Live data from Hacker News

Sequoia PGP is now LGPL 2.0

sequoia-pgp.org

31–40 of 69 posts

Re: Sequoia PGP is now LGPL 2.0

#31
post #20

Earlier quoted context omitted.

The parent comment literally posted the same link. I am aware of the replacement concept and how it is technically distinct from an outright ban on static linking. > That's possible with static linking, that's possible with other languages than the ones relying on a linker step, etc. We are talking about Rust, not languages other than Rust. Could you walk us through how you would offer a Rust binary with a statically…

I don't think it matters that it is impractical. It isn't the FSF's job to write Rust tooling, it is to write licenses. I do agree that that the concern is becoming much more orthogonal both to the FSF's goals and to the way software is built. But that doesn't change the fact that the license works the way it does, nor does it let you insert the words 'dynamic linking' in it.

At no point did I suggest it requires dynamic linking. Again, I understand how the license works. I’m talking about why you would choose it if it were this difficult for someone to use your technology.

In many projects, ensuring the freedom to replace a copy of the library just isn’t worth all this trouble. If I make my code LGPL, I’m mostly shifting that burden onto other people who want to use it, not myself, and so there are presumably very few LGPL authors who are actually motivated to fix all these problems for someone else. Further, most corps will simply not use the LGPL software, because difficulty looks like license trouble. In that sense, this does look a bit like a job for the FSF, to be honest. At this rate, LGPL use will die out, and not in favour of GPL.

In another sense, a proprietary product choosing to embed my component would be a massive victory for the ecosystem it is built to support. I think that is also true for Sequoia. I just straight up don’t care about the ability to replace my component within another proprietary program. If they are using it at all, they will presumably update it themselves, it would be a pretty central dependency; if they don’t want to, they can just build their own version. I'm just hoping to get anyone to pull the trigger and drop their commercial alternative in favour of the open standard my component implements. So is Sequoia; their livelihood depends on it. Will they hack on rustc to make it easier to use? Somehow I think they will not! This makes no sense to me.

A lot of open source today cares less about LGPL-style replaceability and more about adoption of an open standard that is separate from the code itself. In this case it’s PGP-compatible encryption and signing, which has famously never really taken off and by some odd coincidence never had a project of Sequoia's quality with e.g. a BSD-style license that you could simply slap in a project and depend on. (Although much of the blame deservedly goes to GPG providing over a hundred intricate and one must presume deliberately hard-to-reproduce APIs.) In Kubernetes-land, the concept of being k8s-compatible and interoperable is arguably responsible for more freedom than the core software itself. This is simply true of so many things, and further you must admit: Sequoia as code is 100% replaceable by a motivated corporation, if only there were more demand for being compatible with PGP. If you’re still thinking in 2021 that if PGP were in demand the only reason Amazon would be shipping software without a user-serviceable Sequoia package is the LGPL, you haven’t seen how many hundreds of thousands of dev job ads they posted in the last month. Adoption of the open standard is just more important than anyone’s actual code, up until the codebase is so big it would be prohibitively difficult to replicate. If you think your code in particular is special, maybe you're right, or maybe it's just the rare piece of software whose existence is not entirely justified by an open standard.

Re: Sequoia PGP is now LGPL 2.0

#32

From the article: > Delta Chat planned an iOS app, but because Apple does not allow GPL software in their App store, the Delta Chat developers couldn’t use Sequoia. I don't think this is true in theory or in practice, for the iOS App store or the Mac App Store. Take the WordPress app for example.

yep, here's a list of GPL apps on iOS: https://en.wikipedia.org/wiki/List_of_free_and_open-source_i...

moreover, LGPL makes it even worse for using library with app stores.

Re: Sequoia PGP is now LGPL 2.0

#33

Earlier quoted context omitted.

