Skip to contentSkip to conversation

gnutls update to 3.4.1

PATCH In review Armin Kuster 6 participants 24 messages Jun 28, 2015 – Jul 8, 2015

lore
Share & tools
lore

Armin Kuster

author
#0 lore raw

cover gnutls update to 3.4.1

The nettle and gnutls updates must be done as a pair.

The following changes since commit 4948bf62f63e311744ef2ba1e750d4c08a0794c4:

tcmode-default: Test gcc 5.1 (2015-06-28 06:05:07 -0700)

are available in the git repository at:

git://git.yoctoproject.org/poky-contrib akuster/gnutls_update
http://git.yoctoproject.org/cgit.cgi//log/?h=akuster/gnutls_update

Armin Kuster (2):
nettle: update package to 3.1.1 version.
gnutls: update to 3.4.1

 meta/recipes-support/gnutls/gnutls.inc             |  4 ++-
 .../gnutls/configure.ac-fix-sed-command.patch      | 29 ++++++++++------------
 meta/recipes-support/gnutls/gnutls_3.3.14.bb       |  8 ------
 meta/recipes-support/gnutls/gnutls_3.4.1.bb        |  8 ++++++
 .../nettle/{nettle_2.7.1.bb => nettle_3.1.1.bb}    | 12 ++++-----
 5 files changed, 30 insertions(+), 31 deletions(-)
 delete mode 100644 meta/recipes-support/gnutls/gnutls_3.3.14.bb
 create mode 100644 meta/recipes-support/gnutls/gnutls_3.4.1.bb
 rename meta/recipes-support/nettle/{nettle_2.7.1.bb => nettle_3.1.1.bb} (48%)
Signature · 1 line
1.9.1
author
#1 lore raw

PATCH 1/2 nettle: update package to 3.1.1 version.

this requires the gnutls 3.4.1 update or the current gnutils build will break.

Signed-off-by Armin Kuster <[email protected]>
---
 .../nettle/{nettle_2.7.1.bb => nettle_3.1.1.bb}              | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)
 rename meta/recipes-support/nettle/{nettle_2.7.1.bb => nettle_3.1.1.bb} (48%)
meta/recipes-support/nettle/nettle_3.1.1.bb renamed from meta/recipes-support/nettle/nettle_2.7.1.bb +6 -6
similarity index 48%
rename from meta/recipes-support/nettle/nettle_2.7.1.bb
rename to meta/recipes-support/nettle/nettle_3.1.1.bb
index f53afcc..ce5e756 100644
@@ -1,17 +1,17 @@
 SUMMARY = "A low level cryptographic library"
 HOMEPAGE = "http://www.lysator.liu.se/~nisse/nettle/"
 SECTION = "libs"
-LICENSE = "LGPLv2.1 & GPLv2"
-LIC_FILES_CHKSUM = "file://COPYING.LIB;md5=2d5025d4aa3495befef8f17206a5b0a1 \
-                    file://serpent-decrypt.c;beginline=53;endline=67;md5=bcfd4745d53ca57f82907089898e390d \
-                    file://serpent-set-key.c;beginline=56;endline=70;md5=bcfd4745d53ca57f82907089898e390d"
+LICENSE = "GPLv2+ & GPLv3 & LGPLv3+"
+LIC_FILES_CHKSUM = "file://COPYINGv2;beginline=1;endline=2;md5=c70d8d3310941dcdfcd1e02800a1f548 \
+                    file://COPYINGv3;beginline=1;endline=2;md5=d1c727712ceba52db52e0ee449cadf43  \
+                    file://COPYING.LESSERv3;beginline=1;endline=2;md5=ff44a06d461487fb65f84ad672a1d1c8"
 
 DEPENDS += "gmp"
 
 SRC_URI = "http://www.lysator.liu.se/~nisse/archive/${BP}.tar.gz"
 
-SRC_URI[md5sum] = "003d5147911317931dd453520eb234a5"
-SRC_URI[sha256sum] = "bc71ebd43435537d767799e414fce88e521b7278d48c860651216e1fc6555b40"
+SRC_URI[md5sum] = "b40fa88dc32f37a182b6b42092ebb144"
+SRC_URI[sha256sum] = "5fd4d25d64d8ddcb85d0d897572af73b05b4d163c6cc49438a5bfbb8ff293d4c"
 
