Brainpool Curves in Fedora (openssl, libgcrypt, gnupg)

[Timothée Ravier]

Hi everyone,

The ECC Brainpool Curves [1][2] are currently not available in Fedora as according to this BZ [3], this needs Fedora Legal approval.
Could someone from the legal team take a look to see if there are any blockers regarding Brainpool Curves inclusion in Fedora?

Thanks!

[1] https://en.wikipedia.org/wiki/Elliptic-curve_cryptography#Implementation
[2] https://tools.ietf.org/html/rfc5639
[3] https://bugzilla.redhat.com/show_bug.cgi?id=1413618

[Ben Cotton]

On Tue, Nov 10, 2020 at 4:52 AM Timothée Ravier  wrote:
> The ECC Brainpool Curves [1][2] are currently not available in Fedora as according to this BZ [3], this needs Fedora Legal approval.
> Could someone from the legal team take a look to see if there are any blockers regarding Brainpool Curves inclusion in Fedora?

Thanks for bringing this up. I'll check on it.

[Jakub Jelen]

On 11/10/20 2:18 PM, Ben Cotton wrote:
> On Tue, Nov 10, 2020 at 4:52 AM Timothée Ravier  wrote:
> > The ECC Brainpool Curves [1][2] are currently not available in Fedora as according to this BZ [3], this needs Fedora Legal approval.
> > Could someone from the legal team take a look to see if there are any blockers regarding Brainpool Curves inclusion in Fedora?
>
> Thanks for bringing this up. I'll check on it.

Hi Ben,
did you get back to look into this during last months (busy ones were they)?

We need to strip these curves from upstream tarballs and it would be 
great to have this resolved (in either way) rather sooner than later.

My main concern is the libgcrypt but guys handling other packages would 
like to hear an authoritative answer too:

https://bugzilla.redhat.com/show_bug.cgi?id=1413618

Thanks,

[Ben Cotton]

On Thu, Mar 18, 2021 at 10:06 AM Jakub Jelen  wrote:
> We need to strip these curves from upstream tarballs and it would be
> great to have this resolved (in either way) rather sooner than later.

The Brainpool curves are not approved for use in Fedora at this time.

[Jakub Jelen]

On 3/18/21 4:10 PM, Ben Cotton wrote:
> On Thu, Mar 18, 2021 at 10:06 AM Jakub Jelen  wrote:
> > We need to strip these curves from upstream tarballs and it would be
> > great to have this resolved (in either way) rather sooner than later.
>
> The Brainpool curves are not approved for use in Fedora at this time.

Hi,
I wanted to bring up this topic once more again as it was suggested that 
if the curves are build-time disabled we should be able to go around 
without hobbling the source tarball. I proposed the following change to 
libgcrypt to support build-time disabling brainpool curves and I wanted 
to double-check if this approach is legally acceptable:

https://dev.gnupg.org/T5520#149566

Thanks,

[Yaakov Selkowitz]

On Mon, 2021-09-13 at 08:56 +0200, Jakub Jelen wrote:
> On 3/18/21 4:10 PM, Ben Cotton wrote:
> > On Thu, Mar 18, 2021 at 10:06 AM Jakub Jelen  wrote:
> > > We need to strip these curves from upstream tarballs and it would be
> > > great to have this resolved (in either way) rather sooner than later.
> >
> > The Brainpool curves are not approved for use in Fedora at this time.
>
> Hi,
> I wanted to bring up this topic once more again as it was suggested that 
> if the curves are build-time disabled we should be able to go around 
> without hobbling the source tarball. I proposed the following change to 
> libgcrypt to support build-time disabling brainpool curves and I wanted 
> to double-check if this approach is legally acceptable:

Long-standing policy has been that anything which cannot be included for legal
reasons must be stripped from the source tarballs, so no.

