Re: openssl is now a dependency of guix: possible license conflict?

[Mark H Weaver]

Mark H Weaver <address@hidden> writes:

> Alex Vong <address@hidden> writes:
>
>> Recently, guix changes to use guile-git for 'guix pull', which is a
>> libgit2 binding for guile, while libgit2 itself uses openssl to talk
>> over https.
>>
>> Now the potential problem is that guix is licensed in gpl3+ while
>> openssl is licensed in openssl. It is well-known the two licenses have
>> incompatibility disallowing one from distributing the result of linking
>> a gpl program with openssl[0].
>
> Thanks for bringing this to our attention.  I looked into this, and it
> turns out that Debian's libgit2 package no longer depends on OpenSSL:
>
>   https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=798421
>
> libgit2 can use libcurl for HTTPS support, in which case it does not
> need OpenSSL.

I was mistaken about this.  My mistake was based on the following
statement from libgit2's CHANGELOG.md for v0.23:

  * If libcurl is installed, we will use it to connect to HTTP(S)
    servers.

However, further investigation reveals that on GNU/Linux systems,
libgit2's HTTPS support requires OpenSSL.  Debian's libgit2 no longer
supports HTTPS.

There exist patches for libgit2 to support the mbedTLS library, but it
is not yet clear whether they will be accepted upstream:

  https://github.com/libgit2/libgit2/pull/3462
  https://github.com/libgit2/libgit2/pull/3935

OpenSSL is currently attempting to change their license to the Apache
License v2.0, which is compatible with the GNU GPL v3, but it's not
clear how long it will take for them to obtain permission from the large
number of individual copyright owners:

  https://www.openssl.org/blog/blog/2017/03/22/license/

      Mark