9 ms·

One of the major improvements here: this finalizes the license change to Apache 2.0, which makes OpenSSL finally GPL-compatible. That removes one of the major r

One of the major improvements here: this finalizes the license change to Apache 2.0, which makes OpenSSL finally GPL-compatible. That removes one of the major reasons people had to avoid it. (Specifically, OpenSSL is now compatible with anything licensed "GPLv3", "GPLv3 or later", or "GPLv2 or later". It's not compatible with "GPLv2 only", but that's a relatively small amount of software.) Other major improvements: TLS1.3 support, Linux kernel TLS support (hand off crypto to the kernel and then read/write as though you had a normal file descriptor and let the kernel handle the crypto), and opaque low-level structures (no more dependencies on OpenSSL internals).

LeoPanthera 6y ago
Isn't the Linux kernel "GPLv2 only"?
- JoshTriplett 6y ago
  Yes, but it's unlikely to link in a userspace library. This does prevent adapting code from OpenSSL to put in the kernel, but there are plenty of other sources to adapt code from. There are a few other notable codebases that are GPLv2-only, but most projects using the GPL use either "v2 or later" or "v3 or later".
wallacoloo 6y ago
> Other major improvements: TLS1.3 support OpenSSL 1.1.1 already supports TLS 1.3
NiekvdMaas 6y ago
What does the license change mean for LibreSSL (OpenSSL fork) and GnuTLS which have "a better license" as their main selling point?
- throwaway2048 6y ago
  libressl does not have a different license
  - jabl 6y ago
    My understanding is that new libressl code is under the openbsd license, though the original terms still apply as long as they have code under those terms left.
    - Conan_Kudo 6y ago
      There is no reasonable way that the old license will ever go away unless they do a relicensing effort like OpenSSL did. They won't, so it won't.
      - jabl 6y ago
        You're most likely correct. I was just pointing out that libressl is not under a different license from openssl < 3.0 as a whole, nor is it under the openbsd license as a whole. Rather parts of it are under the old openssl + ssleay dual license, and other parts are under the openbsd license. And over time, the fraction under the openbsd license is bound to increase, although as you say, they will probably never reach the point where all the old code has been replaced.
- jabl 6y ago
  The openbsd people behind libressl hate the apache 2.0 license, so they won't be able to copy such code from the openssl project any longer. I'm sure they're happy they have a TLS library with a license they like (new contributions are licensed under the openbsd license) and they can continue developing. As for gnutls, apache 2.0 license is still incompatible with (L)GPL 2.x, so projects under those licenses without the "or later" clause can't use openssl 3.x->. And of course, the gnutls and openssl API's are different, users can't just link against one or the other without code changes.
  - dtech 6y ago
    Why do they hate APL?
    - andinus 6y ago
      If you mean Apache License then, The original Apache license was similar to the Berkeley license, but source code published under version 2 of the Apache license is subject to additional restrictions and cannot be included into OpenBSD. In particular, if you use code under the Apache 2 license, some of your rights will terminate if you claim in court that the code violates a patent. A license can only be considered fully permissive if it allows use by anyone for all the future without giving up any of their rights. If there are conditions that might