[Björn 'besser82' Esser]

Am Montag, dem 13.09.2021 um 09:38 -0400 schrieb Yaakov Selkowitz:
> On Mon, 2021-09-13 at 08:56 +0200, Jakub Jelen wrote:
> > On 3/18/21 4:10 PM, Ben Cotton wrote:
> > > On Thu, Mar 18, 2021 at 10:06 AM Jakub Jelen 
> > > wrote:
> > > > We need to strip these curves from upstream tarballs and it
> > > > would be
> > > > great to have this resolved (in either way) rather sooner than
> > > > later.
> > >
> > > The Brainpool curves are not approved for use in Fedora at this
> > > time.
> >
> > Hi,
> > I wanted to bring up this topic once more again as it was suggested
> > that 
> > without hobbling the source tarball. I proposed the following change
> > to 
> > libgcrypt to support build-time disabling brainpool curves and I
> > wanted 
> > to double-check if this approach is legally acceptable:
>
> Long-standing policy has been that anything which cannot be included
> for legal
> reasons must be stripped from the source tarballs, so no.

Well, are there any chances for legal to reevaluate the ability to ship
the Brainpool ECC within Fedora and/or RHEL?

Those curves are the IT-security recommendation and almost the de-facto
standard for cryptography in most of the European countries, especially
when it comes to the online functionality of the issued ID documents.

AFAIK, the implementation of Brainpool ECC in OpenSSL and OpenJDK has
been contributed by Oracle, and they claim not to use, nor violate, any
patented algorithms within their code.

Thanks,
Björn aka besser82

[Matthew Miller]

On Mon, Sep 13, 2021 at 04:27:19PM +0200, Björn 'besser82' Esser wrote:
> Well, are there any chances for legal to reevaluate the ability to ship
> the Brainpool ECC within Fedora and/or RHEL?

I'll see what I can find out.

[Björn 'besser82' Esser]

Am Dienstag, dem 14.09.2021 um 13:18 -0400 schrieb Matthew Miller:
> On Mon, Sep 13, 2021 at 04:27:19PM +0200, Björn 'besser82' Esser
> wrote:
> > Well, are there any chances for legal to reevaluate the ability to
> > ship
> > the Brainpool ECC within Fedora and/or RHEL?
>
> I'll see what I can find out.

Thank you in advance for your efforts!

[Björn 'besser82' Esser]

Am Dienstag, dem 14.09.2021 um 13:18 -0400 schrieb Matthew Miller:
> On Mon, Sep 13, 2021 at 04:27:19PM +0200, Björn 'besser82' Esser
> wrote:
> > Well, are there any chances for legal to reevaluate the ability to
> > ship
> > the Brainpool ECC within Fedora and/or RHEL?
>
> I'll see what I can find out.

Hello Matthew,

I don't want to be pushy, but it's been a while since your reply.  Did
you get any response or reaction about this in the meantime?

Thanks,
Björn

[Felix Schwarz]

Am 14.10.21 um 21:44 schrieb Björn 'besser82' Esser:
> I don't want to be pushy, but it's been a while since your reply.  Did
> you get any response or reaction about this in the meantime?

Just wanted to mention that this affects me as well. For example electronic 
prescriptions in Germany require signatures with brainpool curves so as of now 
we'd have to rebuild OpenSSL to verify these signatures...

Felix

[Matthew Miller]

On Fri, Oct 15, 2021 at 12:23:57PM +0200, Felix Schwarz wrote:
> Am 14.10.21 um 21:44 schrieb Björn 'besser82' Esser:
> > I don't want to be pushy, but it's been a while since your reply.  Did
> > you get any response or reaction about this in the meantime?
>
> Just wanted to mention that this affects me as well. For example
> electronic prescriptions in Germany require signatures with
> brainpool curves so as of now we'd have to rebuild OpenSSL to verify
> these signatures...

Thank you, that kind of information is very helpful. Can you link to
something documenting this requirement? I coulnd't find anything in a quick
search. (It's okay if it's in German.)

