Re: OpenSSL vs. LibreSSL
Daniel Johnson <[email protected]>
| Newsgroups | gmane.os.apple.fink.devel |
|---|---|
| Message-ID | <[email protected]> |
> On Jun 20, 2015, at 6:49 PM, Alexander Hansen <[email protected]> wrote: > > >> On Jun 20, 2015, at 15:03, Daniel Johnson <[email protected]> wrote: >> >> >>> On Jun 20, 2015, at 4:58 PM, Alexander Hansen <[email protected]> wrote: >>> >>> Since the system’s OpenSSL is going away for 10.11 we’ve got a bit of a pickle. >>> >>> My understanding is that our packages that use openssl100-dev and have binaries are now technically in violation of the openssl license, which only allows redistribution against an OpenSSL which is shipped with the OS. >>> >>> 1) Is this still true? If so, then we need to start tagging them as Restrictive. >>> 2) Does LibreSSL have the same restriction? If not, can we convert over to use that? >>> >>> -- >>> Alexander Hansen, Ph.D. >>> Fink User Liaison >>> >> >> 1) IANAL, so I can’t answer this, but the issue isn’t that OpenSSL’s license forbids distribution. The problem is that because of OpenSSL’s “original” BSD license with the advertising clause, it is incompatible with the GPL. The GPL *does* allow linking to libraries that come with an OS, so that’s where the workaround used to be. >> >> 2) LibreSSL (and BoringSSL but we don’t have that package) is a fork of OpenSSL and therefore must use the same license. I believe they have been trying to get things relicensed but that’s an almost impossible job since there’s some really old code in there. >> >> Daniel >> > > 1+2) Ah. gotcha. As a simple base example then, is our cvs package, which uses openssl100, in violation? And if so, do we have to mark it as Restrictive? Or worse yet, pull it and stop supporting selfupdate-cvs on distributions where Xcode doesn’t have cvs ? > > -- > Alexander Hansen, Ph.D. > Fink User Liaison > This is a good run-down: https://people.gnome.org/~markmc/openssl-and-the-gpl.html Some packages have an explicit “OpenSSL is Ok” clause added to the GPL. cvs does not, but looking at the code, it looks like libcrypto is only used as a requirement for Kerberos and Apple’s Kerberos doesn’t need that. I’ll have to look at it closer. It may be possible to drop the dep. Daniel ------------------------------------------------------------------------------ _______________________________________________ Fink-devel mailing list [email protected] List archive: http://news.gmane.org/gmane.os.apple.fink.devel Subscription management: https://lists.sourceforge.net/lists/listinfo/fink-devel
signature.asc
(application/pgp-signature, 801 B)
-----BEGIN PGP SIGNATURE----- iQIcBAEBCAAGBQJVhfEuAAoJEHIZ9WxpsAjhlj4QAJm+cQyVIrl9TXh4dw6rtkcK EDWeqK2i0YbACQJlCZuVp1M7E9VRl9gWDnOEbS+Q0D2TRFgk0TLZYNiJtjale5Hc 1DusPs0Rup52bsPwUUnt2gIu+ku2MRM6o85GwDpZN/y1m2u87siHVN7aPvoNo6oH T+1bii2J6v9uTPWOTBcK25ofi5qKTd+sn0GANmw6tASxC5NESOw8pXaVDnGEhmb6 i/B+gHmRoPQVzorjan+Q5fOav0L+vxhssm0epN8enVoTRf7bPGWyED9rmnViuXxV NDTHJ2Up9XCieuU38rQ59ACXKWKCK3DvGnMTlv6tMGfqK5tkffP2uSPKd2Pf1RPd Jveh1ahpmXBJX7KBtJZxz4g2a22vmEVvDfte9ZK8s/jLMeypssH2nuIIuunHSqFL tOjoCGqrczN25ennuFrtFhnAmmMF7LGcPMQzrMcKNpPlnRVubameiyRpuTuoooik 1/NbQrFlccGleERbcZPhWXImxLmiiGiQxps5A0VIQWHiWSfANTE1l/jXFIpFMwKI f8EReBMuWad0mUV9fvLC2GhZrKGtcBJZIYc5XD/jShFN1koBJVk60cvzKa6CuD8v PAguKLOvoOMhH3653v7tAb6VJxX9ldRXhyQVdBGVM6hXnppweEVkpKTGUGVJs1zd fB5bd1qtg2/H/hUt4vay =nwSn -----END PGP SIGNATURE-----