git/list[1] front-page[2] threads[3] people[4] search[5] about
 

Re: Will OpenSSL's license change impact us?

From
Ævar Arnfjörð Bjarmason <avarab@gmail.com>
Date
Mar 25, 2017, 21:50 UTC
Message-ID
<CACBZZX6smBoWg1KKAT=dc0Bn1n4E2chtRyO6xVisACrtGuHzEw@mail.gmail.com>
In-Reply-To
<20170325211135.62sa76hlvyiexvje@thunk.org>
On Sat, Mar 25, 2017 at 10:11 PM, Theodore Ts'o <tytso@mit.edu> wrote:
Show 28 quoted lines
> On Sat, Mar 25, 2017 at 06:51:21PM +0100, Ęvar Arnfjörš Bjarmason wrote:
>> In GPLv3 projects only, not GPLv2 projects. The paragraphs you're
>> quoting all explicitly mention v3 only, so statements like
>> "incompatible in one direction" only apply to Apache 2 && GPLv3, but
>> don't at all apply to GPLv2, which is what we're using.
>
> It's complicated.
>
> It's fair enough to say that the FSF adopts a copyright maximalist
> position, and by their interpretation, the two licenses are
> incompatible, and it doesn't matter whether the two pieces of code are
> linked staticaly, dynamically, or one calls the other over an RPC
> call.
>
> Not everyone agrees with their legal analysis.  May I suggest that we
> not play amateur lawyer on the mailing list, and try to settle this
> here?  Each distribution can make its own decision, which may be based
> on its legal advice, the local laws and legal precedents in which they
> operate, etc.  And indeed, different distributions have already come
> to different conclusions with respect to various license compatibility
> issues.  (Examples: dynamically linking GPL programs with OpenSSL
> libraries under the old license, distributing ZFS modules for Linux,
> etc.)
>
> We don't expect lawyers to debug edge cases in a compiler's code
> generation.  Programmers shouldn't try to parse edge cases in the law,
> or try to use a soldering iron, unless they have explicit training and
> expertise to do so.  :-)

Yeah fully agree with the internet lawyering. I'm not looking for that, just seeing if someone knows if this might be an issue for at least some distros, then it's something for us to keep an eye on if OpenSSL's license changes, and a sane default for us to adopt might be to e.g. require that some flag be passed to the Makefile declaring "yes I'm OK with combining AL2 + GPLv2" if the OpenSSL version is newer than so-and-so.

Previous: Theodore Ts'o
Message 11 of 11 in “Will OpenSSL's license change impact us?”
  1. Ævar Arnfjörð BjarmasonMar 24, 2017
  2. demerphqMar 25, 2017
  3. Ævar Arnfjörð BjarmasonMar 25, 2017
  4. brian m. carlsonMar 25, 2017
  5. Ævar Arnfjörð BjarmasonMar 25, 2017
  6. Jeff KingMar 26, 2017
  7. Ævar Arnfjörð BjarmasonMar 25, 2017
  8. demerphqMar 25, 2017
  9. Ævar Arnfjörð BjarmasonMar 25, 2017
  10. Theodore Ts'oMar 25, 2017
  11. Ævar Arnfjörð BjarmasonMar 25, 2017

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.