[Björn 'besser82' Esser]

Am Samstag, dem 16.10.2021 um 23:24 -0400 schrieb Matthew Miller:
> On Fri, Oct 15, 2021 at 12:23:57PM +0200, Felix Schwarz wrote:
> > Am 14.10.21 um 21:44 schrieb Björn 'besser82' Esser:
> > > I don't want to be pushy, but it's been a while since your reply. 
> > > Did
> > > you get any response or reaction about this in the meantime?
> >
> > Just wanted to mention that this affects me as well. For example
> > electronic prescriptions in Germany require signatures with
> > brainpool curves so as of now we'd have to rebuild OpenSSL to verify
> > these signatures...
>
> Thank you, that kind of information is very helpful. Can you link to
> something documenting this requirement? I coulnd't find anything in a
> quick
> search. (It's okay if it's in German.)

Here is a technical reference document (TR-03116-4) issued by German
"BSI" [1] (Federal agency for IT security).  On the very bottom of page
21 it says: "Außerdem muss die elliptische Kurve BrainpoolP256r1 für die
ECC-Verfahren unterstützt werden" -> "Additionally support for
BrainpoolP256r1 ECC is mandatory."

In TR-03116-2 [2] on page 9 one can also find the mandatory requirement
for Brainpool ECC: "Für kryptographische Algorithmen basierend auf
Elliptischen Kurven (d.h. ECDSA und ECKA) sind die
Brainpool Domain Parameter [26] in den entsprechenden Bitlängen zu
verwenden." -> "For cryptographic algorithms based on ECC (ECDSA, ECKA)
Brainpool domain parameters with adequate bit lengths as shown are to be
used."

Thanks,
Björn

[1] 
https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Publikationen/Technische...
[2] 
https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Publikationen/Technische...

[Felix Schwarz]

Am 17.10.21 um 05:24 schrieb Matthew Miller:
> On Fri, Oct 15, 2021 at 12:23:57PM +0200, Felix Schwarz wrote:
> > For example electronic prescriptions in Germany require signatures with 
> > brainpool curves so as of now we'd have to rebuild OpenSSL to verify 
> > these signatures...
>
> Thank you, that kind of information is very helpful. Can you link to 
> something documenting this requirement? I coulnd't find anything in a
> quick search. (It's okay if it's in German.)

haha - it took me also way too long to find these docs ;-)

Here you go:
https://fachportal.gematik.de/fachportal-import/files/gemSpec_Krypt_V2.18.0....

I'd like to mention that this document is not just authoritative for digital 
prescriptions but also other - maybe even more important - use cases related 
to the German health care system:
- eAU https://www.kbv.de/html/e-au.php
- ePA  (electronic patient records): https://www.kbv.de/html/epa.php

Felix

[Matthew Miller]

On Sun, Oct 17, 2021 at 12:25:52PM +0200, Felix Schwarz wrote:
> Here you go:
> https://fachportal.gematik.de/fachportal-import/files/gemSpec_Krypt_V2.18.0....
>
> I'd like to mention that this document is not just authoritative for
> digital prescriptions but also other - maybe even more important -
> use cases related to the German health care system:
> eAU https://www.kbv.de/html/e-au.php
> ePA  (electronic patient records): https://www.kbv.de/html/epa.php

Thanks both of you -- I'll forward these on and see if it helps.

[Björn 'besser82' Esser]

Am Montag, dem 18.10.2021 um 13:02 -0400 schrieb Matthew Miller:
> On Sun, Oct 17, 2021 at 12:25:52PM +0200, Felix Schwarz wrote:
> > Here you go:
> > https://fachportal.gematik.de/fachportal-import/files/gemSpec_Krypt_V2.18.0....
> >
> > I'd like to mention that this document is not just authoritative for
> > digital prescriptions but also other - maybe even more important -
> > use cases related to the German health care system:
> > eAU https://www.kbv.de/html/e-au.php
> > ePA  (electronic patient records): https://www.kbv.de/html/epa.php
>
> Thanks both of you -- I'll forward these on and see if it helps.

Hello Matthew,

did our information help?  What's the status?

