Pity that the bits required for QUIC didn't make the cut: https://github.com/openssl/openssl/pull/8797
OpenSSL 3.0
71–80 of 106 posts
Re: OpenSSL 3.0
#72Earlier quoted context omitted.
The openbsd people behind libressl hate the apache 2.0 license, so they won't be able to copy such code from the openssl project any longer. I'm sure they're happy they have a TLS library with a license they like (new contributions are licensed under the openbsd license) and they can continue developing. As for gnutls, apache 2.0 license is still incompatible with (L)GPL 2.x, so projects under those licenses without…
Why do they hate APL?
User andinus provided the official explanation given by the openbsd project.
On a more philosophical level, the more radical end of the BSD licensing champions such as openbsd are extremists, just like the FSF/GNU people on the other end of the spectrum. Both want a world where ultimately software copyright, not to mention software patents, doesn't exist, source is available for everything and you can use that source for any purpose you like etc. They just have different ways of working towards that goal. The GNU end came up with a legal trick to use copyright law to try to force people to open up their software (copyleft licensing), whereas the BSD radicals just wish the whole copyright crap would go away and thus use the simplest possible license they can come up with.
So the Apache-2.0 license, although in many ways a BSD-like license, is written by and for corporate lawyers, which grates the openbsd people to no end.
Re: OpenSSL 3.0
#73One of the major improvements here: this finalizes the license change to Apache 2.0, which makes OpenSSL finally GPL-compatible. That removes one of the major reasons people had to avoid it. (Specifically, OpenSSL is now compatible with anything licensed "GPLv3", "GPLv3 or later", or "GPLv2 or later". It's not compatible with "GPLv2 only", but that's a relatively small amount of software.) Other major improvements: T…
> Specifically, OpenSSL is now compatible with anything licensed "GPLv3", "GPLv3 or later", or "GPLv2 or later". It's not compatible with "GPLv2 only", but that's a relatively small amount of software. Does this mean I cannot use openssl in my gpl-2.0-only program? How does that work? Doesn't gpl-2.0-later imply that I can also take the code and use it in gpl-2.0-only? Is there some tldr on this topic somewhere? I'm…
If you are the copyright holder, you can put a OpenSSL exception clause in your license which allows this to work. Debian requires such a clause for GPL software to link with OpenSSL prior to this change.
Re: OpenSSL 3.0
#74Earlier quoted context omitted.
I'm not even talking about clear cut API breakage. I'm talking about that if I do #include and build against the 1.2.x system installed OpenSSL I will get thousands of errors from headers internal to OpenSSL.
There's no such thing as OpenSSL 1.2 2018-09-11: 1.1.1-> 1.1.2 https://github.com/openssl/openssl/commit/a4a90a8a3bdcb9336b... 2018-09-27: 1.1.2 -> 3.0.0 https://github.com/openssl/openssl/commit/3a63dbef15b62b121c... There weren't any releases numbered 1.1.2
Sorry you're right I mixed up the version numbers. It was 1.1.x that I wanted to upgrade to from 1.0.x
Re: OpenSSL 3.0
#75Earlier quoted context omitted.
> Specifically, OpenSSL is now compatible with anything licensed "GPLv3", "GPLv3 or later", or "GPLv2 or later". It's not compatible with "GPLv2 only", but that's a relatively small amount of software. Does this mean I cannot use openssl in my gpl-2.0-only program? How does that work? Doesn't gpl-2.0-later imply that I can also take the code and use it in gpl-2.0-only? Is there some tldr on this topic somewhere? I'm…
> Does this mean I cannot use openssl in my gpl-2.0-only program? Correct. > How does that work? The GPL 2.0 and Apache-2.0 licenses contain terms which are incompatible with each other. > Doesn't gpl-2.0-later imply that I can also take the code and use it in gpl-2.0-only? Yes, in that case you can choose whether you use the code subject to the gpl 2.0, 3.0 or any later version. If you combine that code with some gp…
> > Does this mean I cannot use openssl in my gpl-2.0-only program?
> Correct.
Well that sucks. I guess I'll need to look into libressl.
