2

I am preparing to (formally) release my first standalone FOSS program (source and binary). It basically relies on Hashicorp's Vault's implementation of Shamir's Secret Sharing algorithm to provide users an easy interface to sharding passwords and the like.

Here's my license disclaimer. Here's my 4 questions:

  1. Can I publish my tool as it currently is with import vault/shamir? (pretty sure MPL allows this but I want to confirm). Is my disclaimer sufficient, insufficient, or overkill?
  2. Could I fork/copy the vault/shamir.go and test code into my repo while maintaining a license notification? I do not need to vendor the entire Vault lib, so taking this subsample greatly reduces dependencies.
  3. Would I be able to fork/copy the code and make small modification to it? (e.g. I want a variant of Split where I pass in the seed value, for testing purposes)
  4. Would I be able to rewrite my own shamir.go from “scratch”? (kind of hard to do without “plagiarizing” since it is an algorithm and there is basically 1 way to implement an algorithm. Also the python implementation is on wikipedia). I probably don't actually want to do this, but I am curious how it works in a situation like this.
2
  1. Can I publish my tool as it currently is with import vault/shamir? (pretty sure MPL allows this but I want to confirm). Is my disclaimer sufficient, insufficient, or overkill?

Assuming the libraries you mention in the License section of your README.md are all third-party libraries and you have the copyrights to the rest of the code, then I see nothing that would make it illegal to publish your tool.

The last paragraph in that section (your actual disclaimer I think) is not needed, but it won't hurt either. It shows you have at least the intention to abide by all relevant license terms.

  1. Could I fork/copy the vault/shamir.go and test code into my repo while maintaining a license notification? I do not need to vendor the entire Vault lib, so taking this subsample greatly reduces dependencies.
  2. Would I be able to fork/copy the code and make small modification to it? (e.g. I want a variant of Split where I pass in the seed value, for testing purposes)

Yes, the MPL license allows you to create a copy of the vault/shamir.go code and to make changes to it. Removing unused code is one of the modifications that are allowed, so it is impossible to tell if you vendored the entire Vault lib, or just that one file and associated license information.

  1. Would I be able to rewrite my own shamir.go from “scratch”? (kind of hard to do without “plagiarizing” since it is an algorithm and there is basically 1 way to implement an algorithm. Also the python implementation is on wikipedia). I probably don't actually want to do this, but I am curious how it works in a situation like this.

Algorithms themselves are not subject to copyright protection, only their implementations are. So, if you took the mathematical description of an algorithm and created your own implementation of it, that would be entirely your copyright.
On the other hand, if you took an existing implementation and ported that to a different language, then your implementation would likely be considered a derivative work of the source implementation and you would be bound by that implementation's license.
Re-implementing an algorithm from scratch after having seen another implementation muddies the waters, because it will be hard to tell how much was your own inspiration and how much was based on remembering how the other implementation was written. Making a copy based on memory is still making a copy as far as copyright is concerned.

| improve this answer | |
  • "It shows you have at least the intention to abide by all relevant license terms." 👍 "Re-implementing an algorithm from scratch after having seen another implementation" - this is the rub, isn't it? Especially since it's a pretty simple algo, there's little leeway in how to write it (classic software copyright problem, music as well, see the Dark Horse case). But it sounds like as long as I keep the "paper trail" to Hashicorp, I should be good, right? – DeusXMachina May 3 at 13:32
  • 1
    @DeusXMachina, yes. – Bart van Ingen Schenau May 3 at 13:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.