Thanks,
Björn

[Christian Glombek]

I'm hitting this problem as well with the German ID (eAU), see BZ:
https://bugzilla.redhat.com/show_bug.cgi?id=2000306

Some BSI tech guidelines relating to ECCs are actually available in
english, too, e.g.:

https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Publications/TechGuideli...
https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Publications/TechGuideli...

Quoting from the former doc:
> 1.1. Patents and side-channel attacks
> In implementations, patents and side-channel attacks play an important role.
> The algorithms described in this guideline have been carefully selected to allow patent-free
> and/or license-free implementations. Nevertheless, some of the described algorithms or its par-
> ticular implementations may be subject of patent rights. The BSI shall not be held responsible
> for identifying any or all such patent rights.
> Implementors and security evaluators shall also pay attention to [6], which gives a general
> guidance to assess the side-channel resistance of implementations on smartcards

There is more anecdotal evidence e.g. here by ARM Mbed:
https://tls.mbed.org/kb/cryptography/elliptic-curve-performance-nist-vs-brai...

Quote:

Can you optimize Brainpool curves to be as fast as the NIST curves?
> Unfortunately, this is not possible. The design decision for Brainpool to
> use random primes was aimed at:
> avoiding possible patent issues with fast reduction algorithms
> avoiding potential security issues with non-random primes

Nitrokey docs also show using Brainpool curves in their docs:
https://docs.nitrokey.com/pro/linux/ecc.html
> [...] A suitable version of GnuPG is included in the GNU/Linux

distributions Ubuntu (since 18.04), Debian (from Stretch onwards),
> Arch Linux, Fedora (from Release 26 onwards) and openSUSE Tumbleweed [...]

They apparently haven't tested their guide on Fedora in a while ;)

All of the above makes it look to me as though Brainpool curves were
specifically designed to NOT touch on any patents.
I'd be curious if any other of the big distros exclude the Brainpool curves
too. On the linked BZ it was stated that Xubuntu includes them.

It would be great if the current exclusion of those curves would be
reevaluated.

Thanks,
Christian

[Julian Sikorski]

Hello Matthew,

are there any updates regarding this?

Best regards,
Julian

[Matthew Miller]

I will check back again.

On Sun, Jan 16, 2022 at 06:21:05PM -0000, Julian Sikorski wrote:
> Hello Matthew,
>
> are there any updates regarding this?
>
> Best regards,
> Julian
> _______________________________________________
> legal mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]
> Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives: https://lists.fedoraproject.org/archives/list/[e-mail]
> Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure

[Matthew Miller]

Sooooo, these things move slowly, but this _is_ being worked on. I'll let
you know when I can.

On Fri, Jan 28, 2022 at 05:19:34PM -0500, Matthew Miller wrote:
> I will check back again.
>
> On Sun, Jan 16, 2022 at 06:21:05PM -0000, Julian Sikorski wrote:
> > Hello Matthew,
> >
> > are there any updates regarding this?
> >
> > Best regards,
> > Julian
> > _______________________________________________
> > legal mailing list -- [e-mail]
> > To unsubscribe send an email to [e-mail]
> > Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> > List Archives: https://lists.fedoraproject.org/archives/list/[e-mail]
> > Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure
>
> -- 
> Matthew Miller
>
> Fedora Project Leader
> _______________________________________________
> legal mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]
> Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives: https://lists.fedoraproject.org/archives/list/[e-mail]
> Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure

[Julian Sikorski]

Thank you!

