6 ms·

What does the license change mean for LibreSSL (OpenSSL fork) and GnuTLS which have "a better license" as their main selling point?

throwaway2048 6y ago
libressl does not have a different license
- jabl 6y ago
  My understanding is that new libressl code is under the openbsd license, though the original terms still apply as long as they have code under those terms left.
  - Conan_Kudo 6y ago
    There is no reasonable way that the old license will ever go away unless they do a relicensing effort like OpenSSL did. They won't, so it won't.
    - jabl 6y ago
      You're most likely correct. I was just pointing out that libressl is not under a different license from openssl < 3.0 as a whole, nor is it under the openbsd license as a whole. Rather parts of it are under the old openssl + ssleay dual license, and other parts are under the openbsd license. And over time, the fraction under the openbsd license is bound to increase, although as you say, they will probably never reach the point where all the old code has been replaced.
jabl 6y ago
The openbsd people behind libressl hate the apache 2.0 license, so they won't be able to copy such code from the openssl project any longer. I'm sure they're happy they have a TLS library with a license they like (new contributions are licensed under the openbsd license) and they can continue developing. As for gnutls, apache 2.0 license is still incompatible with (L)GPL 2.x, so projects under those licenses without the "or later" clause can't use openssl 3.x->. And of course, the gnutls and openssl API's are different, users can't just link against one or the other without code changes.
- dtech 6y ago
  Why do they hate APL?
  - andinus 6y ago
    If you mean Apache License then, The original Apache license was similar to the Berkeley license, but source code published under version 2 of the Apache license is subject to additional restrictions and cannot be included into OpenBSD. In particular, if you use code under the Apache 2 license, some of your rights will terminate if you claim in court that the code violates a patent. A license can only be considered fully permissive if it allows use by anyone for all the future without giving up any of their rights. If there are conditions that might terminate any rights in the future, or if you have to give up a right that you would otherwise have, even if exercising that right could reasonably be regarded as morally objectionable, the code is not free. In addition, the clause about the patent license is problematic because a patent license cannot be granted under Copyright law, but only under contract law, which drags the whole license into the domain of contract law. But while Copyright law is somewhat standardized by international agreements, contract law differs wildly among jurisdictions. So what the license means in different jurisdictions may vary and is hard to predict. - https://www.openbsd.org/policy.html https://www.openbsd.org/policy.html
    - Sammi 6y ago
      Thanks for this excellent explanation.
    - stock_toaster 6y ago
      Great explanation!
    - aasasd 6y ago
      Dumb question here, isn't a license already a contract in the first place?
      - andrewaylett 6y ago

throwaway2048 6y ago

libressl does not have a different license

jabl 6y ago
My understanding is that new libressl code is under the openbsd license, though the original terms still apply as long as they have code under those terms left.
- Conan_Kudo 6y ago
  There is no reasonable way that the old license will ever go away unless they do a relicensing effort like OpenSSL did. They won't, so it won't.
  - jabl 6y ago
    You're most likely correct. I was just pointing out that libressl is not under a different license from openssl < 3.0 as a whole, nor is it under the openbsd license as a whole. Rather parts of it are under the old openssl + ssleay dual license, and other parts are under the openbsd license. And over time, the fraction under the openbsd license is bound to increase, although as you say, they will probably never reach the point where all the old code has been replaced.

jabl 6y ago

The openbsd people behind libressl hate the apache 2.0 license, so they won't be able to copy such code from the openssl project any longer. I'm sure they're happy they have a TLS library with a license they like (new contributions are licensed under the openbsd license) and they can continue developing. As for gnutls, apache 2.0 license is still incompatible with (L)GPL 2.x, so projects under those licenses without the "or later" clause can't use openssl 3.x->. And of course, the gnutls and openssl API's are different, users can't just link against one or the other without code changes.

dtech 6y ago
Why do they hate APL?
- andinus 6y ago
  If you mean Apache License then, The original Apache license was similar to the Berkeley license, but source code published under version 2 of the Apache license is subject to additional restrictions and cannot be included into OpenBSD. In particular, if you use code under the Apache 2 license, some of your rights will terminate if you claim in court that the code violates a patent. A license can only be considered fully permissive if it allows use by anyone for all the future without giving up any of their rights. If there are conditions that might terminate any rights in the future, or if you have to give up a right that you would otherwise have, even if exercising that right could reasonably be regarded as morally objectionable, the code is not free. In addition, the clause about the patent license is problematic because a patent license cannot be granted under Copyright law, but only under contract law, which drags the whole license into the domain of contract law. But while Copyright law is somewhat standardized by international agreements, contract law differs wildly among jurisdictions. So what the license means in different jurisdictions may vary and is hard to predict. - https://www.openbsd.org/policy.html https://www.openbsd.org/policy.html
  - Sammi 6y ago
    Thanks for this excellent explanation.
  - stock_toaster 6y ago
    Great explanation!
  - aasasd 6y ago
    Dumb question here, isn't a license already a contract in the first place?
    - andrewaylett 6y ago