 EXTRA_OECONF = "--disable-openssl"
Signature · 1 line
1.9.1
author
#2 lore raw

PATCH 2/2 gnutls: update to 3.4.1

This version supports the nettle 3.x and higher and requires that version.

this include a security fix:
GNUTLS-SA-2015-2
no CVE assigned to date.

enable openssl compat via PACKAGECONFIG as iputils needs gnutls/openssl.h

for migration info:
http://www.gnutls.org/manual/gnutls.html#Upgrading-from-previous-versions

V2: Fix some build depends seen on some systems.
WARNING: QA Issue: gnutls-openssl rdepends on libidn, but it isn't a build dependency? [build-deps]
WARNING: QA Issue: gnutls-xx rdepends on libidn, but it isn't a build dependency? [build-deps]
WARNING: QA Issue: gnutls-dev rdepends on libidn, but it isn't a build dependency? [build-deps]
WARNING: QA Issue: gnutls-bin rdepends on libidn, but it isn't a build dependency? [build-deps]
WARNING: QA Issue: gnutls rdepends on libidn, but it isn't a build dependency? [build-deps]

V3: fix typo in PACKAGECONFG

Signed-off-by Armin Kuster <[email protected]>
---
 meta/recipes-support/gnutls/gnutls.inc             |  4 ++-
 .../gnutls/configure.ac-fix-sed-command.patch      | 29 ++++++++++------------
 meta/recipes-support/gnutls/gnutls_3.3.14.bb       |  8 ------
 meta/recipes-support/gnutls/gnutls_3.4.1.bb        |  8 ++++++
 4 files changed, 24 insertions(+), 25 deletions(-)
 delete mode 100644 meta/recipes-support/gnutls/gnutls_3.3.14.bb
 create mode 100644 meta/recipes-support/gnutls/gnutls_3.4.1.bb
meta/recipes-support/gnutls/gnutls.inc +3 -1
index e9b138a..5585e8d 100644
@@ -34,9 +34,11 @@ do_configure_prepend() {
 	done
 }
 
-PACKAGECONFIG ??= "zlib"
+PACKAGECONFIG ??= "zlib openssl_compat"
 PACKAGECONFIG[tpm] = "--with-tpm, --without-tpm, trousers"
 PACKAGECONFIG[zlib] = "--with-zlib, --without-zlib, zlib"
+PACKAGECONFIG[openssl_compat] = "--enable-openssl-compatibility"
+PACKAGECONFIG[libidn] = "--with-idn,--without-idn, libidn"
 
 PACKAGES =+ "${PN}-openssl ${PN}-xx"
meta/recipes-support/gnutls/gnutls/configure.ac-fix-sed-command.patch +13 -16
index 44a9934..342143f 100644
@@ -13,19 +13,16 @@ Signed-off-by: Robert Yang <[email protected]>
  configure.ac | 2 +-
  1 file changed, 1 insertion(+), 1 deletion(-)
 
