RFC: OpenSSL vs NSS

[Geoff Thorpe]

On July 9, 2004 12:58 pm, Steven Edwards wrote:
> I believe we have a licensing issue with the crypto implementation in
> Wine and would like feedback relating to this. I know that some of the
> OpenSSL developers monitor this list so please provide feedback.

We are lurking everywhere, you are never safe ...

> The first question is in regards to the following:
>
> Clause 3 of OpenSSL license:
>  * 3. All advertising materials mentioning features or use of this
>  *    software must display the following acknowledgment:
>  *    "This product includes software developed by the OpenSSL Project
>  *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"

Yeah, this is an unavoidable hangover from the SSLeay days, not much that 
can be done about it (there is an equivalent clause for crediting Eric 
Young, except where the code is entirely new and post-SSLeay). However, 
as someone pointed out, this is "solved" by having OpenSSL as part of the 
underlying system. If it is, then the requirements to satisfy the openssl 
license have already been met (presumably) by the operating system 
provider, supplier, or other third party. In particular, I seem to recall 
that the current wine code is loading openssl on-the-fly and binding to 
symbols as required, so this should not be an issue (if openssl *isn't* 
part of the base distribution or installed in some other form that is 
consistent with the license, then wine won't find it!).

This shouldn't be an issue, but if you would like to go into grubby 
details (something I prefer to avoid, personally) you should head over to 
the openssl-users list and raise it there. There are a lot of open and 
closed source users of the toolkit there who may have already confronted 
the same issues you face (eg. if you are packaging wine commercially, or 
whatever, and have varying concerns beyond that of the raw wine project 
itself). There is also;
   http://www.openssl.org/support/faq.html#LEGAL2

Cheers,
Geoff
-- 
Geoff Thorpe
geoff at geoffthorpe.net
http://www.geoffthorpe.net/