Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

OpenSSL 3.0

wiki.openssl.org

Post reply on HN
Print view View original

81–90 of 106 posts

Re: OpenSSL 3.0

#81

Post by gray_-_wolf »

jabl wrote: post #69
gray_-_wolf wrote: post #67

Earlier quoted context omitted.

> Specifically, OpenSSL is now compatible with anything licensed "GPLv3", "GPLv3 or later", or "GPLv2 or later". It's not compatible with "GPLv2 only", but that's a relatively small amount of software. Does this mean I cannot use openssl in my gpl-2.0-only program? How does that work? Doesn't gpl-2.0-later imply that I can also take the code and use it in gpl-2.0-only? Is there some tldr on this topic somewhere? I'm…

> Does this mean I cannot use openssl in my gpl-2.0-only program? Correct. > How does that work? The GPL 2.0 and Apache-2.0 licenses contain terms which are incompatible with each other. > Doesn't gpl-2.0-later imply that I can also take the code and use it in gpl-2.0-only? Yes, in that case you can choose whether you use the code subject to the gpl 2.0, 3.0 or any later version. If you combine that code with some gp…

> > Does this mean I cannot use openssl in my gpl-2.0-only program?

> Correct.

Wait, I've tried to do some more reading and there are some things I do not understand:

1. I've done quick search over pacman database, and there are lot of packages that are either gpl or gpl2 that link against openssl. Does that mean that archlinux should be in deep legal trouble and it needs to drop few hundred packages (including coreutils, libgit2, kmod and others). Hell, even git itself links again openssl and that is gpl-2.0-only project. Does this make git illegal?

2. Are the "legal issues" comming from gpl-2.0-only side or from the openssl side? If from the gpl-2.0-only side, cannot I just add linking exception to the license to explicitely allow linking to openssl?

Re: OpenSSL 3.0

#82

Post by andrewaylett »

tpolzer wrote: post #24
JoshTriplett wrote: post #2

One of the major improvements here: this finalizes the license change to Apache 2.0, which makes OpenSSL finally GPL-compatible. That removes one of the major reasons people had to avoid it. (Specifically, OpenSSL is now compatible with anything licensed "GPLv3", "GPLv3 or later", or "GPLv2 or later". It's not compatible with "GPLv2 only", but that's a relatively small amount of software.) Other major improvements: T…

Doesn't "GPLv2 or later" specifically allow you to fork into "GPLv2 only"? How can a license be incompatible with only the latter then?

This is where some BSD folks get frustrated by some GPL folks. Compiling code under BSD with code under GPL into the same binary is not _relicensing_. Each section of code still has the same license, and any binaries must abide by the intersection of the licenses. It is indeed the case that the intersection of GPL and BSD is equivalent to GPL and therefore allowed by the GPL, but the BSD license remains on the portions (of code and of binary) that are BSD licensed.

Re: OpenSSL 3.0

#83

Post by my123 »

gray_-_wolf wrote: post #81
jabl wrote: post #69

Earlier quoted context omitted.

> Does this mean I cannot use openssl in my gpl-2.0-only program? Correct. > How does that work? The GPL 2.0 and Apache-2.0 licenses contain terms which are incompatible with each other. > Doesn't gpl-2.0-later imply that I can also take the code and use it in gpl-2.0-only? Yes, in that case you can choose whether you use the code subject to the gpl 2.0, 3.0 or any later version. If you combine that code with some gp…

> > Does this mean I cannot use openssl in my gpl-2.0-only program? > Correct. Wait, I've tried to do some more reading and there are some things I do not understand: 1. I've done quick search over pacman database, and there are lot of packages that are either gpl or gpl2 that link against openssl. Does that mean that archlinux should be in deep legal trouble and it needs to drop few hundred packages (including coreu…

The GPL has an exception for linking with system libraries. It's quite arguable that OpenSSL is one of them. The legal issues are coming from the GPLv2 side, yeah.

Re: OpenSSL 3.0

#84

Post by macintux »

Mizza wrote: post #5

I worry that this is going to break so many programs and scripts in the same way that the switch from Linux 2.6 did..

From other threads it sounds like the licensing may turn out to be a larger pain point than any backwards incompatibility in the code.

Re: OpenSSL 3.0

#85

Post by llimllib »

andrewaylett wrote: post #82
tpolzer wrote: post #24

Earlier quoted context omitted.

Doesn't "GPLv2 or later" specifically allow you to fork into "GPLv2 only"? How can a license be incompatible with only the latter then?

This is where some BSD folks get frustrated by some GPL folks. Compiling code under BSD with code under GPL into the same binary is not _relicensing_. Each section of code still has the same license, and any binaries must abide by the intersection of the licenses. It is indeed the case that the intersection of GPL and BSD is equivalent to GPL and therefore allowed by the GPL, but the BSD license remains on the portio…

Wouldn't it be the union of the licenses, not the intersection? Provisions of one license wouldn't go away because they're not present in the other?

