Re: TCG TPM license issue

On Fri, 23 Jan 2026 at 20:15, James Bottomley
<[email protected]> wrote:
>
> On Fri, 2026-01-23 at 11:02 +0100, Stefano Garzarella wrote:
> > Hi all,
> > it seems the license of the TCG TPM reference implementation that we
> > are using to emulate the vTPM in SVSM is not exactly BSD but a
> > variant of it.
> >
> > For some distro, like Fedora, this could be an issue. See
> > https://gitlab.com/fedora/legal/fedora-license-data/-/issues/716
>
> The problem clause is a conditional statement about the origin of the
> code and not part of the licence, so I don't believe it modifies the
> BSD-2-Clause nature of the implementation in any way.
>
> Additionally, just in the interest of fair dealing Fedora can't
> disapprove of this this disclaimer in coconut, but perfectly fine with
> it in another project they're already shipping:
>
> https://packages.fedoraproject.org/pkgs/libtpms/libtpms/index.html
>
> which has a slightly different form of the disclaimer (inherited
> directly from the TCG) which seems to be a bit stronger in terms of
> modifying the licence:
>
> https://github.com/stefanberger/libtpms/blob/master/LICENSE
>
> ---
> THE COPYRIGHT LICENSES SET FORTH ABOVE DO NOT REPRESENT ANY FORM OF
> LICENSE OR WAIVER, EXPRESS OR IMPLIED, BY ESTOPPEL OR OTHERWISE, WITH
> RESPECT TO PATENT RIGHTS HELD BY TCG MEMBERS (OR OTHER THIRD PARTIES)
> THAT MAY BE NECESSARY TO IMPLEMENT THIS SPECIFICATION OR
> OTHERWISE. Contact TCG Administration
> ([email protected]) for information on specification
> licensing rights available through TCG membership agreements.
> ---
>
> However, I did ask and got word that apparently the TCG has already
> modified its copyright IP policy not to require the patent disclaimer
> in the code, so it's going to remove the language from the TPM
> repository anyway.

So basically, the next TCG TPM version should have a LICENSE file with
only BSD-2-Clause, right?

That should solve the problem I guess.

> I'm guessing that would mean the same problematic
> clause can be removed from libtpms but you'll need to take that up with
> upstream.

Yeah, I'll do.

Thanks,
Stefano