-diff --git a/configure.ac b/configure.ac
-index c6818a0..1c4582d 100644
---- a/configure.ac
-+++ b/configure.ac
-@@ -466,7 +466,7 @@ if test "$NEED_LIBOPTS_DIR" = "true";then
- 	dnl replace libopts-generated files with distributed backups, if present
- 	missing_baks=
- 	for i in ${srcdir}/src/*-args.c.bak ${srcdir}/src/*-args.h.bak; do
--		nam=`echo $i|sed 's/.bak//g'`
-+		nam=`echo $i|sed 's/\.bak$//'`
- 		if test -f $i;then
- 			cp -f $i $nam
- 		else
--- 
-2.0.1
-
+Index: gnutls-3.4.1/configure.ac
+===================================================================
+--- gnutls-3.4.1.orig/configure.ac
++++ gnutls-3.4.1/configure.ac
+@@ -530,7 +530,7 @@ if test "$enable_tools" != "no" || test
+ 		dnl replace libopts-generated files with distributed backups, if present
+ 		missing_baks=
+ 		for i in ${srcdir}/src/*-args.c.bak ${srcdir}/src/*-args.h.bak; do
+-			nam=`echo $i|sed 's/.bak//g'`
++			nam=`echo $i|sed 's/\.bak$//'`
+ 			if test -f $i;then
+ 				cp -f $i $nam
+ 			else
meta/recipes-support/gnutls/gnutls_3.3.14.bb deleted +0 -8
deleted file mode 100644
index f41d183..0000000
@@ -1,8 +0,0 @@
-require gnutls.inc
-
-SRC_URI += "file://correct_rpl_gettimeofday_signature.patch \
-            file://configure.ac-fix-sed-command.patch \
-            file://use-pkg-config-to-locate-zlib.patch \
-           "
-SRC_URI[md5sum] = "7f4465f8c564cf9cb8f5cb38b909f7ca"
-SRC_URI[sha256sum] = "0dfa0030faad8909c1e904105198232d6bc0123cae8cf4933b2bac85ee7cec52"
meta/recipes-support/gnutls/gnutls_3.4.1.bb new file +8 -0
new file mode 100644
index 0000000..1b64813
@@ -0,0 +1,8 @@
+require gnutls.inc
+
+SRC_URI += "file://correct_rpl_gettimeofday_signature.patch  \
+            file://configure.ac-fix-sed-command.patch \
+            file://use-pkg-config-to-locate-zlib.patch \
+          "
+SRC_URI[md5sum] = "2d04f34fa25b45f9dcb9104c0394e12e"
+SRC_URI[sha256sum] = "e9b5f58becf34756464216056cd5abbf04315eda80a374d02699dee83f80b12e"
Signature · 1 line
1.9.1
#3 lore raw

Re: [PATCH 1/2] nettle: update package to 3.1.1 version.

In reply to Armin Kuster
Quoted 3 lines · Armin Kuster

this requires the gnutls 3.4.1 update or the current gnutils build will break.

This appears to brake our partial support for building core-image-base without GPLv3:

https://autobuilder.yoctoproject.org/main/builders/nightly-non-gpl3/builds/372/steps/BuildImages/logs/stdio

Either we trim down what we consider buildable without v3, disable gnutls in iputils, or include the older versions in oe-core.

Any thoughts?

Ross

#4 lore raw

Re: [PATCH 1/2] nettle: update package to 3.1.1 version.

Quoted 5 lines · Burton, Ross
Quoted 2 lines · Armin Kuster

this requires the gnutls 3.4.1 update or the current gnutils build will break.

Quoted 7 lines

This appears to brake our partial support for building core-image-base without GPLv3:

https://autobuilder.yoctoproject.org/main/builders/nightly-non-gpl3/builds/372/steps/BuildImages/logs/stdio

Either we trim down what we consider buildable without v3, disable gnutls in iputils, or include the older versions in oe-core.

Without looking too much at this specific issue, I'd say that we should keep the older version in oe-core. Just as we normally try to do when it comes to GPLv2 / GPLv3 upgrades.

In my opinion, having as much as possible build in a non-GPLv3 build is a desirable goal.

Cheers,
Anders

Signature · 2 lines
Anders Darander
ChargeStorm AB / eStorm AB
#5 lore raw

Re: [PATCH 1/2] nettle: update package to 3.1.1 version.

Quoted 7 lines · Anders Darander

Without looking too much at this specific issue, I'd say that we should keep the older version in oe-core. Just as we normally try to do when it comes to GPLv2 / GPLv3 upgrades.

In my opinion, having as much as possible build in a non-GPLv3 build is a desirable goal.

I neglected to leave my opinion in my mail, but that's also my thought.

Ross

author
#6 lore raw

Re: [PATCH 1/2] nettle: update package to 3.1.1 version.

In reply to Burton, Ross

The current version of nettle 2.7 has one file that is GPL v3. mini-gmp.*

so the license for 2.7 should be updated IMHO. So wont that put us in the same boat as the upgrade?

