After 20 Years, OpenSSL Will Change To Apache License 2.0, Seeks Past Contributors (openssl.org) 110
After nearly 20 years and 31,000 commits, OpenSSL wants to change to Apache License v2.0. They're now tracking down all 400 contributors to sign new license agreements, a process expected to take several months. Slashdot reader rich_salz shares links to OpenSSL's official announcement (and their agreement-collecting web site).
"This re-licensing activity will make OpenSSL, already the world's most widely-used FOSS encryption software, more convenient to incorporate in the widest possible range of free and open source software," said Mishi Choudhary, Legal Director of Software Freedom Law Center and counsel to OpenSSL. "OpenSSL's team has carefully prepared for this re-licensing, and their process will be an outstanding example of 'how to do it right.'"
Click through for some comments on the significance of this move from the Linux Foundation, Intel, and Oracle.
Click through for some comments on the significance of this move from the Linux Foundation, Intel, and Oracle.
- "The Linux Foundation is excited to see the OpenSSL project re-licensing under the Apache License. Using a standard and well-understood license is a huge benefit when incorporating a FOSS project into other projects and products... this license move will further help to ensure it remains one of the most important and relied-upon open source projects in the world."
-- Nicko van Someren, Chief Technology Officer, the Linux Foundation
- "Oracle is proud to extend its collaboration with the OpenSSL Foundation by relicensing its contributions of elliptic curve cryptography. OpenSSL is a critical component in both Oracle products and the infrastructure of the Internet, and we strongly believe the increased use of cryptography fostered by OpenSSL will benefit the entire enterprise software community."
-- Jim Wright, Chief Architect of Open Source Policy, Strategy, Compliance and Alliances, Oracle
- "Intel is thrilled to see OpenSSL moving to the standard Apache 2.0 license, improving license compatibility within the Open Source ecosystem. This will help defragment the open source cryptography ecosystem, leading to stronger and more pervasive use of crypto to improve privacy and security in the global technology infrastructure."
-- Imad Sousou, Vice President and General Manager of the Open Source Technology Center, Intel
What was the old license model? (Score:5, Insightful)
What was the old license model?
Re: (Score:2, Interesting)
OpenSSL has 2 licenses. Must follow both, not one or the other!
About half of OpenSSL has some kind of BSD on steroids license. The other half has a homebrew open source BSD-style license made by the original author/contributor.
Ref: https://www.openssl.org/source/license.html
Re:What was the old license model? (Score:5, Informative)
Basically two Extended 3-Part BSD licenses WITH Advertising Clause, therefore the Purists would
claim they are GPL-Incompatible, and GPL Software should not link with OpenSSL --- Although I do not
agree with that assessment. No issues linking to OpenSSL so long as you obey the terms of the OpenSSL license
in the binary distribution of OpenSSL, and the GPL in the terms of the distribution of the software linking to openssl.
https://www.openssl.org/source... [openssl.org]
Re: (Score:3)
No issues linking to OpenSSL so long as you obey the terms of the OpenSSL license in the binary distribution of OpenSSL, and the GPL in the terms of the distribution of the software linking to openssl.
Doesn't work that way... then you could say that your "licensed for non-commercial use" code is distributed for $0, I'm just charging for my code and your restriction can't extend to my code. You'd get rid of all license restrictions by "librarifying" it. Distribution is not the only exclusive right in copyright, so is preparing derived works and running something as one program in the same memory space is definitively that.
Granted you've moved the primary violation over to the end user, who may or may not
Re: (Score:2)
It was a dual license. One of the licenses was unique to OpenSSL. LibreSSL is no better in this sense, and seems to have the exact OpenSSL license, as listed here:
* https://github.com/libressl/li... [github.com]
The Apache license has been more portable and more acceptable to many developers and software publishers. It will be very interesting to see how this plays out.
Re: (Score:2)
LibreSSL is no better in this sense, and seems to have the exact OpenSSL license.
Well, of course, one thing you can't do when forking is change the license
Re: (Score:2)
You can't safely relicense without negotiating the new license with the copyright holders.
The "advertising clause" embedded in the existing OpenSSL license does present an awkward confusion for LibreSSL. I'm curious to see if this is partly an attempt to clarify the licensing for LibreSSL and for commercial forks, for whom the advertising clause can be difficult to explain to clients.
Not everyone is happy... (Score:4, Informative)
Some of the contributors are upset about the way that this license change is being pushed through. See
http://marc.info/?l=openbsd-tech&m=149028593819547 [marc.info]
Re:Not everyone is happy... (Score:5, Interesting)
Some of the contributors are upset
Parent link (http://marc.info/?l=openbsd-tech&m=149028593819547) is highly informative.
