OpenSSL Planning To Relicense Its Code

[starshipeleven]

The license change is apparently moving forward even without the consent of all rights holders.

THat's the only way they can do that.

The original license https://www.openssl.org/source/license.html ends with

* The licence and distribution terms for any publically available version or
* derivative of this code cannot be changed. i.e. this code cannot simply be
* copied and put under another distribution licence
* [including the GNU Public Licence.]
*/

so I'm still puzzled at how they plan to do this without doing a massive violation.

[wikinevick]

im***ile, git is gplv2 and is linked to openssl

The Apache Software Foundation lawyers disagree on the so-called incompatiblility. Git can add an exception clause if they care so much.

[wikinevick]

THat's the only way they can do that.

The original license https://www.openssl.org/source/license.html ends with

* The licence and distribution terms for any publically available version or
* derivative of this code cannot be changed. i.e. this code cannot simply be
* copied and put under another distribution licence
* [including the GNU Public Licence.]
*/

so I'm still puzzled at how they plan to do this without doing a massive violation.

Easy, neither the original license nor the Apache License are viral: whatever the contributors choose not to re-license can remain with the original license and gradually be replaced.
Also the CLA is not really necessary as the Apache License has clause 5 for new contributions. And yes, I am a lawyer in my spare time.

[starshipeleven]

Easy, neither the original license nor the Apache License are viral: whatever the contributors choose not to re-license can remain with the original license and gradually be replaced.

That's not what it says in the email, It does not say "if you disagree we will reverse your commits and then rewrite your code", it says "if you don't answer to this message we assume you are OK with that.

Also, OpenSSL can't go GPL because of way too obvious reasons.

[geearf]

The new license still is incompatible with GPLv2: https://mta.openssl.org/pipermail/op...ch/009176.html
However it is with GPLv3.

How can it be compatible with the GNU GPL v3 but not v2? I thought v3 was somewhat of a stricter version of v2.

[tajjada]

Also, OpenSSL can't go GPL because of way too obvious reasons.

Could you please explain these "obvious reasons" for someone who doesn't understand the implications of different FOSS licenses in large projects?

[ldo17]

One factor in favour of the Apache licence is the patent protection it offers.

[ssokolow]

Hoes can it be compatible with the GNU GPL v3 but not v2? I thought v3 was somewhat of a stricter version of v2.

The patent termination and indemnification provisions of the Apache license count as forbidden "additional restrictions" according to the GPLv2's language. The FSF thought those were a good idea and, with the GPLv3, they added similar language and made sure it was phrased in a way which wouldn't conflict with the Apache license's version.

[geearf]

The patent termination and indemnification provisions of the Apache license count as forbidden "additional restrictions" according to the GPLv2's language. The FSF thought those were a good idea and, with the GPLv3, they added similar language and made sure it was phrased in a way which wouldn't conflict with the Apache license's version.

Thank you for the clear explanation, that was awesome!

[uid313]

So it is dual-licensed under the Apache License 1.0 and the SSLeay license which is quite similiar to the 4-clause BSD license.

I think it is good to re-license it away from old licenses and away from custom vanity licenses into more common licenses that is more widely adopted to avoid license proliferation.

I think it would be suitable to relicense it under Apache License 2.0 since it is still the Apache License, just a new version, and relicense from SSLeay license to BSD license since it is similar anyway, preferably the 2-clause license.