- armin

Quoted 19 lines · Ross

On 28 June 2015 at 14:18, Armin Kuster <[email protected] <mailto:[email protected]>> wrote:

this requires the gnutls 3.4.1 update or the current gnutils build will break.

This appears to brake our partial support for building core-image-base without GPLv3:

https://autobuilder.yoctoproject.org/main/builders/nightly-non-gpl3/builds/372/steps/BuildImages/logs/stdio

Either we trim down what we consider buildable without v3, disable gnutls in iputils, or include the older versions in oe-core.

Any thoughts?

Ross

#7 lore raw

Re: [PATCH 1/2] nettle: update package to 3.1.1 version.

Quoted 6 lines · On 2 July 2015 at 18:04, akuster808 <[email protected]> wrote:

The current version of nettle 2.7 has one file that is GPL v3. mini-gmp.*

so the license for 2.7 should be updated IMHO. So wont that put us in the same boat as the upgrade?

Yes. Ouch.

Ross

author
#8 lore raw

Re: [PATCH 1/2] nettle: update package to 3.1.1 version.

Quoted 4 lines · Ross

On 2 July 2015 at 18:04, akuster808 <[email protected] <mailto:[email protected]>> wrote:

Quoted 8 lines

The current version of nettle 2.7 has one file that is GPL v3. mini-gmp.*

so the license for 2.7 should be updated IMHO. So wont that put us in the same boat as the upgrade?

Yes. Ouch.

So what now then? meta-oe-core-GPLv3 ; )

- armin

Quoted 2 lines

Ross

#9 lore raw

Re: [PATCH 1/2] nettle: update package to 3.1.1 version.

In reply to akuster808
Quoted 5 lines · * akuster808 <[email protected]> [150702 19:05]:

The current version of nettle 2.7 has one file that is GPL v3. mini-gmp.*

so the license for 2.7 should be updated IMHO. So wont that put us in the same boat as the upgrade?

Ouch, that's no good!

Ideally, we should look at that file and see for how long it's been part of nettle. If it's just for a short time, maybe we could go back to a point in time just prior to the inclusion (or license change) of that file.

Has it been like this for far too long, well, then we either have to see what impact this has on non-GPLv3 builds...

One option, depending on the age etc, could be to check if it's possible to get that single file re-licensed. Short-term, we have to fix the license and backport that fix to all supported versions that are affected, even though that might introduce regressions in images around the world...

Cheers,
Anders

Signature · 2 lines
Anders Darander
ChargeStorm AB / eStorm AB
#10 lore raw

Re: [PATCH 1/2] nettle: update package to 3.1.1 version.

Quoted 14 lines · On Friday 03 July 2015 09:07:16 Anders Darander wrote:
Quoted 5 lines · * akuster808 <[email protected]> [150702 19:05]:

The current version of nettle 2.7 has one file that is GPL v3. mini-gmp.*

so the license for 2.7 should be updated IMHO. So wont that put us in the same boat as the upgrade?

Ouch, that's no good!

Ideally, we should look at that file and see for how long it's been part of nettle. If it's just for a short time, maybe we could go back to a point in time just prior to the inclusion (or license change) of that file.

Quoted 8 lines

Has it been like this for far too long, well, then we either have to see what impact this has on non-GPLv3 builds...

One option, depending on the age etc, could be to check if it's possible to get that single file re-licensed. Short-term, we have to fix the license and backport that fix to all supported versions that are affected, even though that might introduce regressions in images around the world...

We also ought to poke upstream because as far as I can tell they have not noted the addition of this differently licensed source in any of the license notices shipped with it (other than in the added GPLv3 source files themselves, of course).

Armin, is that something you'd be able to take care of?

Cheers,
Paul

Signature · 2 lines
Paul Eggleton
Intel Open Source Technology Centre
author
#11 lore raw

Re: [PATCH 1/2] nettle: update package to 3.1.1 version.

In reply to Anders Darander
Quoted 8 lines · Anders Darander
Quoted 5 lines · * akuster808 <[email protected]> [150702 19:05]:

The current version of nettle 2.7 has one file that is GPL v3. mini-gmp.*

so the license for 2.7 should be updated IMHO. So wont that put us in the same boat as the upgrade?

