Re: [gentoo-dev] Guidance on distributed patented software

[Joshua Kinard]

On 9/22/2021 12:37, Robin H. Johnson wrote:
> On Wed, Sep 22, 2021 at 08:54:40AM -0400, Joshua Kinard wrote:
>> Is there any advice on how this impacts net-misc/dropbear?  That has ECC
>> (both ECDSA and Ed25519) support, and I use it for SGI/MIPS netboot images.
>>  The build doesn't have any bindist uses in it, and ECC support is a
>> localoptions.h compile-time option (enabled by default).  ECC is much faster
>> on old SGI hardware and generating the hostkeys at bootup takes just a
>> second or two, whereas RSA can take up to 10-15 seconds.  So I'd like to be
>> able to use ECC on these platforms and distribute netboot images using them.
> RedHat doesn't seem to disable ECC in Dropbear:
> https://src.fedoraproject.org/rpms/dropbear/blob/rawhide/f/dropbear.spec
>
> Based on what they've said for OpenSSL, I would expect that they SHOULD
> have disabled ECC there, but there is certainly no consistency from
> them.
>
> Probably nobody asked legal and just shipped dropbear anyway.
>
> If you wanted to stir the pot, you could post to the Fedora legal list
> and ask for consistency ;-).

Hmm, it looks like dropbear is relying heavily on the ecc/ecdsa functions
provided in libtomcrypt, and that library's homepage states all its code is
public domain.  Our ebuild has no bindist restrictions on that library.
Perhaps that is how dropbear, and thus Red Hat, avoids the issues with
licensing or patents?

-- 
Joshua Kinard
Gentoo/MIPS
kumba@g.o
rsa6144/5C63F4E3F5C6C943 2015-04-27
177C 1972 1FB8 F254 BAD0 3E72 5C63 F4E3 F5C6 C943

"The past tempts us, the present confuses us, the future frightens us.  And
our lives slip away, moment by moment, lost in that vast, terrible in-between."

--Emperor Turhan, Centauri Republic