The last sentence of the email is particularly enlightening:
If we do not hear from you, we will assume that you have no objection.
Even the most obnoxious EULAs do not assume consent if they cannot get your response.
Re: (Score:3, Insightful)
Personally, I would have thought that would not be legally enforceable?
If such language is legal, then that allows anyone to send a spam-like message to anyone and then receive their agreement for anything; I mean, how many people actually read the email in their spam folder?
I await the serious legal ramifications that stem from this with interest.
Re: (Score:2)
Projects might want to learn from this, and start to ask developers if they'd be OK with allowing future project governance to change the license. Not everyone would say OK to that, but it could drastically reuce the number of contributers that need to e contacted.
Can allow specific license changes (any version of (Score:2)
There are many ways to allow for the possibility that the license may need to be changed in the future, without allowing just anyone to pick any license they choose.
The standard GPL license has a clause allowing the code to be distributed under the current license *or any future version* of the GPL license.
One could ask permission to distribute it under any OSI-approved license. I've received that permission before, the author granted me permission to use "any open source license", and the OSI list is reaso
Re: (Score:2)
The standard GPL license has a clause allowing the code to be distributed under the current license *or any future version* of the GPL license.
That's not part of the GPL AFAIK, rather it's the language some developers (not all) put into the code files that they are licensing. Personally, I don't do that and any version of the GPL that does auto-include such language is something I'd avoid. Sure, I trust the license that I am using now but I don't necessarily trust a newer version to do something I don't approve of.
It is an option I avoid as well (Score:2)
My post may have been a bit unclear. "Or any later version" is indeed an option used by many GPL programs, but certainly not all. GNU recommends including that. I don't in my software, because a) I object to the patent terms of GPLv3, as actually written and b) I no longer trust GNU to avoid adding objectionable clauses in future versions.
Re:Not everyone is happy... (Score:4, Informative)
Re:Not everyone is happy... (Score:5, Interesting)
Especially since one of the licenses that all contributors have agreed to specifically states that the licence CANNOT BE CHANGED.
Re: (Score:1)
I have altered the license. Pray I do not alter it further.
Re: (Score:2)
Re: (Score:2)
That would cover unilateral changes, such as the GPL's provision that the code can be relicensed under future versions of the GPL. Modification of a contract--and a license is just a contract--is allowed by mutual assent of the parties. That's basic contract law.
Re: (Score:3)
Re: (Score:2)
It isn't enforceable if you have a significant interest in the software, but if you only have insignificant contributions then it probably is good enough.
The court would have to balance each of those situations individually by its own merits, there isn't a general rule to smack it with. So some of the people who got that email, that is all they really need to get. Others, it is not enforceable because they have a significant interest in the code and would have to give express consent to any license changes.
Re: (Score:2)
I can see both sides of that last bit. They need to make such an assumption if they want to make progress as some people may no longer be reachable (no known email address, passed away). Making that assumption that no response equals acquiescence lets them move forward.
The problem is that some people that they weren't able to reach may not like the new license agreement. Also I'm not sure if such an assumption would stand up in court should it come to that.
Re: Not everyone is happy... (Score:4, Insightful)
Pragmatism is not sufficient to legally justify the assumption that people are okay with the relicensing unless they object. I'm pretty sure both common law and civil law jurisdictions would side with a contributor who objects after the fact, even if they did get the notice.
Estoppel by acquiescence and laches (Score:5, Informative)
> I'm pretty sure both common law and civil law jurisdictions would side with a contributor who objects after the fact, even if they did get the notice.
If they got the notice, estoppel by acquiescence may apply. "Estoppel by acquiescence" means one may not sue later if you were given a clear opportunity to object and chose to not object in any way. Georgia v. South Carolina is a well-known case. Georgia had legal claim to certain land based on a treaty. For many years, South Carolina treated it as part of South Carolina, levying taxes in the area, etc.Georgia did not object during these many years. Later Georgia attempted to assert their claim to the area. The court ruled that Georgia's failure to object for many years barred the action - their silence was basically implied permission.
A related concept is laches. Laches means you have to assert your rights in a reasonable time frame, or not at all - an author who files suit regarding the license change ten years from now will probably be barred by laches.
Re: (Score:2)
There are additional problems that they would face in bringing a complaint; they would have to show actual harm just to get in the door. When you give away open source software, you're giving up much of your ability to profit based on exclusive control. So you're also giving up most of the harm that could be done to you by the others who also have an ownership stake.
