[pkg-bacula-devel] SHA1 implementation by Steve Reid

[Florian Weimer]

* Carsten Leonhardt:

>> 1. What is wrong with the current SHA1 code/license? For me the
>> license is very much like a BSD license and I don't see a problem with
>> it on the license stand point.
>
> AFAIR the problem is that the RFC is not to be modified, and the code
> came as part of the RFC, so falls under the same restriction, right?
>
> The files in question can be reviewed here:
> http://www.bacula.org/git/cgit.cgi/bacula/tree/bacula/src/lib/sha1.c
> http://www.bacula.org/git/cgit.cgi/bacula/tree/bacula/src/lib/sha1.h

The intent at the time was that modification and distribution of
modified versions were prohibit.  The Bacula version clearly has been
modified (at least in a minor way, didn't check further).  I'm
surprised that upstream doesn't see that.

The code has since been republished as RFC 6234:

  <https://tools.ietf.org/html/rfc6234>

This time, there is a provision for extract of code parts:

   This document is subject to BCP 78 and the IETF Trust's Legal
   Provisions Relating to IETF Documents
   (http://trustee.ietf.org/license-info) in effect on the date of
   publication of this document.  Please review these documents
   carefully, as they describe your rights and restrictions with respect
   to this document.  Code Components extracted from this document must
   include Simplified BSD License text as described in Section 4.e of
   the Trust Legal Provisions and are provided without warranty as
   described in the Simplified BSD License.

The referenced section reads:

  License. In addition to the licenses granted under Section 3, unless
  one of the legends contained in Section 6.c.i or 6.c.ii is included
  in an IETF Document containing Code Components, such Code Components
  are also licensed to each person who wishes to receive such a
  license on the terms of the “Simplified BSD License", as described
  below. If a licensee elects to apply the BSD License to a Code
  Component, then the additional licenses and restrictions set forth
  in Section 3 and elsewhere in these Legal Provisions shall not apply
  thereto. Note that this license is specifically offered for IETF
  Documents and may not be available for Alternate Stream
  documents. See Section 8 for licensing information for the
  appropriate stream.

  BSD License:

    Copyright (c) <insert year> IETF Trust and the persons identified
    as authors of the code. All rights reserved.
  
    Redistribution and use in source and binary forms, with or without
    modification, are permitted provided that the following conditions
    are met:

    o   Redistributions of source code must retain the above copyright
        notice, this list of conditions and the following disclaimer.

    o   Redistributions in binary form must reproduce the above
        copyright notice, this list of conditions and the following
        disclaimer in the documentation and/or other materials
        provided with the distribution.

    o   Neither the name of Internet Society, IETF or IETF Trust, nor
        the names of specific contributors, may be used to endorse or
        promote products derived from this software without specific
        prior written permission.


    THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND
    CONTRIBUTORS “AS IS” AND ANY EXPRESS OR IMPLIED WARRANTIES,
    INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
    MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
    DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS
    BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
    EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
    TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
    DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
    ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR
    TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF
    THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
    SUCH DAMAGE.

The apparent intent, as evidenced by the copyright statement in the
source code parts of RFC 6234, is that the code parts are available
under that licensing option, even though they are not otherwise marked
as code components under the TLP.