Re: OpenSSL 3.0

#86

Post by 2OEH8eoCRo0 »

JoshTriplett wrote: post #2

One of the major improvements here: this finalizes the license change to Apache 2.0, which makes OpenSSL finally GPL-compatible. That removes one of the major reasons people had to avoid it. (Specifically, OpenSSL is now compatible with anything licensed "GPLv3", "GPLv3 or later", or "GPLv2 or later". It's not compatible with "GPLv2 only", but that's a relatively small amount of software.) Other major improvements: T…

It's incredible how much time and energy is spent on what license things use.

Re: OpenSSL 3.0

#87

Post by Hello71 »

gray_-_wolf wrote: post #81
jabl wrote: post #69

Earlier quoted context omitted.

> Does this mean I cannot use openssl in my gpl-2.0-only program? Correct. > How does that work? The GPL 2.0 and Apache-2.0 licenses contain terms which are incompatible with each other. > Doesn't gpl-2.0-later imply that I can also take the code and use it in gpl-2.0-only? Yes, in that case you can choose whether you use the code subject to the gpl 2.0, 3.0 or any later version. If you combine that code with some gp…

> > Does this mean I cannot use openssl in my gpl-2.0-only program? > Correct. Wait, I've tried to do some more reading and there are some things I do not understand: 1. I've done quick search over pacman database, and there are lot of packages that are either gpl or gpl2 that link against openssl. Does that mean that archlinux should be in deep legal trouble and it needs to drop few hundred packages (including coreu…

https://en.wikipedia.org/wiki/OpenSSL#Licensing

Re: OpenSSL 3.0

#88

Post by Tobu »

moonchild wrote: post #10

> OpenSSL versions with the same major number are API and ABI compatible Finally! > A proper HTTP(S) client in libcrypto supporting GET and POST, redirection, plain and ASN.1-encoded contents, proxies, and timeouts Is this really necessary? If you want a 'real' http client, you're probably using libcurl anyway (which is permissively licensed, more stable, and supports http/3).

HTTPS is a really huge scope to tackle, and requires a lot of policy which OpenSSL traditionally hasn't encoded (how to root trust, for example — possibly involving system stores or custom ones, stapling, pinning…). Also, OpenSSL generally is embedded in HTTP clients, and having distinct implementations of HTTP calling into each other from the same library seems terrible, with potential for security issues related to policy or implementation mismatches.

Of course, there's all the traditional bug surface of any code that talks to the network to consider as well.

Defining an interface for calling back into another HTTP library might be doable, but there's still a question of scope creep.

The motivation seems to be this fork and pull request:

- https://github.com/mpeylo/cmpossl

- https://github.com/openssl/openssl/issues/5926

The use case is far away from what most users of OpenSSL need, and could quite easily be tackled outside OpenSSL.

Re: OpenSSL 3.0

#89

Post by jabl »

gray_-_wolf wrote: post #81
jabl wrote: post #69

Earlier quoted context omitted.

> Does this mean I cannot use openssl in my gpl-2.0-only program? Correct. > How does that work? The GPL 2.0 and Apache-2.0 licenses contain terms which are incompatible with each other. > Doesn't gpl-2.0-later imply that I can also take the code and use it in gpl-2.0-only? Yes, in that case you can choose whether you use the code subject to the gpl 2.0, 3.0 or any later version. If you combine that code with some gp…

> > Does this mean I cannot use openssl in my gpl-2.0-only program? > Correct. Wait, I've tried to do some more reading and there are some things I do not understand: 1. I've done quick search over pacman database, and there are lot of packages that are either gpl or gpl2 that link against openssl. Does that mean that archlinux should be in deep legal trouble and it needs to drop few hundred packages (including coreu…

It's somewhat(?) common for GPL projects to add an exemption to the license to allow it to be linked to openssl. See e.g. https://people.gnome.org/~markmc/openssl-and-the-gpl.html

In other cases, there's the "system library" argument (the GPL contains language that if a library the program links to is a "system library" the GPL "virality" doesn't extend there).

And in yet other cases, people just ignore it.

If you want to play it safe, just use GnuTLS, or Mozilla NSS.

Re: OpenSSL 3.0

#90

Post by wcoenen »

JoshTriplett wrote: post #2

One of the major improvements here: this finalizes the license change to Apache 2.0, which makes OpenSSL finally GPL-compatible. That removes one of the major reasons people had to avoid it. (Specifically, OpenSSL is now compatible with anything licensed "GPLv3", "GPLv3 or later", or "GPLv2 or later". It's not compatible with "GPLv2 only", but that's a relatively small amount of software.) Other major improvements: T…

> TLS1.3 support

TLS 1.3 support was already added in OpenSSL 1.1.1

https://www.openssl.org/news/openssl-1.1.1-notes.html

Post reply on HN