The reason that a copyright holder can sue even when they're not actively benefiting from some work, (maybe it is out of print or something) is
Re: Estoppel by acquiescence and laches (Score:2)
Acquiescence requires that the party making the new claim not be aware that they are infringing the other party's rights. (In the GA/SC boundary disputes, there were reasonable and independent bases to declare that some of the islands were in SC under the treaty and usual rules of territory.). The OpenSSL group here is clearly aware that they do not hold the copyrights here, or have permission to change the license.
Re: (Score:2)
Even if the contributor has passed away, they may have signed over whatever remaining rights they had in their software to heirs. Good luck figuring that out.
Re: (Score:3)
They don't have to "Sign it away to heirs". Copyrights automatically become property of their estate, Unless they put in a legal structure to explicitly donate that asset, and their heirs will ultimately direct the disposition.
Re: (Score:2)
They don't have to "Sign it away to heirs". Copyrights automatically become property of their estate, Unless they put in a legal structure to explicitly donate that asset, and their heirs will ultimately direct the disposition.
And the Executor of the Estate has to usually be convinced of to do what is being asked, they often have not understanding of the field, etc - so it's usually a very long, hard road; usually code gets rewritten in those cases.
Re: (Score:3)
They need to make such an assumption if they want to make progress as some people may no longer be reachable
Regardless of what is convenient for the project, the DEFAULT Under copyright is ALL RIGHTS RESERVED.
The licensing for the contributions were not implicit.... OpenSSL contributions were made under a specific license
https://www.openssl.org/source... [openssl.org]
The license they put it under has a SPECIFIC statement Barring license changes:
* The licence and distribution terms for any publically available version
Re: (Score:1)
The license they put it under has a SPECIFIC statement Barring license changes
That's changes by third parties. The authors of the work can change the license at any time (but not retroactively for past versions), if they can reach a consensus.
Re: Not everyone is happy... (Score:3)
Theo de Raadt is not the world most reasonable person, but I don't think any lawyer would say that the OpenSSL people are on solid legal footing with opt-opt relicensing.
Re: (Score:3, Interesting)
I used to think the same before I talked to some legal people -- you might be surprised. Making a good-faith, reasonable effort to contact everyone involved and give them a chance to object, and get agreement from all significant contributors with the unknown portion driven down to a miniscule portion, and apparently it can be viable. It's not a situation I would count out without actually talking with an expert for each specific situation.
Re: (Score:2)
Re: (Score:2)
Is it illegal to rewrite from scratch the contributions of those few authors who cannot be reached if alive or whose estate cannot be reached if deceased?
Re: (Score:2)
Re: (Score:2)
Re: (Score:3)
Some contributors contributions may be so small they cannot actually claim copyright.
As usual: it depends.
Re: (Score:2)
Copyright licensing is ONLY assignable in writing.
Copyright is only assignable in writing. The law doesn't require that copyright licenses be formal, written documents. Courts have upheld verbal and even implied licenses. This is a very good thing for open source, actually, since hardly any projects get written licenses from contributors. The mere act of sending a pull request (or sending a patch to a mailing list, or...) is taken as an implied license of the author's contribution, under the license or licenses that the project is using.
Also, good luck getting approval from all 400 - after 20 years some are going to be dead.
That only matters
Re: (Score:2)
Re: (Score:2)
What happens if you can't find the heirs?
You ignore the situation and go on. If at some point in the future the heirs object, then you identify and rewrite the code.
Re: (Score:2)
I used to think the same before I talked to some legal people -- you might be surprised.
It's the sort of thing legal people can blabber on and on about, but when you consider that anyone distributing this project can be sued in 100+ jurisdictions with different laws and legal systems most of them will get very quiet. And at least in the US there are statutory damages, who ever is "hurt" doesn't have to prove that, they just have to prove infringement and they can cash in which could be tempting for a greedy heir. And not necessarily just liability either, fraudulent removal or alteration of a
Re: (Score:2)
Re: (Score:2)
> OpenSSL can only be improved by rewriting.
Given the lack of portability demonstrated by LibreSSL, this is not as certain as you may think.
Re: (Score:1)
I've seen it done for a codebase with an indeterminate number of contributors and *no* existing license. The 5 major developers agreed on what the new license should be, told the community and asked that anyone who disagreed tell them what lines of code they owned (and demonstration it was theirs - the records weren't good for anyone). I was among the minor contributors, and posted that I thought my add-on scripts and a few little bugfixes were below the threshold for copyright and was fine with that.
Re: (Score:2)
Its a politeness thing, not a a requirement. OpenSSL has always required contributors to assign copyright to the OpenSSL foundation. They don't *have* to ask permission.
