[Cryptlib] License questions

[Stephen Hurd]

A person porting my project to Debian has cited the following blog post
as a reason to exclude any software integrating Cryptlib from Debian
packages. It appears that nobody has actually asked about these issues
though.

Does the license concern have any merit (the other concerns don't really
concern me)?

https://www.debian-administration.org/users/dkg/weblog/74

Relevant copy/paste:

However, a significant portion of the cryptlib codebase (particularly
within the bn/ and crypt/ directories) appears to derive directly from
OpenSSL, and it retains Eric Young's copyright and licensing. This
licensing retains the so-called "advertising clause" that is generally
acknowledged to be deliberately incompatible with the GPL
<http://people.gnome.org/%7Emarkmc/openssl-and-the-gpl.html>. (A common
counterargument for this incompatibility is that OpenSSL should be
considered a "System Library" for GPL
<http://www.gnu.org/licenses/gpl.html>'ed tools that link against it;
whether or not you believe this for tools linked against OpenSSL, this
counterargument clearly does not hold for a project that embeds and
ships OpenSSL code directly, as CryptLib does)

This does not mean that CryptLib is not free software (it is!), nor does
it mean that you cannot link it against GPL'ed code (you can!). However,
you probably can't /distribute/ the results of linking CryptLib against
any GPL'ed code, because the GPL is incompatible with the OpenSSL license.



_______________________________________________
Cryptlib mailing list
***@mbsks.franken.deAdministration via Mail: cryptlib-***@mbsks.franken.de
Archive: ftp://ftp.franken.de/pub/crypt/cryptlib/archives/
http://news.gmane.org/gmane.comp.encryption.cryptlib
Posts from non-subscribed addresses are blocked to prevent spam, please
subscribe in order to post messages.

[Daniel Kahn Gillmor]

Post by Stephen Hurd
A person porting my project to Debian has cited the following blog post
as a reason to exclude any software integrating Cryptlib from Debian
packages. It appears that nobody has actually asked about these issues
though.
Does the license concern have any merit (the other concerns don't really
concern me)?
https://www.debian-administration.org/users/dkg/weblog/74

Hi, i'm the author of that post.

I did actually ask about it on this list back in 2011. the discussions
are here:

http://thread.gmane.org/gmane.comp.encryption.cryptlib/2529
http://thread.gmane.org/gmane.comp.encryption.cryptlib/2515

I didn't see any followup about it.

Regards,

--dkg

_______________________________________________
Cryptlib mailing list
***@mbsks.franken.deAdministration via Mail: cryptlib-***@mbsks.franken.de
Archive: ftp://ftp.franken.de/pub/crypt/cryptlib/archives/
http://news.gmane.org/gmane.comp.encryption.cryptlib
Posts from non-subscribed addresses are blocked to prevent spam, please
subscribe in order to post messages.

[Florian Weimer]

Post by Daniel Kahn Gillmor
I did actually ask about it on this list back in 2011. the discussions
http://thread.gmane.org/gmane.comp.encryption.cryptlib/2529
http://thread.gmane.org/gmane.comp.encryption.cryptlib/2515
I didn't see any followup about it.

There is also the technical problem that cryptlib redefines OpenSSL
symbols with slightly different implementations. This can easily to
problems, since more and more libraries add cryptography support and
may link against OpenSSL themselves.

It is also not clear if the Sleepycat license is compatible with the
GPL. The GPL, version 3, requires that users are allowed to give
binaries to third parties for merely running them, or sources for
modification, *without* giving the recipients any rights under
copyright. (It is usually argued that this is not a material change
from the GPL, version 2, just a clarification, but I'm don't think
these additional permissions where actually implied by the GPL,
version 2, although, for example, Cygnus' business model heavily
depended on that.) In contrast, the Sleepycat license requires that
recipients must be able to obtain the sources and redistribute them.

Furthermore, the standard interpretation of the GPL says that you only
have to give source code to those who actually receive binaries. The
“SaaS configuration” provision in cryptlib's variant of the Sleepycat
license conflicts with that, too.

_______________________________________________
Cryptlib mailing list
***@mbsks.franken.deAdministration via Mail: cryptlib-***@mbsks.franken.de
Archive: ftp://ftp.franken.de/pub/crypt/cryptlib/archives/
http://news.gmane.org/gmane.comp.encryption.cryptlib
Posts from non-subscribed addresses are blocked to prevent spa