terminate any rights in the future, or if you have to give up a right that you would otherwise have, even if exercising that right could reasonably be regarded as morally objectionable, the code is not free. In addition, the clause about the patent license is problematic because a patent license cannot be granted under Copyright law, but only under contract law, which drags the whole license into the domain of contract law. But while Copyright law is somewhat standardized by international agreements, contract law differs wildly among jurisdictions. So what the license means in different jurisdictions may vary and is hard to predict. - https://www.openbsd.org/policy.html https://www.openbsd.org/policy.html
      - Sammi 6y ago
        Thanks for this excellent explanation.
bjoli 6y ago
A bit of a digression: the Apache license includes better patent language, which got me thinking of the patents on ocb mode. Shouldn't they expire sometime early in this decade? Like next year or something?
- wbl 6y ago
  Rogaway has licensed them to any TLS implementation for free.
ta17711771 6y ago
...wasn't the major reason to avoid it the shitton of vulns it has had compared to libreSSL!?
- toyg 6y ago
  The “shitton of vulnerabilities” is a recent phenomenon, it’s not what prevented people from using OpenSSL.
  - ta17711771 6y ago
    Perhaps a recently discovered phenomenon. It definitely should be the reason now!
terrywang 6y ago
- Linux Kernel TLS support Is this referring to kernel TLS offload (using linux kernel's TLS connection ooffload infrastrucuture)?
- shoo 6y ago
  i am unfamiliar with kernel TLS offload [1], but superficially, it looks like that may be supported: https://github.com/openssl/openssl/blob/43a70f02022ebbc29aa71853f04f1dc0d9772846/INSTALL.md#enable-ktls https://github.com/openssl/openssl/blob/43a70f02022ebbc29aa7... `SOL_TLS` referenced here https://github.com/openssl/openssl/blob/f059e4cc435b7b850cfc8188d265a8925edff0bd/include/internal/ktls.h https://github.com/openssl/openssl/blob/f059e4cc435b7b850cfc... as defined here: https://github.com/torvalds/linux/commit/3c4d7559159bfe1e3b94df3a657b2cda3a34e218#diff-19d8c55950b68c71d87e12df129ae8f7R337 https://github.com/torvalds/linux/commit/3c4d7559159bfe1e3b9... [1] https://www.kernel.org/doc/html/latest/networking/tls-offload.html https://www.kernel.org/doc/html/latest/networking/tls-offloa...
- aisio 6y ago
  Yes it supports Kernel TLS offload support. Both in SW mode (where the kernel does the TLS operations) and HW mode https://www.kernel.org/doc/html/latest/networking/tls-offload.html https://www.kernel.org/doc/html/latest/networking/tls-offloa...
scottlamb 6y ago
Does anyone know if OpenSSL-derived projects like BoringSSL and ring will follow suit in switching to Apache 2.0? And if so, have a guess at how long that will take?
tpolzer 6y ago
Doesn't "GPLv2 or later" specifically allow you to fork into "GPLv2 only"? How can a license be incompatible with only the latter then?
- yc12340 6y ago
  > How can a license be incompatible with only the latter then? Your parent comment said no such thing. It says, that you need GPL v3 to be compatible with Apache 2. "Or later" clause on GPL 2-licensed project offers you a way to re-license the project under GPL v3.
- CrLf 6y ago
  IANAL, but “GPLv2 or later” allows you (the recipient of the license) to choose either GPLv2 or GPLv3 (i.e. the one that’s more convenient to you) but does not allow you to prevent others (the recipients of your modified version) from having the same choice. This goes both ways, “GPLv2 or later” cannot be changed to either GPLv2 or GPLv3 only without permission from everybody that has ever contributed to the codebase. The FSF requires copyright attribution from cotributors, that’s why they were able to switch their projects to GPLv3-only.