Re: (Score:2)
I know for a fact they haven't "ALWAYS" required contributors to assign any rights.
Even if they have, assignment without consideration may be non-binding.
Also, I'm fairly sure Eric Young and Hudson haven't assigned copyright to them,
they're using the code in a commercial SSL library for $$$, after all.....
Re: (Score:2)
Courts have already looked at that and didn't blink. It is hypothesizing of a very silly sort, because the answer is obvious and already known.
When you license code to the world in return for conditions in a license, those conditions are the consideration you received. Done. This is not a mystery.
If some business comes to me and asks for me to write some code for them, and I tell them that I'll do it for $100, and they agree, then I received $100 of consideration. If instead I tell them, you don't have to p
Re: (Score:3)
Some of the contributors are upset
Parent link (http://marc.info/?l=openbsd-tech&m=149028593819547) is highly informative.
"Informative" in the sense that it shows Theo acting within character? He never says what his problem with the change is, just "I don't like it". I'm an OpenSSL contributor and I've OK'd the change, it's long past time they updated the license from that awkward not-really-BSD one to something more standard.
Re: (Score:2)
Theo has voiced concerns specifically against the Apache 2.0 licence -- a decade ago.
What is up with some free software providers?! They say "Here's something free! Oh wait, I changed my mind."
While not exactly bait-and-switch, this is something which has been causing the community continual grief, and therefore we decided to honour a few of the projects that have decided to go non-free. After all.. having gone non-free, no one is going to remember them in the end.
[...]
The Apache group started from the humble beginnings of just being 'a patchy' set of changes to a completely free web server of dubious quality. But the years have changed them, and what they supply is now quite non-free... released under a license so entangled in legalese that we have absolutely no doubt that there are encumbrances hidden within. Legal terms protect. Who are they protecting? Not your freedom.
(From https://www.openbsd.org/lyrics... [openbsd.org] ; I'm sure there's a relevant mailing list post somewhere.)
Basically, they refused to update their in-tree Apache from 1.3.30 to anything newer, since 1.3.31 and so forth were Apache 2.0 licensed. Many years later, I believe they removed it and replaced it with something whose licence they could agree with (nginx IIRC).
In general, the BSDs are really wary of incorporating anything tha
Re: (Score:2)
So then encourage as many authors as possible to write a Reply:
I Do Not consent at this time to the license change regarding my contribution Nor any derivative work, added, or modified versions thereof.
Derivative work includes all code added or to the project after my contributions which extended any functionality on
top of OpenSSL based on any derivative of my earlier code, Including any non-literal copying of design style, naming conventions, or other aesthetic and miscellaneous aspects of my work f
Re: (Score:1)
please contact license@openssl.org so we can make sure we handle your contributions properly.
Re: (Score:2)
Some of the contributors are upset about the way that this license change is being pushed through. See
http://marc.info/?l=openbsd-tech&m=149028593819547 [marc.info]
There's always going to be a difficult one looking for any angle to complain and obstruct.
It will not happen (Score:1)
Finding hundreds of contributors and obtain a license change from them will not happen.
The only workable solution is just to change it and hope nobody will complain.
Re:It will not happen (Score:5, Informative)
If you get enough, you can rewrite the remaining bits.
Re: (Score:2)
Unwinding it all to figure out who contributed to what source files is the hardest part. I suppose at
In reality my guess that of the 400 contributors, a much smaller number contributed to the bulk of the code. Some of the contributors might have only made one or two small contributions that would be easy to work around if they didn't give consent or they could not be located.
Re: (Score:1)
Unwinding it all to figure out who contributed to what source files is the hardest part. I suppose at
Yeah, if only we had a tool that would track who wrote which line of code in which file. Something like a Version Control System.
Re: (Score:1)
The tools we used to do this are at https://github.com/openssl/too... [github.com]
Re:It will not happen (Score:4, Informative)
How the hell do you re-write something like that? An "if" statement keys on the value of a single variable and conditionally executes a function. There are some things for which there is only one solution. Someone might suggest "just cold-room it!" But how are they supposed to do that?
You mean cleanroom. Copyright protects one particular expression (implementation) not the underlying idea (functionality), so the point is not necessarily to come up with a different solution but to document that it has been done independently. Yes, that means they must find an "untainted" developer to write the new code but you can in great detail describe the functionality as long as you don't impose a particular implementation. It's even been done "after the fact" as evidence:
The court relied heavily on evidence NEC presented that compared a "clean room'' program with both the V20/30 and Intel 8086/88 microcode. NEC hired an independent engineer (Gary Davidian) to develop a set of microcode for the V20/30 without access to any other microcode. Because Davidian's version of the microcode was similar in many regards to both the Intel and NEC microcodes, the court found it likely that those similarities were dictated not by copying of Intel's microcode, but rather by functional constraints of the hardware, the architecture, and the need for 8086/88 compatibility.
