git/list[1] front-page[2] threads[3] people[4] search[5] about
 

Re: Will OpenSSL's license change impact us?

From
brian m. carlson <sandals@crustytoothpaste.net>
Date
Mar 25, 2017, 21:44 UTC
Message-ID
<20170325214427.f3kdxgrldpnar4ag@genre.crustytoothpaste.net>
In-Reply-To
<CACBZZX6F47uC9jLxppgkUnwVpGV2jpzzP4kwTuqKgayCevomeA@mail.gmail.com>
On Sat, Mar 25, 2017 at 12:51:52AM +0100, Ævar Arnfjörð Bjarmason wrote:
Show 12 quoted lines
> They're changing their license[1] to Apache 2 which unlike the current
> fuzzy compatibility with the current license[2] is explicitly
> incompatible with GPLv2[3].
> 
> We use OpenSSL for SHA1 by default unless NO_OPENSSL=YesPlease.
> 
> This still hasn't happened, but given the lifetime of git versions
> packaged up by distros knowing sooner than later if this is going to
> be a practical problem would be good.
> 
> If so perhaps we could copy the relevant subset of the code int our
> tree, or libressl's, or improve block-sha1.

I think that most distros don't link against OpenSSL because they can't take advantage of the system library exception. I don't think that's going to change.

If we want to consider performance-related concerns, I think the easier solution is using Nettle, which is LGPL 2.1. Considering that the current opinions for a new hash function are moving in the direction of SHA-3, which Nettle has, but OpenSSL does not, I think that might be a better decision overall. It was certainly the implementation I would use if I were to implement it.

-- 
brian m. carlson / brian with sandals: Houston, Texas, US
+1 832 623 2791 | https://www.crustytoothpaste.net/~bmc | My opinion only
OpenPGP: https://keybase.io/bk2204
Previous: Ævar Arnfjörð BjarmasonNext: Ævar Arnfjörð Bjarmason
Message 4 of 11 in “Will OpenSSL's license change impact us?”
  1. Ævar Arnfjörð BjarmasonMar 24, 2017
  2. demerphqMar 25, 2017
  3. Ævar Arnfjörð BjarmasonMar 25, 2017
  4. brian m. carlsonMar 25, 2017
  5. Ævar Arnfjörð BjarmasonMar 25, 2017
  6. Jeff KingMar 26, 2017
  7. Ævar Arnfjörð BjarmasonMar 25, 2017
  8. demerphqMar 25, 2017
  9. Ævar Arnfjörð BjarmasonMar 25, 2017
  10. Theodore Ts'oMar 25, 2017
  11. Ævar Arnfjörð BjarmasonMar 25, 2017

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.