Quoted 6 lines

Ouch, that's no good!

Ideally, we should look at that file and see for how long it's been part of nettle. If it's just for a short time, maybe we could go back to a point in time just prior to the inclusion (or license change) of that file.

this file has been in nettle for two years. It was introduced with th 2.7 release. Parts of that file are pulled from the gmp project.

Quoted 4 lines

Has it been like this for far too long, well, then we either have to see what impact this has on non-GPLv3 builds...

Does "Lesser" GPLv3 count? Looked a the file again and 'Lesser' is near the beginning of the paragraph before 'version 3'.

Does this change things for nettle 2.7?

- armin

Quoted 9 lines

One option, depending on the age etc, could be to check if it's possible to get that single file re-licensed. Short-term, we have to fix the license and backport that fix to all supported versions that are affected, even though that might introduce regressions in images around the world...

Cheers,
Anders

#12 lore raw

Re: [PATCH 1/2] nettle: update package to 3.1.1 version.

Hi Armin,

Quoted 18 lines · On Friday 03 July 2015 14:54:22 akuster808 wrote:
Quoted 7 lines · Anders Darander
Quoted 5 lines · * akuster808 <[email protected]> [150702 19:05]:

The current version of nettle 2.7 has one file that is GPL v3. mini-gmp.*

so the license for 2.7 should be updated IMHO. So wont that put us in the same boat as the upgrade?

Quoted 6 lines

Ouch, that's no good!

Ideally, we should look at that file and see for how long it's been part of nettle. If it's just for a short time, maybe we could go back to a point in time just prior to the inclusion (or license change) of that file.

this file has been in nettle for two years. It was introduced with th 2.7 release. Parts of that file are pulled from the gmp project.

Quoted 7 lines
Quoted 2 lines

Has it been like this for far too long, well, then we either have to see what impact this has on non-GPLv3 builds...

Does "Lesser" GPLv3 count? Looked a the file again and 'Lesser' is near the beginning of the paragraph before 'version 3'.

Does this change things for nettle 2.7?

Well, at minimum for our purposes LGPLv3 (or LGPLv3+?) needs to be added to LICENSE in the nettle recipe (with &). Whether or not someone chooses to exclude that license in their configuration through INCOMPATIBLE_LICENSE is a completely separate matter (and that is, as you allude to, a distinct license from GPLv3).

I just think it's something that upstream ought to be noting in their license statement, because they don't appear to be at the moment.

Cheers,
Paul

Signature · 2 lines
Paul Eggleton
Intel Open Source Technology Centre
#13 lore raw

Re: [PATCH 1/2] nettle: update package to 3.1.1 version.

Quoted 8 lines · Paul Eggleton

Well, at minimum for our purposes LGPLv3 (or LGPLv3+?) needs to be added to LICENSE in the nettle recipe (with &). Whether or not someone chooses to exclude that license in their configuration through INCOMPATIBLE_LICENSE is a
completely separate matter (and that is, as you allude to, a distinct license
from GPLv3).

FWIW the YP documentation states to mark GPL LGPL and AGPL v3 in INCOMPATIBLE_LICENSE to build a GPLv3 image, on the rationale that the usual clauses that upset people are not specific to the GPL variation. The autobuilder just excludes GPL right now, but there's a bug to fix this.

Of course IANAL and the opinion of someone who actually does use INCOMPATIBLE_LICENSE to remove GPLv3 software would be appreciated!

Ross

#14 lore raw

Re: [PATCH 1/2] nettle: update package to 3.1.1 version.

Quoted 12 lines · Ross

On 4 July 2015 at 12:38, Paul Eggleton <[email protected]>

Quoted 8 lines · wrote:

Well, at minimum for our purposes LGPLv3 (or LGPLv3+?) needs to be added to
LICENSE in the nettle recipe (with &). Whether or not someone chooses to exclude that license in their configuration through INCOMPATIBLE_LICENSE is a
completely separate matter (and that is, as you allude to, a distinct license
from GPLv3).

Quoted 7 lines

FWIW the YP documentation states to mark GPL LGPL and AGPL v3 in INCOMPATIBLE_LICENSE to build a GPLv3 image, on the rationale that the usual clauses that upset people are not specific to the GPL variation. The autobuilder just excludes GPL right now, but there's a bug to fix this.