  - yc12340 6y ago
    > “GPLv2 or later” cannot be changed to either GPLv2 or GPLv3 only without permission... What? Of course it can be changed to either. It literally says so in the license name.
    - zvr 6y ago
      No, it does not say such thing. “GPLv2 or later” says you are allowed to use it under GPLv2 or GPLv3 (for now). It does not allow to change it to GPL-2.0-only (to use the correct SPDX identifier).
      - yc12340 6y ago
        > “GPLv2 or later” says you are allowed to use it under GPLv2 or GPLv3 I am afraid, that you are wrong. GPL does not govern usage of software at all. You don't need to agree to GPL in order to use GPL licensed software. This is literally said in text of GPL itself. The preamble ("this program is free software...") is not part of GPL itself — it is just short informative text. And you are misremembering, what preamble says. Citing from GNU website: > This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version. I believe, that we should erase all SPDX-whatever nonsense from Linux source code, and replace it back with proper preamble — least other users of GPL software start to misremember as well.
chrisweekly 6y ago
Thanks Josh, that's a helpful summary!
gray_-_wolf 6y ago
> Specifically, OpenSSL is now compatible with anything licensed "GPLv3", "GPLv3 or later", or "GPLv2 or later". It's not compatible with "GPLv2 only", but that's a relatively small amount of software. Does this mean I cannot use openssl in my gpl-2.0-only program? How does that work? Doesn't gpl-2.0-later imply that I can also take the code and use it in gpl-2.0-only? Is there some tldr on this topic somewhere? I'm not good with these legal things to ELI5 would be nice :/
- jabl 6y ago
  > Does this mean I cannot use openssl in my gpl-2.0-only program? Correct. > How does that work? The GPL 2.0 and Apache-2.0 licenses contain terms which are incompatible with each other. > Doesn't gpl-2.0-later imply that I can also take the code and use it in gpl-2.0-only? Yes, in that case you can choose whether you use the code subject to the gpl 2.0, 3.0 or any later version. If you combine that code with some gpl-2.0-only code then you're choosing to use the first code under 2.0, and the combined work is then gpl-2.0-only. > Is there some tldr on this topic somewhere? I'm not good with these legal things to ELI5 would be nice :/ The GNU project maintains a list of licenses and some comments about them, and conveniently categorizes them according to their GPL compatibility. https://www.gnu.org/licenses/license-list.html https://www.gnu.org/licenses/license-list.html See also the chart at http://gplv3.fsf.org/dd3-faq http://gplv3.fsf.org/dd3-faq for compatibility between the different GPL versions and variants.
  - gray_-_wolf 6y ago
    > > Does this mean I cannot use openssl in my gpl-2.0-only program? > Correct. Well that sucks. I guess I'll need to look into libressl.
    - jabl 6y ago
      You might also check out GnuTLS which is under the LGPL 2.1+ license. If you're using Linux it's certainly already available from your package manager.
    - 6y ago
2OEH8eoCRo0 6y ago
It's incredible how much time and energy is spent on what license things use.
- flatiron 6y ago
  But think of what the gpl has given to us!
wcoenen 6y ago
> TLS1.3 support TLS 1.3 support was already added in OpenSSL 1.1.1 https://www.openssl.org/news/openssl-1.1.1-notes.html https://www.openssl.org/news/openssl-1.1.1-notes.html

