license issue related to the OASIS IPR Policy

[Mingli-Yu]

The file
https://github.com/containers/podman/blob/main/vendor/github.com/miekg/pkcs11/pkcs11.h has some line about OASIS IPR Policy [1], is it possible to avoid the license issue?

[1] https://www.oasis-open.org/policies-guidelines/ipr/

[mheon]

This is an indirect dependency - we don't directly use it, but our libraries do. I think the main consumer is ocicrypt? Will probably need to bring this up with their maintainers and see if there are alternatives.

[Mingli-Yu]

Thanks @mheon for your follow-up.
miekg/pkcs11#157

[vrothberg]

Cc @lumjjb

[lumjjb]

@stefanberger

[stefanberger]

This is an indirect dependency - we don't directly use it, but our libraries do. I think the main consumer is ocicrypt? Will probably need to bring this up with their maintainers and see if there are alternatives.

I don't know of any alternatives. What is the exact issue?

[Mingli-Yu]

@stefanberger
The file
https://github.com/containers/podman/blob/main/vendor/github.com/miekg/pkcs11/pkcs11.h has some line about OASIS IPR Policy [1] which should be proprietary.
[1] https://www.oasis-open.org/policies-guidelines/ipr/

[stefanberger]

@Mingli-Yu Sorry, I am not following. What does that mean that "the file has some line about OASIS IPR Policy which should be proprietary"? Does it mean the header file(s) should be non-public? If so, where does it say that?

[stefanberger]

OASIS publishes header files here: https://github.com/oasis-tcs/pkcs11/tree/master/published/3-00

[Mingli-Yu]

@stefanberger
1, The file included in podman as https://github.com/containers/podman/blob/main/vendor/github.com/miekg/pkcs11/pkcs11.h should come from https://github.com/miekg/pkcs11 which is different from https://github.com/oasis-tcs/pkcs11 which you mentioned.
2, And what we concern if podman uses https://github.com/miekg/pkcs11 and https://github.com/containers/podman/blob/main/vendor/github.com/miekg/pkcs11/pkcs11.h claims OASIS IPR Policy [1], maybe it affects the podman is open-sources or not?
[1] https://www.oasis-open.org/policies-guidelines/ipr/

[stefanberger]

@Mingli-Yu The file from https://github.com/miekg/pkcs11 is exactly this one here: https://github.com/oasis-tcs/pkcs11/blob/master/published/2-40-errata-1/pkcs11.h . And the pkcs11f.h files also match.

# sha1sum.exe oasis-pkcs11/published/2-40-errata-1/pkcs11.h miekg-pkcs11/pkcs11.h
1b03c80c5e68f2f82c580843906df41ed5c6886f *oasis-pkcs11/published/2-40-errata-1/pkcs11.h
1b03c80c5e68f2f82c580843906df41ed5c6886f *miekg-pkcs11/pkcs11.h

# sha1sum.exe oasis-pkcs11/published/2-40-errata-1/pkcs11f.h  miekg-pkcs11/pkcs11f.h
e75b76f6c0ee7e686f07525e929b665993fdfff2 *oasis-pkcs11/published/2-40-errata-1/pkcs11f.h
e75b76f6c0ee7e686f07525e929b665993fdfff2 *miekg-pkcs11/pkcs11f.h

There are additions to the pkcs11t.h in miekg's repo:

diff oasis-pkcs11/published/2-40-errata-1/pkcs11t.h miekg-pkcs11/pkcs11t.h
385a386,390
> #define CKK_SHA3_224_HMAC       0x00000033UL
> #define CKK_SHA3_256_HMAC       0x00000034UL
> #define CKK_SHA3_384_HMAC       0x00000035UL
> #define CKK_SHA3_512_HMAC       0x00000036UL
>
612a618,621
> #define CKM_DSA_SHA3_224               0x00000018UL
> #define CKM_DSA_SHA3_256               0x00000019UL
> #define CKM_DSA_SHA3_384               0x0000001AUL
> #define CKM_DSA_SHA3_512               0x0000001BUL
645a655,663

[...] several more

[stefanberger]

@rjrelyea Are there any known issues with using the OASIS header files in other/golang/... projects?

[rjrelyea]

On 4/25/22 4:12 AM, Stefan Berger wrote: @rjrelyea <https://github.com/rjrelyea> Are there any known issues with using the OASIS header files in other/golang/... projects?

only know about OASIS headers in pkcs #11. In general the OASIS license is claimed to be compatible with open source, but it always generates questions. It's good to have legal look at it. That said, each OASIS TC has the ability to 'tweak' thinks to a certain extent, so answering the question for one TC doesn't give a full answer. Not a very useful answer, but I'm often fighting the same ambiguity. bob

…

— Reply to this email directly, view it on GitHub <#13906 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AEXMMSPCZB473VVK7TJPBFTVGZ4ZLANCNFSM5TVHH6SQ>. You are receiving this because you were mentioned.Message ID: ***@***.***>

[stefanberger]

I am wondering what the sticky points are in the license? Is it the Copyright Licenses?

[github-actions]

A friendly reminder that this issue had no activity for 30 days.

[edsantiago]

Issue appears abandoned.