OpenSSL and GPL (was Re: [DotGNU]Encryption protocols)

[Stephen Compall]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Monday 10 March 2003 05:57 am, Chris Smith wrote:
> Norbert and I have discussed OpenSSL and GnuPGP at great length in
> terms of licencing (as openssl isn't gpl, but fairly compatible). 

OpenSSL is as GPL compatible as Microsoft msvcrt.dll.

As the OpenSSL FAQ says, the GPL does not place restrictions on using 
libraries that are part of the normal operating system distribution. 
The exact words are "need not include anything that is normally 
distributed (in either source or binary form) with the major components 
(compiler, kernel, and so on) of the operating system on which the 
executable runs, unless that component itself accompanies the 
executable." As msvcrt.dll qualifies for this exception to the GPL's 
terms, you can link it into GPL apps.

Nevertheless, OpenSSL is not at all GPL-compatible. So I will add that a 
GNU project is working on a TLS/SSL library that can definitely be used 
in GPL programs, GnuTLS. It's in beta, according to the page: 
http://www.gnu.org/software/gnutls/

> The solution that came up was to use 'a crypt toolkit' but not
> specifically openssl or gnupgp.... OpenSSL would be the prefered
> option IMO as it's so well respected and trusted, but GNUPgp sould be
> the default at compile time as it's GPL... (I'd want to use openssl
> every time though TBH :o)

I could easily be wrong, but IIRC, libgcrypt provides only cryptographic 
routines, not their standard SSL/TLS mappings onto sockets. This would 
be a good reason for the existence of GnuTLS :)

- -- 
Stephen Compall - Also known as S11001001
DotGNU `Contributor' -- http://dotgnu.org
Jabber ID: address@hidden

- From time to time, companies have said to us, "We would make an
improved version of this program if you allow us to release it without
freedom." We say, "No thanks--your improvements might be useful if
they were free, but if we can't use them in freedom, they are no good
at all." Then they appeal to our egos, saying that our code will have
"more users" inside their proprietary programs. We respond that we
value our community's freedom more than an irrelevant form of
popularity.
        -- RMS, "The GNU GPL and the American Way"
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)

iD8DBQE+bio+2AceYinZ4EgRArXoAKCcZhRZQ1wJ1ZcTgn89NIR9jPqc1gCeKdHn
1JLKx6RxJ4GHhFl2L7FZYiE=
=36Gr
-----END PGP SIGNATURE-----