Re: openssl is now a dependency of guix: possible license conflict?

[Alex Vong]

Mark H Weaver <address@hidden> writes:

> Mark H Weaver <address@hidden> writes:
>
>> Alex Vong <address@hidden> writes:
>>
>>> Recently, guix changes to use guile-git for 'guix pull', which is a
>>> libgit2 binding for guile, while libgit2 itself uses openssl to talk
>>> over https.
>>>
>>> Now the potential problem is that guix is licensed in gpl3+ while
>>> openssl is licensed in openssl. It is well-known the two licenses have
>>> incompatibility disallowing one from distributing the result of linking
>>> a gpl program with openssl[0].
>>
>> Thanks for bringing this to our attention.  I looked into this, and it
>> turns out that Debian's libgit2 package no longer depends on OpenSSL:
>>
>>   https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=798421
>>
>> libgit2 can use libcurl for HTTPS support, in which case it does not
>> need OpenSSL.
>
> I was mistaken about this.  My mistake was based on the following
> statement from libgit2's CHANGELOG.md for v0.23:
>
>   * If libcurl is installed, we will use it to connect to HTTP(S)
>     servers.
>
> However, further investigation reveals that on GNU/Linux systems,
> libgit2's HTTPS support requires OpenSSL.  Debian's libgit2 no longer
> supports HTTPS.
>
> There exist patches for libgit2 to support the mbedTLS library, but it
> is not yet clear whether they will be accepted upstream:
>
>   https://github.com/libgit2/libgit2/pull/3462
>   https://github.com/libgit2/libgit2/pull/3935
>
It seems julia had merge the mbedtls patches, so they should be working:

  https://github.com/JuliaLang/julia/pull/22614

Should we also adopt the patches?

Another solution I can think of is to change the (guix git) module so
that it supports using plain git to clone and fetch the repo. We can
have an option to choose using either libgit2 or git in the configure
script.

> OpenSSL is currently attempting to change their license to the Apache
> License v2.0, which is compatible with the GNU GPL v3, but it's not
> clear how long it will take for them to obtain permission from the large
> number of individual copyright owners:
>
>   https://www.openssl.org/blog/blog/2017/03/22/license/
>
This is great. They start doing it in 2015, time flies:
  https://www.openssl.org/blog/blog/2015/08/01/cla/

>       Mark

signature.asc
Description: PGP signature