5 ms·

Could someone please explain why the article lists OpenSSL license as problematic, while in-explicitly hinting that LibreSSL doesn't have that problem? How coul

by Jnr 6y ago

Could someone please explain why the article lists OpenSSL license as problematic, while in-explicitly hinting that LibreSSL doesn't have that problem? How could that be the case if LibreSSL is just a fork of OpenSSL? Surely they can't just change the license without rewriting everything from scratch.

Xylakant 6y ago
> Surely they can't just change the license without rewriting everything from scratch. They can. You can get a permission from all (or most) contributors and rewrite/remove all others . You can relicense to a compatible license (gpl2 -> GPL 3) You could license all new contributions under the new license and retain all old code under the previous license (for example moving from MIT to APL). There’s probably other options, it relicensing is not impossible, though sometimes painful.
- aflag 6y ago
  I thought GPL 3 was not compatible with GPL 2.
  - xoa 6y ago
    You're correct, the GPL v3 is not compatible with the GPL v2 simply as a matter of license [0]. GP might be confusing "compatibility" with specific grant of future version usage. The FSF default recommended notice boilerplate for the GPL v2 is: This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version. So it includes an explicit "or any later version" clause. Since by far most projects just copy/paste standard language it's common to be able to combine v2 and v3. However, not all projects do that, with the most famous and impactful of course being the Linux kernel itself which is explicitly GPL-2.0 only. ---- 0: https://www.gnu.org/licenses/license-list.en.html https://www.gnu.org/licenses/license-list.en.html
    - Xylakant 6y ago
      I meant "compatible" in the sense of "allows upgrade to", so you're correct. I could have phrased that better.
red_trumpet 6y ago
So, I don't have any insider knowledge, but I just googled the license of OpenSSL [1]. Apparently, since 3.0.0 it uses the Apache License v2. So maybe LibreSSL is forked from this? Prior versions of OpenSSL seem to use some different OpenSSL License. So my guess is the article references this special license. [1] https://www.openssl.org/source/license.html https://www.openssl.org/source/license.html
nopcode 6y ago
The Apache 2 license (for OpenSSL 3) has more restrictions than the original OpenSSL licenses (which are BSD-style). Until now, OpenSSL, LibreSSL and BoringSSL were using non-viral licenses and thus used different licenses for different source code files. (Eg Google would license their patches under ISC so it could be adopted by the LibreSSL team). With OpenSSL becoming Apache 2 licensed, it is no longer "compatible" with the mindset of certain projects. For example OpenBSD does not distribute Apache 2 code. I bet that Apple will also stay on LibreSSL for the same reason.
- bojanz 6y ago
  OpenBSD does distribute Apache 2 code (e.g. LLVM), but it's true they're not happy about it due to the patent clause. Apple prefers Apache 2 for its own code (LLVM, CUPS, Swift).
- ninjin 6y ago
  Correct, a complete write up on how OpenBSD and associated projects view licensing can be found here: https://www.openbsd.org/policy.html https://www.openbsd.org/policy.html
teh_klev 6y ago
This is the old "special" license: https://github.com/openssl/openssl/blob/OpenSSL_1_1_1c/LICENSE https://github.com/openssl/openssl/blob/OpenSSL_1_1_1c/LICEN... And this is likely the condition the article refers to 3. All advertising materials mentioning features or use of this software must display the following acknowledgment: "This product includes software developed by the OpenSSL Project for use in the OpenSSL Toolkit. (http://www.openssl.org/)" The original SSLeay license included in that same license had a similar requirement.

by Jnr 6y ago

Xylakant 6y ago

> Surely they can't just change the license without rewriting everything from scratch. They can. You can get a permission from all (or most) contributors and rewrite/remove all others . You can relicense to a compatible license (gpl2 -> GPL 3) You could license all new contributions under the new license and retain all old code under the previous license (for example moving from MIT to APL). There’s probably other options, it relicensing is not impossible, though sometimes painful.

aflag 6y ago
I thought GPL 3 was not compatible with GPL 2.
- xoa 6y ago
  You're correct, the GPL v3 is not compatible with the GPL v2 simply as a matter of license [0]. GP might be confusing "compatibility" with specific grant of future version usage. The FSF default recommended notice boilerplate for the GPL v2 is: This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version. So it includes an explicit "or any later version" clause. Since by far most projects just copy/paste standard language it's common to be able to combine v2 and v3. However, not all projects do that, with the most famous and impactful of course being the Linux kernel itself which is explicitly GPL-2.0 only. ---- 0: https://www.gnu.org/licenses/license-list.en.html https://www.gnu.org/licenses/license-list.en.html
  - Xylakant 6y ago
    I meant "compatible" in the sense of "allows upgrade to", so you're correct. I could have phrased that better.

red_trumpet 6y ago

So, I don't have any insider knowledge, but I just googled the license of OpenSSL [1]. Apparently, since 3.0.0 it uses the Apache License v2. So maybe LibreSSL is forked from this? Prior versions of OpenSSL seem to use some different OpenSSL License. So my guess is the article references this special license. [1] https://www.openssl.org/source/license.html https://www.openssl.org/source/license.html

nopcode 6y ago

The Apache 2 license (for OpenSSL 3) has more restrictions than the original OpenSSL licenses (which are BSD-style). Until now, OpenSSL, LibreSSL and BoringSSL were using non-viral licenses and thus used different licenses for different source code files. (Eg Google would license their patches under ISC so it could be adopted by the LibreSSL team). With OpenSSL becoming Apache 2 licensed, it is no longer "compatible" with the mindset of certain projects. For example OpenBSD does not distribute Apache 2 code. I bet that Apple will also stay on LibreSSL for the same reason.

bojanz 6y ago
OpenBSD does distribute Apache 2 code (e.g. LLVM), but it's true they're not happy about it due to the patent clause. Apple prefers Apache 2 for its own code (LLVM, CUPS, Swift).
ninjin 6y ago
Correct, a complete write up on how OpenBSD and associated projects view licensing can be found here: https://www.openbsd.org/policy.html https://www.openbsd.org/policy.html

teh_klev 6y ago

This is the old "special" license: https://github.com/openssl/openssl/blob/OpenSSL_1_1_1c/LICENSE https://github.com/openssl/openssl/blob/OpenSSL_1_1_1c/LICEN... And this is likely the condition the article refers to 3. All advertising materials mentioning features or use of this software must display the following acknowledgment: "This product includes software developed by the OpenSSL Project for use in the OpenSSL Toolkit. (http://www.openssl.org/)" The original SSLeay license included in that same license had a similar requirement.