OpenSSL after Heartbleed [LWN.net]

OpenSSL after Heartbleed

Posted Oct 7, 2016 13:25 UTC (Fri) by TRS-80 (guest, #1804)
Parent article: OpenSSL after Heartbleed

Will moving to the Apache 2 License mean the end of the advertising clauses and hence GPL compatibility? Because that is something that would increase contributions.

to post comments

OpenSSL after Heartbleed

Posted Oct 7, 2016 13:37 UTC (Fri) by Conan_Kudo (subscriber, #103240) [Link] (3 responses)

I'm not a lawyer, but, as far as I know, it only properly solves the advertising clause issue. The Apache-2.0 license is noted to be compatible with GPLv3, but not earlier versions of the GPL. So, unless your GPL'd software is GPLv2+ (thus upgradable to GPLv3), GPLv3, or GPLv3+, it doesn't appear that you can stop having that exception added.

OpenSSL after Heartbleed

Posted Oct 7, 2016 15:15 UTC (Fri) by TRS-80 (guest, #1804) [Link] (2 responses)

Ah yes, I had forgotten that AL2 wasn't compatible with GPLv2 only code. Are there still any big userland projects that are GPLv2-only? We are coming up on 10 years since GPLv3 was released.

Some software is GPLv2-only

Posted Oct 7, 2016 15:29 UTC (Fri) by david.a.wheeler (subscriber, #72896) [Link]

The vast majority of GPL'ed software is "GPL-2.0+", not 2.0-only. However, there are important exceptions, including the Linux kernel, git, and Busybox.

OpenSSL after Heartbleed

Posted Oct 7, 2016 21:52 UTC (Fri) by pbonzini (subscriber, #60935) [Link]

QEMU is GPLv2-only (and for crypto it uses gnutls and NSS).