Re: OpenSSL vs. LibreSSL

On Saturday, June 20, 2015, Daniel Johnson <[email protected]>
wrote:

>
> > On Jun 20, 2015, at 7:03 PM, Daniel Johnson <[email protected]
> <javascript:;>> wrote:
> >
> >
> >> On Jun 20, 2015, at 6:49 PM, Alexander Hansen <
> [email protected] <javascript:;>> wrote:
> >>
> >>
> >>> On Jun 20, 2015, at 15:03, Daniel Johnson <[email protected]
> <javascript:;>> wrote:
> >>>
> >>>
> >>>> On Jun 20, 2015, at 4:58 PM, Alexander Hansen <
> [email protected] <javascript:;>> wrote:
> >>>>
> >>>> Since the system’s OpenSSL is going away for 10.11 we’ve got a bit of
> a pickle.
> >>>>
> >>>> My understanding is that our packages that use openssl100-dev and
> have binaries are now technically in violation of the openssl license,
> which only allows redistribution against an OpenSSL which is shipped with
> the OS.
> >>>>
> >>>> 1)  Is this still true?  If so, then we need to start tagging them as
> Restrictive.
> >>>> 2)  Does LibreSSL have the same restriction?  If not, can we convert
> over to use that?
> >>>>
> >>>> --
> >>>> Alexander Hansen, Ph.D.
> >>>> Fink User Liaison
> >>>>
> >>>
> >>> 1) IANAL, so I can’t answer this, but the issue isn’t that OpenSSL’s
> license forbids distribution. The problem is that because of OpenSSL’s
> “original” BSD license with the advertising clause, it is incompatible with
> the GPL. The GPL *does* allow linking to libraries that come with an OS, so
> that’s where the workaround used to be.
> >>>
> >>> 2) LibreSSL (and BoringSSL but we don’t have that package) is a fork
> of OpenSSL and therefore must use the same license. I believe they have
> been trying to get things relicensed but that’s an almost impossible job
> since there’s some really old code in there.
> >>>
> >>> Daniel
> >>>
> >>
> >> 1+2)  Ah.  gotcha.  As a simple base example then, is our cvs package,
> which uses openssl100, in violation?  And if so, do we have to mark it as
> Restrictive?  Or worse yet, pull it and stop supporting selfupdate-cvs on
> distributions where Xcode doesn’t have cvs ?
> >>
> >> --
> >> Alexander Hansen, Ph.D.
> >> Fink User Liaison
> >>
> >
> > This is a good run-down:
> https://people.gnome.org/~markmc/openssl-and-the-gpl.html
> >
> > Some packages have an explicit “OpenSSL is Ok” clause added to the GPL.
> cvs does not, but looking at the code, it looks like libcrypto is only used
> as a requirement for Kerberos and Apple’s Kerberos doesn’t need that. I’ll
> have to look at it closer. It may be possible to drop the dep.
> >
> > Daniel
> >
>
> Ok, cvs doesn’t link to or even check for openssl. The dep is probably a
> relic of an old Kerberos.framework that published -lcrypto in its config
> program. I’ve removed the dep and reved up.


Fedora doesn't have a build dependency on OpenSSL for their cvs package but
does build it against a MIT licensed krb5 which in turn is built against
OpenSSL.


> Daniel
>
>
>

------------------------------------------------------------------------------

_______________________________________________
Fink-devel mailing list
[email protected]
List archive:
http://news.gmane.org/gmane.os.apple.fink.devel
Subscription management:
https://lists.sourceforge.net/lists/listinfo/fink-devel