Am 06.04.22 um 16:13 schrieb Matthew Miller:
> Sooooo, these things move slowly, but this _is_ being worked on. I'll let
> you know when I can.
>
> On Fri, Jan 28, 2022 at 05:19:34PM -0500, Matthew Miller wrote:
> > I will check back again.
> >
> > On Sun, Jan 16, 2022 at 06:21:05PM -0000, Julian Sikorski wrote:
> > > Hello Matthew,
> > >
> > > are there any updates regarding this?
> > >
> > > Best regards,
> > > Julian
> > > _______________________________________________
> > > legal mailing list -- [e-mail]
> > > To unsubscribe send an email to [e-mail]
> > > Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> > > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> > > List Archives: https://lists.fedoraproject.org/archives/list/[e-mail]
> > > Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure
> >
> > -- 
> > Matthew Miller
> >
> > Fedora Project Leader
> > _______________________________________________
> > legal mailing list -- [e-mail]
> > To unsubscribe send an email to [e-mail]
> > Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> > List Archives: https://lists.fedoraproject.org/archives/list/[e-mail]
> > Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure

[Felix Schwarz]

Am 06.04.22 um 16:13 schrieb Matthew Miller:
> Sooooo, these things move slowly, but this _is_ being worked on. I'll let
> you know when I can.

Thanks :-)
The day Red Hat is able to distribute the brainpool curves will be a great one 
for us.

Felix

[Matthew Miller]

On Wed, Apr 06, 2022 at 05:31:10PM +0200, Felix Schwarz wrote:
> Am 06.04.22 um 16:13 schrieb Matthew Miller:
> > Sooooo, these things move slowly, but this _is_ being worked on. I'll let
> > you know when I can.
>
> Thanks :-)
> The day Red Hat is able to distribute the brainpool curves will be a
> great one for us.

I have been told that it is okay to include Brainpool ECC in Fedora. Thank
you for your patience.

[Peter Lemenkov]

Great news, thank you Matthew!

On Tue, Nov 8, 2022 at 4:19 PM Matthew Miller  wrote:
> On Wed, Apr 06, 2022 at 05:31:10PM +0200, Felix Schwarz wrote:
> > Am 06.04.22 um 16:13 schrieb Matthew Miller:
> > > Sooooo, these things move slowly, but this _is_ being worked on. I'll let
> > > you know when I can.
> >
> > Thanks :-)
> > The day Red Hat is able to distribute the brainpool curves will be a
> > great one for us.
>
> I have been told that it is okay to include Brainpool ECC in Fedora. Thank
> you for your patience.
>
> --
> Matthew Miller
>
> Fedora Project Leader
> _______________________________________________
> legal mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]
> Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives: https://lists.fedoraproject.org/archives/list/[e-mail]
> Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue

[Sérgio Basto]

On Tue, 2022-11-08 at 10:19 -0500, Matthew Miller wrote:
> On Wed, Apr 06, 2022 at 05:31:10PM +0200, Felix Schwarz wrote:
> > Am 06.04.22 um 16:13 schrieb Matthew Miller:
> > > Sooooo, these things move slowly, but this _is_ being worked on.
> > > I'll let
> > > you know when I can.
> >
> > Thanks :-)
> > The day Red Hat is able to distribute the brainpool curves will be
> > a
> > great one for us.
>
> I have been told that it is okay to include Brainpool ECC in Fedora.
> Thank
> you for your patience.

So can you remove blocker FE_LEGAL tracker on
https://bugzilla.redhat.com/show_bug.cgi?id=1413618
? 
and write that is approved please
> -- 
> Matthew Miller
>
> Fedora Project Leader
> _______________________________________________
> legal mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]
> Fedora Code of Conduct:
> https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> List Guidelines:
> https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives:
> https://lists.fedoraproject.org/archives/list/[e-mail]
> Do not reply to spam, report it:
> https://pagure.io/fedora-infrastructure/new_issue

[Richard Fontana]

On Tue, Nov 8, 2022 at 1:04 PM Sérgio Basto  wrote:
> So can you remove blocker FE_LEGAL tracker on
> https://bugzilla.redhat.com/show_bug.cgi?id=1413618
> ?

I'm supposed to be able to do this but I cannot figure out how
(despite having done something equivalent for another bug several
months ago). I use redhat.bugzilla.com very infrequently and have the
impression that every time I use it something subtle in the interface
changes each time. Sorry. If someone can provide simple instructions I
can do it.