> The way you'd have to do static linking isn't something that is easy to set up in most build systems, it's trivial in CMake which is the most used buildsystem in languages with a linker, just set -DBUILD_SHARED_LIBS=0 on the command line > and deprives you of the ability to do certain post-build steps (such as signing the build) why would it ? I build my app as a set of static libs linked together in the end and th…

> it's trivial in CMake which is the most used buildsystem in languages with a linker, just set -DBUILD_SHARED_LIBS=0 on the command line Building or using static libraries isn't hard. Doing so in a way that doesn't violate the LGPL's replacement requirement is. The document you yourself linked says this about developing statically-linked libraries with the GPL: > If you statically link against an LGPLed library, you…

I don't understand, if you can build your app statically then you have the .o ; a static library libfoo.a is just an archive of .o files that pretty much any Unix system can extract

Re: Sequoia PGP is now LGPL 2.0

#34

Is Sequoia PGP a drop in replacement for GPG? How do I go about integrating with Git and what not?

tldr: not yet

I tried a bit (i'm only using gpg for my pass keyring, but as pass is dead simple i wanted to write a clone and hack around sequoia), but i found the command-line interface to be missing some features. As a showstopper it doesn't seem to allow on-the-fly decryption of secret keys to sign/encrypt stuff (at least i didn't get it to work). Also, there are very few options for editing secret keys (subkeys, managing certifications). Keyrings are amusingly barebone: they are just concatenated keys (as armored ascii), seems to do the job.

I'm confident this will improve in the matter of a handful of months tho. I didn't check but i'd bet this is mostly a problem of writing the front-end cli code to advertise all the library features. They seem to be pretty active, 1.0 on the lib was cut not so long ago and 'sq' (the executable) is still pre 1.0. Other execs are sqv (verifier) and sqop ("stateless command interface", seems to be oriented at scripting, apparently aiming to drive interop between implementations).

Re: Sequoia PGP is now LGPL 2.0

#35
post #20

Earlier quoted context omitted.

I don't think it matters that it is impractical. It isn't the FSF's job to write Rust tooling, it is to write licenses. I do agree that that the concern is becoming much more orthogonal both to the FSF's goals and to the way software is built. But that doesn't change the fact that the license works the way it does, nor does it let you insert the words 'dynamic linking' in it.

At no point did I suggest it requires dynamic linking. Again, I understand how the license works. I’m talking about why you would choose it if it were this difficult for someone to use your technology. In many projects, ensuring the freedom to replace a copy of the library just isn’t worth all this trouble. If I make my code LGPL, I’m mostly shifting that burden onto other people who want to use it, not myself, and s…

[deleted]

Re: Sequoia PGP is now LGPL 2.0

#36

Earlier quoted context omitted.

> it's trivial in CMake which is the most used buildsystem in languages with a linker, just set -DBUILD_SHARED_LIBS=0 on the command line Building or using static libraries isn't hard. Doing so in a way that doesn't violate the LGPL's replacement requirement is. The document you yourself linked says this about developing statically-linked libraries with the GPL: > If you statically link against an LGPLed library, you…

I don't understand, if you can build your app statically then you have the .o ; a static library libfoo.a is just an archive of .o files that pretty much any Unix system can extract

The final link line in a build system for an application is generally `cc -o app file1.o file2.o file3.o ... -llib1 -lib2 -llib3`. Turning that link line into one that produces an app.o that can be combined with liblgpllib.a to produce an equivalent app file is nontrivial. (And before you say just add all the .o files into a single .a file, no, that is not equivalent. Because Unix linking sucks).

Re: Sequoia PGP is now LGPL 2.0

#37

From the article: > Delta Chat planned an iOS app, but because Apple does not allow GPL software in their App store, the Delta Chat developers couldn’t use Sequoia. I don't think this is true in theory or in practice, for the iOS App store or the Mac App Store. Take the WordPress app for example.

yep, here's a list of GPL apps on iOS: https://en.wikipedia.org/wiki/List_of_free_and_open-source_i...

My understanding is that Apple's terms of service are incompatible with the GPL. If you hold the copyright yourself though, you have no need to abide by the license and can distribute it on the App Store under different terms.

