OpenSSL 3.0.0 released [LWN.net]

OpenSSL 3.0.0 released

Posted Sep 7, 2021 15:52 UTC (Tue) by josh (subscriber, #17465)
Parent article: OpenSSL 3.0.0 released

And there was much rejoicing.

License issues due to the original OpenSSL license were a headache when I first started working in Open Source 20 years ago. I'm glad that those issues can now be a thing of the past.

to post comments

OpenSSL 3.0.0 released

Posted Sep 7, 2021 18:06 UTC (Tue) by joib (subscriber, #8541) [Link] (2 responses)

Now we can spend the following 20 years arguing whether Apache-2.0 really is incompatible with GPL-2.0-only! :)

OpenSSL 3.0.0 released

Posted Sep 7, 2021 18:45 UTC (Tue) by josh (subscriber, #17465) [Link] (1 responses)

Many people (myself included) believe it is incompatible, and many projects acknowledge it as such. There are relatively few GPLv2-only projects out there. Any GPLv3 project is compatible, any v2-or-later project is compatible (though I *completely* understand the aversion to "or later" licensing), and I think energy spent on arguing for the compatibility of v2 with Apache-2.0 would be better spent relicensing projects to v3 or v2-and-v3, or if absolutely necessary, v2 with an exception for Apache-2.0.

Also, the Linux kernel has already made arrangements with several authors of crypto code in OpenSSL to use that code under more permissive licensing that's GPLv2-compatible. Such arrangements may work for other GPLv2 projects that need specific bits.

OpenSSL 3.0.0 released

Posted Sep 20, 2021 22:44 UTC (Mon) by augustz (guest, #37348) [Link]

Many folks using Apache or MIT licenses are not on the same page with FSF, especially around GPLv3.

Here is the ASF statement: "We avoid GPLv3 software because merely linking to it is considered by the GPLv3 authors to create a derivative work. We want to honor their license. Unless GPLv3 licensors relax this interpretation of their own license regarding linking, our licensing philosophies are fundamentally incompatible."