Richard

[Richard Fontana]

On Tue, Nov 8, 2022 at 10:24 PM Richard Fontana  wrote:
> I use redhat.bugzilla.com very infrequently

bugzilla.redhat.com, that is

[Neal Gompa]

On Tue, Nov 8, 2022 at 10:29 PM Richard Fontana  wrote:
> On Tue, Nov 8, 2022 at 10:24 PM Richard Fontana  wrote:
> > I use redhat.bugzilla.com very infrequently
>
> bugzilla.redhat.com, that is

Edit the Blocks field to remove the FE_LEGAL BZ and make a comment
noting that this is fine.

[Richard Fontana]

On Tue, Nov 8, 2022 at 10:34 PM Neal Gompa  wrote:
> On Tue, Nov 8, 2022 at 10:29 PM Richard Fontana  wrote:
> > On Tue, Nov 8, 2022 at 10:24 PM Richard Fontana  wrote:
> > > I use redhat.bugzilla.com very infrequently
> >
> > bugzilla.redhat.com, that is
>
> Edit the Blocks field to remove the FE_LEGAL BZ and make a comment
> noting that this is fine.

Ah, of course. It's an "advanced field" that is hidden by default (and
unhidden by a button way off to the right and easy to overlook, for me
at least). Done now.

Richard

[Fabio Valentini]

On Tue, Nov 8, 2022 at 4:19 PM Matthew Miller  wrote:
> On Wed, Apr 06, 2022 at 05:31:10PM +0200, Felix Schwarz wrote:
> > Am 06.04.22 um 16:13 schrieb Matthew Miller:
> > > Sooooo, these things move slowly, but this _is_ being worked on. I'll let
> > > you know when I can.
> >
> > Thanks :-)
> > The day Red Hat is able to distribute the brainpool curves will be a
> > great one for us.
>
> I have been told that it is okay to include Brainpool ECC in Fedora. Thank
> you for your patience.

Sorry for resurrecting this old thread.
I just realized that the wiki has not been updated to reflect the fact
that the Brainpool curves are considered OK now:
https://fedoraproject.org/wiki/Legal:ECC

Can somebody with edit privileges on that page update the list?
Or should this documentation be moved somewhere else altogether (legal
docs on docs.fp.o)?

Fabio

[Richard Fontana]

On Thu, May 16, 2024 at 10:00 AM Fabio Valentini  wrote:
> On Tue, Nov 8, 2022 at 4:19 PM Matthew Miller  wrote:
> > On Wed, Apr 06, 2022 at 05:31:10PM +0200, Felix Schwarz wrote:
> > > Am 06.04.22 um 16:13 schrieb Matthew Miller:
> > > > Sooooo, these things move slowly, but this _is_ being worked on. I'll let
> > > > you know when I can.
> > >
> > > Thanks :-)
> > > The day Red Hat is able to distribute the brainpool curves will be a
> > > great one for us.
> >
> > I have been told that it is okay to include Brainpool ECC in Fedora. Thank
> > you for your patience.
>
> Sorry for resurrecting this old thread.
> I just realized that the wiki has not been updated to reflect the fact
> that the Brainpool curves are considered OK now:
> https://fedoraproject.org/wiki/Legal:ECC
>
> Can somebody with edit privileges on that page update the list?
> Or should this documentation be moved somewhere else altogether (legal
> docs on docs.fp.o)?

It should probably be moved to docs.fp.o, we've been treating the
legal portions of the wiki as deprecated.

Richard

[Fabio Valentini]

On Tue, May 21, 2024 at 3:00 AM Richard Fontana  wrote:
> On Thu, May 16, 2024 at 10:00 AM Fabio Valentini  wrote:
> > Can somebody with edit privileges on that page update the list?
> > Or should this documentation be moved somewhere else altogether (legal
> > docs on docs.fp.o)?
>
> It should probably be moved to docs.fp.o, we've been treating the
> legal portions of the wiki as deprecated.

Thanks, I've now opened a merge request that does so:
https://gitlab.com/fedora/legal/fedora-legal-docs/-/merge_requests/296

Fabio