Re: OpenSSL 3.0
#76Earlier quoted context omitted.
> Does this mean I cannot use openssl in my gpl-2.0-only program? Correct. > How does that work? The GPL 2.0 and Apache-2.0 licenses contain terms which are incompatible with each other. > Doesn't gpl-2.0-later imply that I can also take the code and use it in gpl-2.0-only? Yes, in that case you can choose whether you use the code subject to the gpl 2.0, 3.0 or any later version. If you combine that code with some gp…
> > Does this mean I cannot use openssl in my gpl-2.0-only program? > Correct. Well that sucks. I guess I'll need to look into libressl.
You might also check out GnuTLS which is under the LGPL 2.1+ license. If you're using Linux it's certainly already available from your package manager.
Re: OpenSSL 3.0
#77There's simply no way anybody will confuse OpenSSL 3.0, SSL 3, and TLS 1.3 :-)
I'm confused as to why they didn't skip a version release; for clarity's sake.
There was a proposal, which was declined: https://github.com/openssl/openssl/pull/8367
Re: OpenSSL 3.0
#78Earlier quoted context omitted.
> Does this mean I cannot use openssl in my gpl-2.0-only program? Correct. > How does that work? The GPL 2.0 and Apache-2.0 licenses contain terms which are incompatible with each other. > Doesn't gpl-2.0-later imply that I can also take the code and use it in gpl-2.0-only? Yes, in that case you can choose whether you use the code subject to the gpl 2.0, 3.0 or any later version. If you combine that code with some gp…
> > Does this mean I cannot use openssl in my gpl-2.0-only program? > Correct. Well that sucks. I guess I'll need to look into libressl.
>I guess I'll need to look into libressl.
libressl is under the original openssl license which is GPL incompatible.
Re: OpenSSL 3.0
#79Earlier quoted context omitted.
If you mean Apache License then, The original Apache license was similar to the Berkeley license, but source code published under version 2 of the Apache license is subject to additional restrictions and cannot be included into OpenBSD. In particular, if you use code under the Apache 2 license, some of your rights will terminate if you claim in court that the code violates a patent. A license can only be considered f…
Dumb question here, isn't a license already a contract in the first place?
Not a dumb question at all -- that's actually fairly controversial.
Many licenses are offered as part of a contract. But in _most_ jurisdictions (albeit not the one I'm standing in, which is Scotland) in order to have a contract one must have both a meeting of the minds and consideration. Many Free licenses don't have either. So they rely on copyright law: you don't have to agree to the license terms. If all you're doing is stuff that's allowed under law, you're fine. If you want to do something beyond that, you need permission and the license is what supplies permissions.
This is also where the "viral" nature of GPL licenses has its controversy: if the license is a contract, then you've agreed specific actions to take in order to be able to derive from the source. So (while it's not likely) a court could compel specific performance of that action, forcing you to release your code under the GPL (viral!). If it's not a contract, then by not agreeing to the terms you may have breached copyright, but there's no mechanism for anyone to _force_ you to do anything except stop breaching copyright. So no possibility that you will be required to release your source.
So you may be better off thinking of the license as a thing that may be bought or sold using a contract, but is itself not a contract. Proprietary software will often be bought or sold like this: you're not buying _the software_, you're buying _a license to use the software_. Where Free software licenses are often (but not always!) available for free.
But some licenses start looking like they stretch beyond the realm of pure copyright licenses, and that's where the controversy picks up again.
Re: OpenSSL 3.0
#80Earlier quoted context omitted.
> Does this mean I cannot use openssl in my gpl-2.0-only program? Correct. > How does that work? The GPL 2.0 and Apache-2.0 licenses contain terms which are incompatible with each other. > Doesn't gpl-2.0-later imply that I can also take the code and use it in gpl-2.0-only? Yes, in that case you can choose whether you use the code subject to the gpl 2.0, 3.0 or any later version. If you combine that code with some gp…
> > Does this mean I cannot use openssl in my gpl-2.0-only program? > Correct. Well that sucks. I guess I'll need to look into libressl.
[deleted]