Of course IANAL and the opinion of someone who actually does use INCOMPATIBLE_LICENSE to remove GPLv3 software would be appreciated!

I'm also not a lawyer, but for that exact reason I don't think we want to get into any question of license equivalence or similarity - INCOMPATIBLE_LICENSE, if used, needs to list all of the licenses you wish to exclude, so if you want LGPLv3 excluded then you need to state that in addition to GPLv3 (and naturally any recipe that builds LGPLv3-licensed source needs to state as such in the LICENSE value).

Cheers,
Paul

Signature · 2 lines
Paul Eggleton
Intel Open Source Technology Centre
#15 lore raw

Re: [PATCH 1/2] nettle: update package to 3.1.1 version.

Quoted 10 lines · Paul Eggleton
Quoted 8 lines · Ross

On 4 July 2015 at 12:38, Paul Eggleton <[email protected]>

Quoted 5 lines · wrote:

Well, at minimum for our purposes LGPLv3 (or LGPLv3+?) needs to be added to LICENSE in the nettle recipe (with &). Whether or not someone chooses to exclude that license in their configuration through INCOMPATIBLE_LICENSE is a completely separate matter (and that is, as you allude to, a distinct license from GPLv3).

Quoted 4 lines
Quoted 4 lines

FWIW the YP documentation states to mark GPL LGPL and AGPL v3 in INCOMPATIBLE_LICENSE to build a GPLv3 image, on the rationale that the usual clauses that upset people are not specific to the GPL variation. The autobuilder just excludes GPL right now, but there's a bug to fix this.

Good. I had assumed that it was changed after the discussion that lead to the additional mentioning of LGPL-3.0 and AGPL-3.0 in the YP Manual.

Quoted 2 lines
Quoted 2 lines

Of course IANAL and the opinion of someone who actually does use INCOMPATIBLE_LICENSE to remove GPLv3 software would be appreciated!

Well, I guess that it's the opinion of someone who uses that, and has been running that through lawyers that's needed. Maybe one of the commercial distributors can chim in on that.

Otherwise I guess that a lot of people using INCOMPATIBLE_LICENSE are doing that on a layman's basis, just like me...

Quoted 6 lines

I'm also not a lawyer, but for that exact reason I don't think we want to get into any question of license equivalence or similarity - INCOMPATIBLE_LICENSE, if used, needs to list all of the licenses you wish to exclude, so if you want LGPLv3 excluded then you need to state that in addition to GPLv3 (and naturally any recipe that builds LGPLv3-licensed source needs to state as such in the LICENSE value).

Yes, we certainly don't want to state that everything except for a short list of licenses is OK. In the end, that's up to each and every company making products to decide.

Though, in the YP documentation, we state as an example on how to get GPLv3-free builds, that you should set INCOMPATIBLE_LICENSE to "GPL-3.0 LGPL-3.0 AGPL-3.0", per an e-mail thread from last year (if I remember correctly. I know that at least Mark Hatle was involved in that thread, as well as I).

Cheers,
Anders

Signature · 2 lines
Anders Darander
ChargeStorm AB / eStorm AB
#16 lore raw

Re: [PATCH 1/2] nettle: update package to 3.1.1 version.

In reply to akuster808
Quoted 5 lines · * akuster808 <[email protected]> [150702 19:05]:

The current version of nettle 2.7 has one file that is GPL v3. mini-gmp.*

so the license for 2.7 should be updated IMHO. So wont that put us in the same boat as the upgrade?

Well, after looking a little bit at the repo in question, my understanding is that all files (well, those few I looked at, including mini-gmp.*) is dual licensed LGPLv3 /or/ GPLv2+, in the current master branch. It looks like this was done 2014-04-12, in 12 commits.

So could you double check the 3.1.1 release, and verify whether it only consists of LGPLv3 | GPLv2+ licensed files, or if there actually are any files having the GPLv3(+) restriction?