Re: Sequoia PGP is now LGPL 2.0

#38

From the article: > Delta Chat planned an iOS app, but because Apple does not allow GPL software in their App store, the Delta Chat developers couldn’t use Sequoia. I don't think this is true in theory or in practice, for the iOS App store or the Mac App Store. Take the WordPress app for example.

yep, here's a list of GPL apps on iOS: https://en.wikipedia.org/wiki/List_of_free_and_open-source_i...

I took a brief look at a few of those and it looked like they either only included code that they owned the copyright to or that was under a more permissive license than GPL.

Putting your own GPL code in your iOS app is fine. The issue with GPL on the iOS store arises when you put someone else's GPL code in your iOS app.

The problem is that that the terms of use that the user must agree to in order to use the store place restrictions on what the user can do with the software they obtain through the store. These restriction are at odds with the GPL requirement that you not place additional restrictions on GPL software you distribute.

For Apple to distribute GPLed software on the Apple store, the copyright holder has to give them permission to do so on terms other than GPL. In the case where the developer who places the GPL app on the store is the copyright holder to the entire app this is no problem. They have had to agree to Apple's terms for developers in order to be allowed to upload. I've forgotten what exactly is in those terms, but I'm almost certain there is something in there that requires the developer to give Apple permission to distribute.

That permission that a developer of a GPLed app (or an app under any other license) gives to Apple to make and distribute copies only applies to code owned by that developer. If they have included any third party GPL code from owners who have not granted Apple that permission, then the app as a whole will not be legal for Apple to distribute.

In summary, distributing on the Apple app store requires that you give Apple a license to make and distribute copies under Apple's terms, which are not GPL compatible. Apple does not care what license you give to anyone else, so it is fine to go with "GPL for everyone plus this special license for Apple".

Re: Sequoia PGP is now LGPL 2.0

#39
post #3

I know that a few years ago there was some discussion about which license to choose, with LGPL and MPLv2 being two strong contenders, and it was noted (by Neal himself actually) that MPLv2 is much easier to use when static linking (as is the norm in the Rust community). Why was LGPL chosen instead? The LGPL requires that all applications that consume it as a static library provide the tools to re-link the binary agai…

Quite right. I contribute a Rust component to a larger AGPL-3.0 project and went with MPL-2.0 over LGPL for this reason. A bit off-topic, but I wonder if the FSF's ideas about dynamic linking have been litigated yet. It has always seemed a pretty suspicious to me that a dynamically linked program, existing only in volatile memory, could really be a copyright work at all, let alone a derivative one. I found this LWN a…

Linking weather dynamic and static is basically connecting interfaces.

Law is (in my understanding) normally based on concepts not technical implementation details.

As such for me the idea that there is a difference legal between static linking, dynamic linking or "linking together by a unix-pipe" sounds strange and irritating.

Instead I would argue weather or not something is a derivative of something else should depend on the conceptual usage of that thing, not some technical implementation detail.

Re: Sequoia PGP is now LGPL 2.0

#40
post #3

I know that a few years ago there was some discussion about which license to choose, with LGPL and MPLv2 being two strong contenders, and it was noted (by Neal himself actually) that MPLv2 is much easier to use when static linking (as is the norm in the Rust community). Why was LGPL chosen instead? The LGPL requires that all applications that consume it as a static library provide the tools to re-link the binary agai…

Quite right. I contribute a Rust component to a larger AGPL-3.0 project and went with MPL-2.0 over LGPL for this reason. A bit off-topic, but I wonder if the FSF's ideas about dynamic linking have been litigated yet. It has always seemed a pretty suspicious to me that a dynamically linked program, existing only in volatile memory, could really be a copyright work at all, let alone a derivative one. I found this LWN a…

https://en.wikipedia.org/wiki/MAI_Systems_Corp._v._Peak_Comp.... would suggest that a program that exists in volatile memory does count for copyright purposes.
Post reply on HN