LeoPanthera 6y ago

Isn't the Linux kernel "GPLv2 only"?

JoshTriplett 6y ago
Yes, but it's unlikely to link in a userspace library. This does prevent adapting code from OpenSSL to put in the kernel, but there are plenty of other sources to adapt code from. There are a few other notable codebases that are GPLv2-only, but most projects using the GPL use either "v2 or later" or "v3 or later".

wallacoloo 6y ago

> Other major improvements: TLS1.3 support OpenSSL 1.1.1 already supports TLS 1.3

NiekvdMaas 6y ago

What does the license change mean for LibreSSL (OpenSSL fork) and GnuTLS which have "a better license" as their main selling point?

throwaway2048 6y ago
libressl does not have a different license
- jabl 6y ago
  My understanding is that new libressl code is under the openbsd license, though the original terms still apply as long as they have code under those terms left.
  - Conan_Kudo 6y ago
    There is no reasonable way that the old license will ever go away unless they do a relicensing effort like OpenSSL did. They won't, so it won't.
    - jabl 6y ago
      You're most likely correct. I was just pointing out that libressl is not under a different license from openssl < 3.0 as a whole, nor is it under the openbsd license as a whole. Rather parts of it are under the old openssl + ssleay dual license, and other parts are under the openbsd license. And over time, the fraction under the openbsd license is bound to increase, although as you say, they will probably never reach the point where all the old code has been replaced.
jabl 6y ago
The openbsd people behind libressl hate the apache 2.0 license, so they won't be able to copy such code from the openssl project any longer. I'm sure they're happy they have a TLS library with a license they like (new contributions are licensed under the openbsd license) and they can continue developing. As for gnutls, apache 2.0 license is still incompatible with (L)GPL 2.x, so projects under those licenses without the "or later" clause can't use openssl 3.x->. And of course, the gnutls and openssl API's are different, users can't just link against one or the other without code changes.
- dtech 6y ago
  Why do they hate APL?
  - andinus 6y ago
    If you mean Apache License then, The original Apache license was similar to the Berkeley license, but source code published under version 2 of the Apache license is subject to additional restrictions and cannot be included into OpenBSD. In particular, if you use code under the Apache 2 license, some of your rights will terminate if you claim in court that the code violates a patent. A license can only be considered fully permissive if it allows use by anyone for all the future without giving up any of their rights. If there are conditions that might terminate any rights in the future, or if you have to give up a right that you would otherwise have, even if exercising that right could reasonably be regarded as morally objectionable, the code is not free. In addition, the clause about the patent license is problematic because a patent license cannot be granted under Copyright law, but only under contract law, which drags the whole license into the domain of contract law. But while Copyright law is somewhat standardized by international agreements, contract law differs wildly among jurisdictions. So what the license means in different jurisdictions may vary and is hard to predict. - https://www.openbsd.org/policy.html https://www.openbsd.org/policy.html
    - Sammi 6y ago
      Thanks for this excellent explanation.

bjoli 6y ago

A bit of a digression: the Apache license includes better patent language, which got me thinking of the patents on ocb mode. Shouldn't they expire sometime early in this decade? Like next year or something?

wbl 6y ago
Rogaway has licensed them to any TLS implementation for free.

ta17711771 6y ago

...wasn't the major reason to avoid it the shitton of vulns it has had compared to libreSSL!?

toyg 6y ago
The “shitton of vulnerabilities” is a recent phenomenon, it’s not what prevented people from using OpenSSL.
- ta17711771 6y ago
  Perhaps a recently discovered phenomenon. It definitely should be the reason now!

terrywang 6y ago

- Linux Kernel TLS support Is this referring to kernel TLS offload (using linux kernel's TLS connection ooffload infrastrucuture)?

shoo 6y ago
i am unfamiliar with kernel TLS offload [1], but superficially, it looks like that may be supported: https://github.com/openssl/openssl/blob/43a70f02022ebbc29aa71853f04f1dc0d9772846/INSTALL.md#enable-ktls https://github.com/openssl/openssl/blob/43a70f02022ebbc29aa7... `SOL_TLS` referenced here https://github.com/openssl/openssl/blob/f059e4cc435b7b850cfc8188d265a8925edff0bd/include/internal/ktls.h https://github.com/openssl/openssl/blob/f059e4cc435b7b850cfc... as defined here: https://github.com/torvalds/linux/commit/3c4d7559159bfe1e3b94df3a657b2cda3a34e218#diff-19d8c55950b68c71d87e12df129ae8f7R337 https://github.com/torvalds/linux/commit/3c4d7559159bfe1e3b9... [1] https://www.kernel.org/doc/html/latest/networking/tls-offload.html https://www.kernel.org/doc/html/latest/networking/tls-offloa...
aisio 6y ago
Yes it supports Kernel TLS offload support. Both in SW mode (where the kernel does the TLS operations) and HW mode https://www.kernel.org/doc/html/latest/networking/tls-offload.html https://www.kernel.org/doc/html/latest/networking/tls-offloa...

scottlamb 6y ago

Does anyone know if OpenSSL-derived projects like BoringSSL and ring will follow suit in switching to Apache 2.0? And if so, have a guess at how long that will take?

tpolzer 6y ago

Doesn't "GPLv2 or later" specifically allow you to fork into "GPLv2 only"? How can a license be incompatible with only the latter then?

