From: Alex Vong <alexvong1995@gmail.com>
To: Mark H Weaver <mhw@netris.org>
Cc: guix-devel@gnu.org
Subject: Re: openssl is now a dependency of guix: possible license conflict?
Date: Fri, 18 Aug 2017 22:44:04 +0800 [thread overview]
Message-ID: <87vall7x6z.fsf@gmail.com> (raw)
In-Reply-To: <878tii8x2k.fsf@netris.org> (Mark H. Weaver's message of "Thu, 17 Aug 2017 03:36:51 -0400")
[-- Attachment #1: Type: text/plain, Size: 2280 bytes --]
Mark H Weaver <mhw@netris.org> writes:
> Mark H Weaver <mhw@netris.org> writes:
>
>> Alex Vong <alexvong1995@gmail.com> writes:
>>
>>> Recently, guix changes to use guile-git for 'guix pull', which is a
>>> libgit2 binding for guile, while libgit2 itself uses openssl to talk
>>> over https.
>>>
>>> Now the potential problem is that guix is licensed in gpl3+ while
>>> openssl is licensed in openssl. It is well-known the two licenses have
>>> incompatibility disallowing one from distributing the result of linking
>>> a gpl program with openssl[0].
>>
>> Thanks for bringing this to our attention. I looked into this, and it
>> turns out that Debian's libgit2 package no longer depends on OpenSSL:
>>
>> https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=798421
>>
>> libgit2 can use libcurl for HTTPS support, in which case it does not
>> need OpenSSL.
>
> I was mistaken about this. My mistake was based on the following
> statement from libgit2's CHANGELOG.md for v0.23:
>
> * If libcurl is installed, we will use it to connect to HTTP(S)
> servers.
>
> However, further investigation reveals that on GNU/Linux systems,
> libgit2's HTTPS support requires OpenSSL. Debian's libgit2 no longer
> supports HTTPS.
>
> There exist patches for libgit2 to support the mbedTLS library, but it
> is not yet clear whether they will be accepted upstream:
>
> https://github.com/libgit2/libgit2/pull/3462
> https://github.com/libgit2/libgit2/pull/3935
>
It seems julia had merge the mbedtls patches, so they should be working:
https://github.com/JuliaLang/julia/pull/22614
Should we also adopt the patches?
Another solution I can think of is to change the (guix git) module so
that it supports using plain git to clone and fetch the repo. We can
have an option to choose using either libgit2 or git in the configure
script.
> OpenSSL is currently attempting to change their license to the Apache
> License v2.0, which is compatible with the GNU GPL v3, but it's not
> clear how long it will take for them to obtain permission from the large
> number of individual copyright owners:
>
> https://www.openssl.org/blog/blog/2017/03/22/license/
>
This is great. They start doing it in 2015, time flies:
https://www.openssl.org/blog/blog/2015/08/01/cla/
> Mark
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 832 bytes --]
next prev parent reply other threads:[~2017-08-18 14:44 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-08-17 0:31 openssl is now a dependency of guix: possible license conflict? Alex Vong
2017-08-17 2:29 ` Mark H Weaver
2017-08-17 7:36 ` Mark H Weaver
2017-08-18 14:44 ` Alex Vong [this message]
2017-08-18 18:06 ` Leo Famulari
2017-08-18 21:21 ` Mark H Weaver
2017-08-19 12:51 ` Adonay Felipe Nogueira
2017-08-22 8:32 ` Ludovic Courtès
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=87vall7x6z.fsf@gmail.com \
--to=alexvong1995@gmail.com \
--cc=guix-devel@gnu.org \
--cc=mhw@netris.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this external index
https://git.savannah.gnu.org/cgit/guix.git
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.