From mboxrd@z Thu Jan 1 00:00:00 1970 From: Mark H Weaver Subject: Re: openssl is now a dependency of guix: possible license conflict? Date: Thu, 17 Aug 2017 03:36:51 -0400 Message-ID: <878tii8x2k.fsf@netris.org> References: <87tw17ox0x.fsf@gmail.com> <87y3qjncyi.fsf@netris.org> Mime-Version: 1.0 Content-Type: text/plain Return-path: Received: from eggs.gnu.org ([2001:4830:134:3::10]:52387) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1diFMi-0006v3-Oz for guix-devel@gnu.org; Thu, 17 Aug 2017 03:37:17 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1diFMe-0004KS-Kq for guix-devel@gnu.org; Thu, 17 Aug 2017 03:37:16 -0400 Received: from world.peace.net ([50.252.239.5]:43276) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_128_CBC_SHA1:16) (Exim 4.71) (envelope-from ) id 1diFMe-0004K4-Gn for guix-devel@gnu.org; Thu, 17 Aug 2017 03:37:12 -0400 In-Reply-To: <87y3qjncyi.fsf@netris.org> (Mark H. Weaver's message of "Wed, 16 Aug 2017 22:29:57 -0400") List-Id: "Development of GNU Guix and the GNU System distribution." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org Sender: "Guix-devel" To: Alex Vong Cc: guix-devel@gnu.org Mark H Weaver writes: > Alex Vong writes: > >> Recently, guix changes to use guile-git for 'guix pull', which is a >> libgit2 binding for guile, while libgit2 itself uses openssl to talk >> over https. >> >> Now the potential problem is that guix is licensed in gpl3+ while >> openssl is licensed in openssl. It is well-known the two licenses have >> incompatibility disallowing one from distributing the result of linking >> a gpl program with openssl[0]. > > Thanks for bringing this to our attention. I looked into this, and it > turns out that Debian's libgit2 package no longer depends on OpenSSL: > > https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=798421 > > libgit2 can use libcurl for HTTPS support, in which case it does not > need OpenSSL. I was mistaken about this. My mistake was based on the following statement from libgit2's CHANGELOG.md for v0.23: * If libcurl is installed, we will use it to connect to HTTP(S) servers. However, further investigation reveals that on GNU/Linux systems, libgit2's HTTPS support requires OpenSSL. Debian's libgit2 no longer supports HTTPS. There exist patches for libgit2 to support the mbedTLS library, but it is not yet clear whether they will be accepted upstream: https://github.com/libgit2/libgit2/pull/3462 https://github.com/libgit2/libgit2/pull/3935 OpenSSL is currently attempting to change their license to the Apache License v2.0, which is compatible with the GNU GPL v3, but it's not clear how long it will take for them to obtain permission from the large number of individual copyright owners: https://www.openssl.org/blog/blog/2017/03/22/license/ Mark