yc12340 6y ago
> How can a license be incompatible with only the latter then? Your parent comment said no such thing. It says, that you need GPL v3 to be compatible with Apache 2. "Or later" clause on GPL 2-licensed project offers you a way to re-license the project under GPL v3.
CrLf 6y ago
IANAL, but “GPLv2 or later” allows you (the recipient of the license) to choose either GPLv2 or GPLv3 (i.e. the one that’s more convenient to you) but does not allow you to prevent others (the recipients of your modified version) from having the same choice. This goes both ways, “GPLv2 or later” cannot be changed to either GPLv2 or GPLv3 only without permission from everybody that has ever contributed to the codebase. The FSF requires copyright attribution from cotributors, that’s why they were able to switch their projects to GPLv3-only.
- yc12340 6y ago
  > “GPLv2 or later” cannot be changed to either GPLv2 or GPLv3 only without permission... What? Of course it can be changed to either. It literally says so in the license name.
  - zvr 6y ago
    No, it does not say such thing. “GPLv2 or later” says you are allowed to use it under GPLv2 or GPLv3 (for now). It does not allow to change it to GPL-2.0-only (to use the correct SPDX identifier).
    - yc12340 6y ago
      > “GPLv2 or later” says you are allowed to use it under GPLv2 or GPLv3 I am afraid, that you are wrong. GPL does not govern usage of software at all. You don't need to agree to GPL in order to use GPL licensed software. This is literally said in text of GPL itself. The preamble ("this program is free software...") is not part of GPL itself — it is just short informative text. And you are misremembering, what preamble says. Citing from GNU website: > This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version. I believe, that we should erase all SPDX-whatever nonsense from Linux source code, and replace it back with proper preamble — least other users of GPL software start to misremember as well.

chrisweekly 6y ago

Thanks Josh, that's a helpful summary!

gray_-_wolf 6y ago

> Specifically, OpenSSL is now compatible with anything licensed "GPLv3", "GPLv3 or later", or "GPLv2 or later". It's not compatible with "GPLv2 only", but that's a relatively small amount of software. Does this mean I cannot use openssl in my gpl-2.0-only program? How does that work? Doesn't gpl-2.0-later imply that I can also take the code and use it in gpl-2.0-only? Is there some tldr on this topic somewhere? I'm not good with these legal things to ELI5 would be nice :/

jabl 6y ago
> Does this mean I cannot use openssl in my gpl-2.0-only program? Correct. > How does that work? The GPL 2.0 and Apache-2.0 licenses contain terms which are incompatible with each other. > Doesn't gpl-2.0-later imply that I can also take the code and use it in gpl-2.0-only? Yes, in that case you can choose whether you use the code subject to the gpl 2.0, 3.0 or any later version. If you combine that code with some gpl-2.0-only code then you're choosing to use the first code under 2.0, and the combined work is then gpl-2.0-only. > Is there some tldr on this topic somewhere? I'm not good with these legal things to ELI5 would be nice :/ The GNU project maintains a list of licenses and some comments about them, and conveniently categorizes them according to their GPL compatibility. https://www.gnu.org/licenses/license-list.html https://www.gnu.org/licenses/license-list.html See also the chart at http://gplv3.fsf.org/dd3-faq http://gplv3.fsf.org/dd3-faq for compatibility between the different GPL versions and variants.
- gray_-_wolf 6y ago
  > > Does this mean I cannot use openssl in my gpl-2.0-only program? > Correct. Well that sucks. I guess I'll need to look into libressl.
  - jabl 6y ago
    You might also check out GnuTLS which is under the LGPL 2.1+ license. If you're using Linux it's certainly already available from your package manager.
  - 6y ago

2OEH8eoCRo0 6y ago

It's incredible how much time and energy is spent on what license things use.

flatiron 6y ago
But think of what the gpl has given to us!

wcoenen 6y ago

> TLS1.3 support TLS 1.3 support was already added in OpenSSL 1.1.1 https://www.openssl.org/news/openssl-1.1.1-notes.html https://www.openssl.org/news/openssl-1.1.1-notes.html