|
|
Log in / Subscribe / Register

OpenSSL 1.0.0 released

OpenSSL 1.0.0 released

Posted Mar 30, 2010 3:07 UTC (Tue) by foom (subscriber, #14868)
In reply to: OpenSSL 1.0.0 released by busterb
Parent article: OpenSSL 1.0.0 released

Available under GPLv2 only: basically useless for a distro.


to post comments

OpenSSL 1.0.0 released

Posted Mar 30, 2010 3:20 UTC (Tue) by foom (subscriber, #14868) [Link]

Sorry, read too quickly. They also have a "license exemption" for FOSS licenses.

http://www.polarssl.org/license_exception

But, that has two conditions that still make it still unusable by a linux distro as a replacement for
GNUTLS/OpenSSL:

> A FOSS application developer ("you" or "your") may distribute a Derivative Work provided that
> you and the Derivative Work meet all of the following conditions:

[...]

> 4. You distribute Independent Works in object code or executable form with the complete
> corresponding machine-readable source code on the same medium and under the same FOSS
> license applying to the object code or executable forms;

Not the case for a Linux distro: source is usually not distributed on the same CD as binaries.
Furthermore, source code for many programs is available under different (less restrictive) terms
than the object code (because the object code is only available under the intersection of the
licenses for all pieces of source code.

> 5. All works that are aggregated with the Program or the Derivative Work on a medium or
> volume of storage are not derivative works of the Program, Derivative Work or FOSS
> Application, and must reasonably be considered independent and separate works.

Not the case for a Linux distro: in fact many such Derivative Works are derivative works of other
such Derivative Works.

OpenSSL 1.0.0 released

Posted Mar 30, 2010 20:30 UTC (Tue) by samroberts (subscriber, #46749) [Link] (2 responses)

Most distros are chock full of GPLv2 licensed code, what is the problem here?

OpenSSL 1.0.0 released

Posted Mar 30, 2010 20:58 UTC (Tue) by Darkmere (subscriber, #53695) [Link] (1 responses)

Libraries licensed under GPL-2 are somewhat bad and a problematic situation for distributors.

OpenSSL 1.0.0 released

Posted Mar 30, 2010 21:36 UTC (Tue) by foom (subscriber, #14868) [Link]

And we're not just talking about *any* old library here: SSL is used (many times indirectly) in
programs of just about every license imaginable. So, if you're going to choose an SSL
implementation to link against for another infrastructure library which is permissively licensed
(say, libldap, or libcurl), you really don't want to choose one which is only usable by GPLv2
programs.

BTW, insane thing I just noticed: gnutls is available under the LGPL, but gnutls' openssl
compatibility layer (libgnutls-openssl) is available under the GPL. Crazy...


Copyright © 2026, Eklektix, Inc.
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds