

>
> D. Ben Knoble wrote:
> > Interestingly, Gentoo claims Git's license is only GPL-2, but I think
> > they compile in the sha1dc code since it's the default in meson.
> > Should we be claiming the Git package (with sha1dc) is actually GPL-2
> > and MIT?
>
> I _think_ that that depends on whether Gentoo's license tag
> is meant to be the "effective" license they are distributing
> their Git package or attempting to encompass the license of
> all of the code which goes into the Git package.
>
> Fedora's Git package has:
>
>     BSD-3-Clause AND GPL-2.0-only AND GPL-2.0-or-later AND LGPL-2.1-or-later AND MIT

Oh, curious! Where are the (using Gentoo identifiers for the moment) BSD and LGPL-2.1+ sources? I guess I assume by looking at our COPYING that the GPL-2+ came from contributions that said they were willing to be 2+?

Show 14 quoted lines

> I think I was the last to touch that, in ef75bcd (update
> license data and convert to SPDX format, 2022-11-07).  I
> attempted to capture all of the licensing, but I most
> certainly could have missed some things.  And things may
> have changed since then too.
>
> Fedora's guidelines have a lengthy page on the License tag².
> It includes a 'No "effective license" analysis' section
> discussing this.
>
> I don't know if any of that helps. :)
>
> ¹ https://src.fedoraproject.org/rpms/git/c/ef75bcd
> ² https://docs.fedoraproject.org/en-US/legal/license-field/

From Gentoo's packaging guide [1], I think we might want to list all the license, except it really does depend on the license of the (installed) *output* files. We build from source but don't install the source, so maybe Junio's cousin reply that indicates the built product is covered under GPL-2 is sufficient ;)

[1]: https://devmanual.gentoo.org/general-concepts/licenses/index.html#determining-the-correct-license

In the case of other packages [2], it seems we try to handle multi-license cases, but I think there (it's been a while since that particular linked PR stalled) we might be installed both a shared library under one license and a binary under another.

[2]: https://codeberg.org/gentoo/gentoo/pulls/1340#issuecomment-18812828

Anyway, thanks all! I'll assume the Gentoo maintainers knew what they were doing :)

-- 
D. Ben Knoble