On Wed, 2021-09-15 at 16:06 +0100, Luca Boccassi wrote: > On Tue, 2021-09-14 at 13:36 +0200, Lennart Poettering wrote: > > Heya! > > > > Some of the systemd developers have been discussing switching > > systemd's crypto libraries to be exclusively OpenSSL 3.0, and drop > > support for older OpenSSL versions, as well as any GNUTLS/libgcrypt > > support. As you might have noticed OpenSSL 3.0 has been released > > recently, and for the first time resolves the GPL2 license > > incompatibility mess comprehensively, which opens this door to us. > > > > I personally care a lot about reducing the combinatorial explosion of > > deps a bit, and keeping our tree as maintainable as we can, with a > > single implementation of everything, not multiple, and no abstraction > > layers and such, and thus removing any compat kludges for other > > libraries or other library versions. > > > > Now, before we make a decision on this, I'd like to collect feedback > > on such a move. I know that there are some people who backpart new > > systemd onto old distros. How big would the pain be require porting > > OpenSSL 3, too, at the same time? > > > > (What's not up for discussion: for new additions to systemd we'll do > > only OpenSSL, and won't accept anything else. My question is really > > just about the stuff we aleady have, where we currently support > > GNUTLS/libcgrypt.). > > > > Anyway, I'd be interested in your thoughts about this. i.e. hear > > multiple takes, opinions, from differently people and positions? > > > > Thanks, > > > > Lennart > > To summarize in public what we discussed elsewhere: > > - OpenSSL 3 is licensed under Apache2 which is compatible with GPLv3 > but believed by many to be incompatible with GPLv2 > - systemd is mostly (L)GPLv2+, with no specific OpenSSL exception > clauses > - distributors of the built and linked binaries can safely and without > any reasonable doubt get over the perceived incompatibility by > declaring that the GPLv2+ binaries linked to OpenSSL are distributed > under GPLv3 > > The issue of course is with the "mostly" keyword. There are many > compat-headers backported from Linux UAPI headers, but they are covered > by the Linux syscall-note exception so they explicitly do not affect > the license of the binaries built with them. > There are however three GPLv2-only headers with no exceptions currently > included in all builds: > > - src/basic/ioprio.h which is in the process of being removed via > https://github.com/systemd/systemd/pull/20736 > - src/basic/linux/loadavg.h which is copied from > https://github.com/torvalds/linux/blob/master/include/linux/sched/loadavg.h > - src/shared/linux/bpf_insn.h which is copied from > https://github.com/torvalds/linux/blob/master/samples/bpf/bpf_insn.h > > The third one to me seems the most problematic one, as it's fairly > complex and thus is unlikely to be perceived universally as exempt from > copyright. It is very annoying as it is clearly a "sample" source file, > which usually is intended to be reused liberally, and originally it was > without a license and was given GPLv2-only when the big SPDX refactor > happened. There are 5 companies or so holding copyright on that file, > so perhaps a quick avenue would be to seek their permission to dual > license it? BPF support in systemd is of course optional, so it could > instead be disabled everywhere so that the header is excluded at build > time, but it would be quite unfortunate Status update: all these issues have been solved. The first two headers have been removed, and the third one has been dual-licensed upstream. https://github.com/systemd/systemd/pull/20736 https://github.com/systemd/systemd/pull/20839 https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git/commit/?id=d75fe9cb1dd062684c9fb8a4581738170365dc06 Therefore, we can say with certainty and no doubt whatsoever that systemd binaries can be distributed under (L)GPL-2-or-later and thus be compatible with Apache2, enabling linking with OpenSSL 3. The current plan is to avoid linking libsystemd.so to OpenSSL, so that the license of this library as distributed is not affected. -- Kind regards, Luca Boccassi
Attachment:
signature.asc
Description: This is a digitally signed message part
