Re: [OE-core] [PATCH] dropbear: Clarify LICENSE and drop PD

[Richard Purdie <richard.purdie@linuxfoundation.org>]

On Tue, 2026-06-30 at 00:44 +0200, Yoann Congal wrote:
> On Tue Jun 2, 2026 at 5:00 PM CEST, Richard Purdie via lists.openembedded.org wrote:
> > The "public-domain" code has a MIT license header so we can remove
> > that from LICENSE (MIT is already listed).
> > 
> > Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
> > ---
> >  meta/recipes-core/dropbear/dropbear_2025.89.bb | 3 ++-
> >  1 file changed, 2 insertions(+), 1 deletion(-)
> > 
> > diff --git a/meta/recipes-core/dropbear/dropbear_2025.89.bb b/meta/recipes-core/dropbear/dropbear_2025.89.bb
> > index 957a0901fb0..ece065265ff 100644
> > --- a/meta/recipes-core/dropbear/dropbear_2025.89.bb
> > +++ b/meta/recipes-core/dropbear/dropbear_2025.89.bb
> > @@ -5,7 +5,8 @@ SECTION = "console/network"
> >  
> >  # some files are from other projects and have others license terms:
> >  #   public domain, OpenSSH 3.5p1, OpenSSH3.6.1p2, PuTTY
> > -LICENSE = "MIT & BSD-3-Clause & BSD-2-Clause & PD"
> > +# The 'public-domain' file is headered as MIT
> > +LICENSE = "MIT & BSD-3-Clause & BSD-2-Clause"
> >  LIC_FILES_CHKSUM = "file://LICENSE;md5=25cf44512b7bc8966a48b6b1a9b7605f"
> 
> While reviewing backporting this patch for scarthgap, I've look at the
> licences of dropbear:
> The "'public-domain' file headered as MIT" is (I think):
> https://github.com/mkj/dropbear/blob/DROPBEAR_2026.91/src/curve25519.c
> (indeed MIT header)
> 
> But:
> * vendored libtommcrypt is "PD OR WTFPL"
>   https://github.com/mkj/dropbear/blob/DROPBEAR_2026.91/libtomcrypt/LICENSE
> * vendored libtommath is "Unlicense"
>   https://github.com/mkj/dropbear/blob/DROPBEAR_2026.91/libtommath/LICENSE
> ... is that OK that those don't appear in LICENSE?
> 
> If yes, then the argument is still valid for scarthgap and I'll will
> backport.

Well spotted, I think you're right that I didn't get this quite right.
It should be:

"MIT & BSD-3-Clause & BSD-2-Clause & (PD | WTFPL) & Unlicense"

assuming those libs are always used in the build.

We should probably just make it:

"MIT & BSD-3-Clause & BSD-2-Clause & WTFPL & Unlicense"

since PD just causes us pain and WTFPL is effectively the alternative.

Cheers,

Richard