Bug 1786211

Summary:	geolite2: upstream license change
Product:	[Fedora] Fedora	Reporter:	Carl George 🎩 <carl>
Component:	geolite2	Assignee:	Carl George 🎩 <carl>
Status:	CLOSED CANTFIX	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	32	CC:	carl, dwd, mruprich, o.freyermuth, paul, tcallawa, ubellavance, wienemann
Target Milestone:	---
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2020-05-14 23:01:28 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	182235

Description Carl George 🎩 2019-12-23 23:53:44 UTC

MaxMind, the company that maintains the GeoLite2 databases, has decided to change the license of their databases [0]. Previously they were available under the Creative Commons Attribution-ShareAlike 4.0 license [1]. My understanding of the situation is that the databases are now distributed under a custom license that requires a user to agree to terms to obtain a license key in order to download the databases [2]. Their blog post states that redistribution is permitted, but I don't see any mention of redistribution in the new license.

I have updated the Fedora packages to the December 2019 version of the databases, which are still available under CC-BY-SA. I would like Fedora Legal's advice on what should happen to this package in the future. Here are the scenarios I can imagine.

1. Keep the Fedora packages but never update them again, since future updates to the databases will be released under a non-approved license.

2. Retire the packages. Nothing has a hard requirement on them. ipcalc, php-maxmind-db-reader, and php-maxminddb recommend one at least one of the geolite2-* subpackages. The geoipupdate tool is capable of downloading the databases when provided with a license key, but having the databases available as packages is beneficial so users can have the databases updated with their normal system updates rather than a dedicated tool.

3. Seek Fedora Legal's approval of the new license [2] in order to keep the packages updated. In this scenario I'm not clear who would be agreeing to the license terms. I'm not sure if I as an individual can agree to the terms for all of Fedora. This package also exists in RHEL 8, so if Red Hat were to establish a MaxMind account for RHEL, it would be nice to be able to use the same account for Fedora as well.

[0]: https://blog.maxmind.com/2019/12/18/significant-changes-to-accessing-and-using-geolite2-databases/
[1]: https://web.archive.org/web/20191206115318/https://dev.maxmind.com/geoip/geoip2/geolite2/#License
[2]: https://www.maxmind.com/en/geolite2/eula

Comment 1 Tom "spot" Callaway 2020-01-07 19:47:03 UTC

Sadly, the new GeoLite2 license is non-free and not permissible in Fedora. The December 2019 version of the databases which is clearly CC-BY-SA (and thus, permissible) can stay as long as you wish. 

In your three option scenarios, I can only eliminate #3. The choice of #1 or #2 is up to you, though, I would strongly advise you to engage in a deeper discussion with the Fedora community (especially affected maintainers) before making any change.

Comment 2 Ben Cotton 2020-02-11 17:18:05 UTC

This bug appears to have been reported against 'rawhide' during the Fedora 32 development cycle.
Changing version to 32.

Comment 3 Carl George 🎩 2020-05-14 23:01:28 UTC

Since this is content and not code, I don't see an issue in keeping this around in Fedora.  I added a note in the spec file to warn any future packagers that may be considering updating it.

https://src.fedoraproject.org/rpms/geolite2/c/a92eaebc21a1d71e0fae9339b05e0f4b0ae27280

Comment 4 Paul Howarth 2020-05-15 08:05:27 UTC

Maybe you could add a README.md in git too with the same information, which would then show up at https://src.fedoraproject.org/rpms/geolite2

Comment 5 Carl George 🎩 2020-05-20 21:59:33 UTC

Good idea, done.

https://src.fedoraproject.org/rpms/geolite2/c/a97bc6dc97c70c0ff43bbfc6d5a6158915d3646b

Comment 6 Paul Howarth 2020-07-09 12:13:50 UTC

Maybe we could look at packaging the DB-IP Lite database, which has Creative Commons Attributions 4 International License and also supports MMDB format.

https://db-ip.com/db/lite.php