The documentation is a pain in the butt, but the legal reasoning around it isn't so bad.
Re: (Score:2)
I always hear this refrain in situations like this. But suppose one of the contributions went something like this:
if (flag1 != "value") { doIt(); }
How the hell do you re-write something like that? An "if" statement keys on the value of a single variable and conditionally executes a function. There are some things for which there is only one solution.
If there's truly only one possible solution for something that simple, then it isn't copyrightable anyway. Copyright requires some amount of creative expression, and something like that wouldn't meet the minimum level of creativity.
Re: It will not happen (Score:2)
while (flag1 != "value")
{
doIt();
break;
}
Re: (Score:2)
Re: (Score:3)
Of course it won't happen. What's the likelihood that all 400 are still alive and mentally competent after a couple of decades?
Have you ever read the OpenSSL code? I don't think lack of mental competency has ever stopped anyone from contributing in the past.
Hahahahah (Score:2)
Yes, and I'm asking for the same permission to own all assets associated with openssl.org. If I don't hear back from you, I'll assume you have no objection.
So far I've not convinced (Score:1)
I'm willing to do public domain, unlicense. I could be persuaded to go to 2-clause BSD, MIT, ISC but there is not really any way I'd be happy with Apache license. I wasn't that happy with the OpenSSL licenses when I contributed but there wasn't a choice. But now that I've been given some influence, I'm going to use it to decide what happens to my contributions.
This will likely end with my code being throw out and someone rewriting it, but I'd at least like to see how far I can take this.
Re: So far I've not convinced (Score:1)
We're listening.
Had to scroll down to find this 1 lonely comment.
Please tell us more what you dislike about the Apache license specifically.
Sounds odd.... (Score:5, Informative)
...They're now tracking down all 400 contributors to sign new license agreements...
From what I read, OpenSSL are saying that if you have contributed, and you don't respond to their request to change the license on the code you contributed, OpenSSL will take your code and change the license on your code without your explicit permission.
.
I really hope I am reading it [theregister.co.uk] incorrectly, because I would expect better behavior from a security-oriented project. Far better behavior.
Re:On a 20 year old project, (Score:5, Insightful)
It's why the FSF is so very careful that the GPL grants licenses to existing users, and are transitive so that changes are _also_ under GPL and free for publication and modificaiton. It's also why various "you must advertise our name on this software" or "you may not make any changes to this software" have repeatedly proven confusing and dangerous to use.
Re:Sounds odd.... (Score:4, Insightful)
You are reading it wrong.
This article was about the decision about whether they should move to AL or not and "no response" was taken as a "yes" vote - but that's all.
The actual license of the code can not be changed by the OpenSSL folks because they do not have the right to it - only the original contributor can do it.
They have to do what every other license-changing project did: if the contributor does not respond or refuses the license change, his/her code will be removed and eventually rewritten by someone else.
Re: Sounds familiar (Score:1)
All I need to be suspicious is the mention that Oracle is involved.
Re: (Score:3)
Is there anything wrong with Apache License 2.0? (Score:2)
If the devs were okay with the previous licenses, what are they likely to object to in the proposed license?
I don't think I've ever heard anyone rant against Apache 2.0.
A couple questions (Score:2)
What's the existing license? Is this a migration from copyleft to a more permissive license, or is this a migration from an unusual license (some kind of openbsd license?) to something more standard?
Also:
Oracle is proud to extend its collaboration with the OpenSSL Foundation by relicensing its contributions of elliptic curve cryptography
What company that Oracle has bought originally contributed this?
Re: (Score:2)
or is this a migration from an unusual license (some kind of openbsd license?) to something more standard?
OpenBSD has nothing to do with the OpenSSL project.
OpenSSH and OpenNTPD and OpenBGPD are the projects they are responsible for IIRC. Yes, I know, it's confusing. (OpenNTPD is wonderful, by the way.)
The current licence of OpenSSL is the four-clause BSD licence. It's not the most desirable licence but it's about as standard as you can get.
It is a migration to a more complex licence, if we count by the number of words.
Re: (Score:2)
Kinda moot... (Score:2)
Everything it provides will be integrated into systemd anyway, they need it as part of the upcoming systemd web browser.
Re: (Score:2)
OpenSSL isn't under the GPL - it has its own unique, dual license.