On Mon, Dec 14, 2009 at 07:15:36AM -0500, Richard Freeman wrote: > On 12/13/2009 02:49 PM, Robin H. Johnson wrote: > >On Sun, Dec 13, 2009 at 10:44:05PM +1100, Daniel Black wrote: > >>Recently this got produced as a draft license for parties distributing > >>CAcert's root certificate(s) (like us). > >>https://svn.cacert.org/CAcert/Policies/Agreements/3PVDisclaimerAndLicence.html > >That's a pretty dense license. I can see why you had a headache. > > > >I believe that in it's current form, we will have to make sure we have a > >liability disclaimer to users for the license, but that should be about > >it. > > > > First, I am not a lawyer. > > The 3PV license does require that the user be presented with: > http://www.cacert.org/policy/NRPDisclaimerAndLicence.php From 3PV: ===== 1.4 Vendor's Agreement with End-User Vendor agrees 1. to distribute both the NRP-DaL and this present agreement to end-user, 2. to advise the end-user of the NRP-DaL appropriately. ... 2. Disclaimer 2.1 All Liability Vendor's relationship with end-users creates risks, liabilities and obligations due to the end-user's permitted USE of the certificates, and potentially through other activities such as inappropriate and non-permitted RELIANCE. =====
1.4.1 just means we get to install both licenses, similar to the other @BINARY-REDISTRIBUTABLE discussion we had. 1.4.2 is interesting, in that a lot of users don't read elog/einfo at all. Thus do they count as reasonable effort to the inform the user? 2.1 is where I had more concern. NRP contains this wonderful line: "You may NOT RELY on any statements or claims made by the certificates or implied in any way." But... > An option would be to RESTRICT=mirror their root key, and install it > directly from their site, assuming they don't start messing with the > URL. Then we can just put the license in the ebuild like any other. > Since we don't redistribute anything copyrighted, Gentoo itself > doesn't enter into any license agreement. This is entirely moot. The CACert materials in Gentoo come from Debian's ca-certificates package. We do NOT independently supply them. http://packages.debian.org/sid/ca-certificates I think this might enable us to entirely sidestep a large part of the discussion. Watch what Debian does, and see what related actions if any we need to take. -- Robin Hugh Johnson Gentoo Linux: Developer, Trustee & Infrastructure Lead E-Mail : robb...@gentoo.org GnuPG FP : 11AC BA4F 4778 E3F6 E4ED F38E B27B 944E 3488 4E85
pgpZWqz0Hn4ih.pgp
Description: PGP signature
