From mboxrd@z Thu Jan 1 00:00:00 1970 From: Alex Vong Subject: Re: openssl is now a dependency of guix: possible license conflict? Date: Fri, 18 Aug 2017 22:44:04 +0800 Message-ID: <87vall7x6z.fsf@gmail.com> References: <87tw17ox0x.fsf@gmail.com> <87y3qjncyi.fsf@netris.org> <878tii8x2k.fsf@netris.org> Mime-Version: 1.0 Content-Type: multipart/signed; boundary="=-=-="; micalg=pgp-sha512; protocol="application/pgp-signature" Return-path: Received: from eggs.gnu.org ([2001:4830:134:3::10]:34012) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1diiVh-0007mh-99 for guix-devel@gnu.org; Fri, 18 Aug 2017 10:44:30 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1diiVe-0003jJ-65 for guix-devel@gnu.org; Fri, 18 Aug 2017 10:44:29 -0400 Received: from mail-pg0-x22b.google.com ([2607:f8b0:400e:c05::22b]:37131) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_128_CBC_SHA1:16) (Exim 4.71) (envelope-from ) id 1diiVd-0003hi-Vx for guix-devel@gnu.org; Fri, 18 Aug 2017 10:44:26 -0400 Received: by mail-pg0-x22b.google.com with SMTP id y129so65753516pgy.4 for ; Fri, 18 Aug 2017 07:44:24 -0700 (PDT) In-Reply-To: <878tii8x2k.fsf@netris.org> (Mark H. Weaver's message of "Thu, 17 Aug 2017 03:36:51 -0400") List-Id: "Development of GNU Guix and the GNU System distribution." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org Sender: "Guix-devel" To: Mark H Weaver Cc: guix-devel@gnu.org --=-=-= Content-Type: text/plain Mark H Weaver writes: > Mark H Weaver writes: > >> Alex Vong writes: >> >>> Recently, guix changes to use guile-git for 'guix pull', which is a >>> libgit2 binding for guile, while libgit2 itself uses openssl to talk >>> over https. >>> >>> Now the potential problem is that guix is licensed in gpl3+ while >>> openssl is licensed in openssl. It is well-known the two licenses have >>> incompatibility disallowing one from distributing the result of linking >>> a gpl program with openssl[0]. >> >> Thanks for bringing this to our attention. I looked into this, and it >> turns out that Debian's libgit2 package no longer depends on OpenSSL: >> >> https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=798421 >> >> libgit2 can use libcurl for HTTPS support, in which case it does not >> need OpenSSL. > > I was mistaken about this. My mistake was based on the following > statement from libgit2's CHANGELOG.md for v0.23: > > * If libcurl is installed, we will use it to connect to HTTP(S) > servers. > > However, further investigation reveals that on GNU/Linux systems, > libgit2's HTTPS support requires OpenSSL. Debian's libgit2 no longer > supports HTTPS. > > There exist patches for libgit2 to support the mbedTLS library, but it > is not yet clear whether they will be accepted upstream: > > https://github.com/libgit2/libgit2/pull/3462 > https://github.com/libgit2/libgit2/pull/3935 > It seems julia had merge the mbedtls patches, so they should be working: https://github.com/JuliaLang/julia/pull/22614 Should we also adopt the patches? Another solution I can think of is to change the (guix git) module so that it supports using plain git to clone and fetch the repo. We can have an option to choose using either libgit2 or git in the configure script. > OpenSSL is currently attempting to change their license to the Apache > License v2.0, which is compatible with the GNU GPL v3, but it's not > clear how long it will take for them to obtain permission from the large > number of individual copyright owners: > > https://www.openssl.org/blog/blog/2017/03/22/license/ > This is great. They start doing it in 2015, time flies: https://www.openssl.org/blog/blog/2015/08/01/cla/ > Mark --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEdZDkzSn0Cycogr9IxYq4eRf1Ea4FAlmW/TUACgkQxYq4eRf1 Ea4bqg/8C8DhB1/pH/7Jis8L8uRGzWTfPbNRP5UIcuahGFl0xCLpt49Z7wZLVytf brMM2QlVxysZ458/ZcXixGuWsi3HMYLfzI8M3xU7anfgmT4PMfbP1etkh4/bU8uJ fxAf8k145yHHTUe/sT/I2RFD6fqc0bWr9lPG4AZv7WaerOoM5FvY9fO5YHpOZsp/ M1/CPxwW16yiEgz2MJ+xU6tT/eRKELN5U9oGL67PDdM2StOtEXUNJwjLkS5EglCO +aHisOvFTISdCJHvS01JeCJRR0tPMzKXT/3tlTXjN5piM4xmQDxrfOm4VaKzMjt6 n2xH9gUHWLUPgNRAd/N/0Zy9775eo9wrthFTINPWz4gcnrsEtL27c2p+m6PMe2BQ IDGny+HSdYKVzRmUTWhpGeIXgE+sV3N3qn1qC9mmz0dSqspOXztCdVWMK+DiM5Qn 18mxMbyevhammcGZwghOxoNmL3lvoMa3KXMBZAMQ/nq2ggmDsj34eEzfNRv3sVVV g33aZ5E+G2MzfZLQSUhdknFa1qAai+cNpHQAA5ck01eTpHmuNSf2corYSqB+c2WT WJoR7BUkN+xOM3XB7M1tT0HJJPEz3Cq7DpVC5w7KPvfDnZkz9B6f1pdKqRmpd0Ge /mjYYMasAFBTkhmYVg4l+p0pNIwRMckdcDypJkCB8NGzgVW3P1k= =gpjD -----END PGP SIGNATURE----- --=-=-=--