At least the commits from 2014-04-12 suggests that the whole nettle repo was clarified to be dual-licensed as LGPLv3 | GPLv2+ (though there's of course a risk that some files are left untouched). Though, it also suggests that upstream is willing to ensure that GPLv2 compatibility remains as an option.

Cheers,
Anders

Signature · 2 lines
Anders Darander
ChargeStorm AB / eStorm AB
#17 lore raw

Re: [PATCH 1/2] nettle: update package to 3.1.1 version.

Quoted 4 lines · Anders Darander

So could you double check the 3.1.1 release, and verify whether it only consists of LGPLv3 | GPLv2+ licensed files, or if there actually are any files having the GPLv3(+) restriction?

The nettle manual says quite clearly:

"Nettle is dual licenced under the GNU General Public License version 2 or later, and the GNU Lesser General Public License version 3 or later"
<https://git.lysator.liu.se/nettle/nettle/blob/master/nettle.texinfo#L147>
(https://git.lysator.liu.se/nettle/nettle/blob/master/nettle.texinfo#L147)

An updated recipe that puts the "or" operator in the LICENSE field will solve all the problems.

Ross

author
#18 lore raw

Re: [PATCH 1/2] nettle: update package to 3.1.1 version.

Quoted 10 lines · Ross
Quoted 4 lines · On 7 July 2015 at 06:34, Anders Darander <[email protected]…

So could you double check the 3.1.1 release, and verify whether it only consists of LGPLv3 | GPLv2+ licensed files, or if there actually are any files having the GPLv3(+) restriction?

The nettle manual says quite clearly:

Quoted 7 lines

"Nettle is dual licenced under the GNU General Public License version 2 or later, and the GNU Lesser General Public License version 3 or later"
<https://git.lysator.liu.se/nettle/nettle/blob/master/nettle.texinfo#L147>
(https://git.lysator.liu.se/nettle/nettle/blob/master/nettle.texinfo#L147)

An updated recipe that puts the "or" operator in the LICENSE field will solve all the problems.

which recipe? 2.7.1 / 3.1 or both?

- armin
( sucks at this licensing stuff)

Quoted 4 lines

Ross

#19 lore raw

Re: [PATCH 1/2] nettle: update package to 3.1.1 version.

Quoted 6 lines · On 7 July 2015 at 21:09, akuster808 <[email protected]> wrote:

which recipe? 2.7.1 / 3.1 or both?

- armin
( sucks at this licensing stuff)

Quoted 1 line

So: 2.7.1 is "LGPL" (v2).

3.1.1 is GPLv2+ or LGPLv3+.

An "interesting" choice to say the least. Because the v2 bit is not L, I'm wondering if we will need to keep both versions. But a 3.1.1 recipe with GPLv2+ *or* LGPLv3+ would be a good start.

Ross

#20 lore raw

Re: [PATCH 1/2] nettle: update package to 3.1.1 version.

Quoted 8 lines · Ross
Quoted 5 lines · On 7 July 2015 at 21:09, akuster808 <[email protected]> wrote:

which recipe? 2.7.1 / 3.1 or both?

- armin
( sucks at this licensing stuff)

Quoted 7 lines

So: 2.7.1 is "LGPL" (v2).

3.1.1 is GPLv2+ or LGPLv3+.

An "interesting" choice to say the least. Because the v2 bit is not L, I'm wondering if we will need to keep both versions. But a 3.1.1 recipe with GPLv2+ *or* LGPLv3+ would be a good start.

I'd vote YES to keeping the LGPLv2 version available.

GPL libraries are normally off limits for closed source apps, so the new licensing options would be a problem for anyone with a proprietary application using nettle in a distro which can't use [L]GPLv3. (I'm in that category...).

Quoted 8 lines

Ross

--
_______________________________________________
Openembedded-core mailing list
[email protected]
http://lists.openembedded.org/mailman/listinfo/openembedded-core

#21 lore raw

Re: [PATCH 1/2] nettle: update package to 3.1.1 version.

Quoted 17 lines · Andre McCurdy
Quoted 8 lines · Ross
Quoted 5 lines · On 7 July 2015 at 21:09, akuster808 <[email protected]> wrote:

which recipe? 2.7.1 / 3.1 or both?

