From: D. Ben Knoble <ben.knoble@gmail.com>
Date: Sat, 10 Oct 2026 14:10:59 GMT
Subject: Re: [PATCH 0/4] faster SHA-1 collision detection
Message-ID: <CALnO6CAEcjieW48DkA9Pt1eqZ5hctwihmTXMxZ29YBrmzrp1QA@mail.gmail.com>
In-Reply-To: <20261009203749.x4V9kN18@teonanacatl.net>

On Fri, Oct 9, 2026 at 4:37 PM Todd Zullinger <tmz@pobox.com> wrote:
>
> D. Ben Knoble wrote:
> > Interestingly, Gentoo claims Git's license is only GPL-2, but I think
> > they compile in the sha1dc code since it's the default in meson.
> > Should we be claiming the Git package (with sha1dc) is actually GPL-2
> > and MIT?
>
> I _think_ that that depends on whether Gentoo's license tag
> is meant to be the "effective" license they are distributing
> their Git package or attempting to encompass the license of
> all of the code which goes into the Git package.
>
> Fedora's Git package has:
>
>     BSD-3-Clause AND GPL-2.0-only AND GPL-2.0-or-later AND LGPL-2.1-or-later AND MIT

Oh, curious! Where are the (using Gentoo identifiers for the moment)
BSD and LGPL-2.1+ sources? I guess I assume by looking at our COPYING
that the GPL-2+ came from contributions that said they were willing to
be 2+?

> I think I was the last to touch that, in ef75bcd (update
> license data and convert to SPDX format, 2022-11-07).  I
> attempted to capture all of the licensing, but I most
> certainly could have missed some things.  And things may
> have changed since then too.
>
> Fedora's guidelines have a lengthy page on the License tag².
> It includes a 'No "effective license" analysis' section
> discussing this.
>
> I don't know if any of that helps. :)
>
> ¹ https://src.fedoraproject.org/rpms/git/c/ef75bcd
> ² https://docs.fedoraproject.org/en-US/legal/license-field/

From Gentoo's packaging guide [1], I think we might want to list all
the license, except it really does depend on the license of the
(installed) *output* files. We build from source but don't install the
source, so maybe Junio's cousin reply that indicates the built product
is covered under GPL-2 is sufficient ;)

[1]: https://devmanual.gentoo.org/general-concepts/licenses/index.html#determining-the-correct-license

In the case of other packages [2], it seems we try to handle
multi-license cases, but I think there (it's been a while since that
particular linked PR stalled) we might be installed both a shared
library under one license and a binary under another.

[2]: https://codeberg.org/gentoo/gentoo/pulls/1340#issuecomment-18812828

Anyway, thanks all! I'll assume the Gentoo maintainers knew what they
were doing :)

-- 
D. Ben Knoble