- armin
( sucks at this licensing stuff)

Quoted 7 lines

So: 2.7.1 is "LGPL" (v2).

3.1.1 is GPLv2+ or LGPLv3+.

An "interesting" choice to say the least. Because the v2 bit is not L, I'm wondering if we will need to keep both versions. But a 3.1.1 recipe with GPLv2+ *or* LGPLv3+ would be a good start.

Quoted 6 lines

I'd vote YES to keeping the LGPLv2 version available.

GPL libraries are normally off limits for closed source apps, so the new licensing options would be a problem for anyone with a proprietary application using nettle in a distro which can't use [L]GPLv3. (I'm in that category...).

Surely if you can't use [L]GPLv3, you want the 3.1.1 version which is GPLv2 (or other things)?

Cheers,

Richard

#22 lore raw

Re: [PATCH 1/2] nettle: update package to 3.1.1 version.

Quoted 20 lines · Richard Purdie
Quoted 19 lines · Andre McCurdy
Quoted 8 lines · Ross
Quoted 5 lines · On 7 July 2015 at 21:09, akuster808 <[email protected]> wrote:

which recipe? 2.7.1 / 3.1 or both?

- armin
( sucks at this licensing stuff)

Quoted 7 lines

So: 2.7.1 is "LGPL" (v2).

3.1.1 is GPLv2+ or LGPLv3+.

An "interesting" choice to say the least. Because the v2 bit is not L, I'm wondering if we will need to keep both versions. But a 3.1.1 recipe with GPLv2+ *or* LGPLv3+ would be a good start.

I'd vote YES to keeping the LGPLv2 version available.

Quoted 7 lines
Quoted 4 lines

GPL libraries are normally off limits for closed source apps, so the new licensing options would be a problem for anyone with a proprietary application using nettle in a distro which can't use [L]GPLv3. (I'm in that category...).

Surely if you can't use [L]GPLv3, you want the 3.1.1 version which is GPLv2 (or other things)?

There are two separate issues.

Both GPLv3 and LGPLv3 block 'Tivoization', which rules out [L]GPLv3 for anyone needing to create signed firmware images which can not be modified by the end user.

http://www.gnu.org/licenses/rms-why-gplv3.en.html

Quite separate from that, linking an application with a GPL library (any version of the GPL) requires that the application be released under a GPL or GPL compatible license, so GPL libraries are generally considered to be incompatible with closed source applications. (Dynamically linking with an LGPL library is generally OK since the LGPL license doesn't transfer to the application).

http://www.gnu.org/licenses/gpl-faq.en.html#IfLibraryIsGPL
http://www.gnu.org/licenses/gpl-faq.en.html#GPLStaticVsDynamic

So for someone with a proprietary application which links dynamically with nettle in a distro which can't use [L]GPLv3, the older version of nettle with an LGPLv2 license would be the only option.

Quoted 6 lines

Cheers,

Richard

#23 lore raw

Re: [PATCH 1/2] nettle: update package to 3.1.1 version.

Quoted 15 lines · Andre McCurdy

There are two separate issues.

Both GPLv3 and LGPLv3 block 'Tivoization', which rules out [L]GPLv3 for anyone needing to create signed firmware images which can not be modified by the end user.

http://www.gnu.org/licenses/rms-why-gplv3.en.html

Quite separate from that, linking an application with a GPL library (any version of the GPL) requires that the application be released under a GPL or GPL compatible license, so GPL libraries are generally considered to be incompatible with closed source applications. (Dynamically linking with an LGPL library is generally OK since the LGPL license doesn't transfer to the application).

Quoted 6 lines

http://www.gnu.org/licenses/gpl-faq.en.html#IfLibraryIsGPL
http://www.gnu.org/licenses/gpl-faq.en.html#GPLStaticVsDynamic

So for someone with a proprietary application which links dynamically with nettle in a distro which can't use [L]GPLv3, the older version of nettle with an LGPLv2 license would be the only option.

Yep, that sounds correct to me and the sane thing for us to do.

Cheers,
Anders

Signature · 2 lines
Anders Darander
ChargeStorm AB / eStorm AB