license conflicts with OpenSSL

license conflicts with OpenSSL

[Yong Li]

[-- Attachment #1: Type: text/plain, Size: 813 bytes --]

Hi All,

 

Just found that some packages included in openbmc have license conflict
issues between OpenSSL and GPL

 

Ipmitool package and krb5 package are both linked to openssl and other GPL
libs. 

 

Based on the discussion in
https://lists.debian.org/debian-legal/2004/05/msg00595.html, I think they
are conflict licenses.

 

Just want to know if we need to do something? Such as add an additional
license file?

 

 

More information:

meta-openembedded/meta-oe/recipes-kernel/ipmitool/ipmitool_1.8.18.bb

LICENSE = "BSD-3-Clause"

DEPENDS = "openssl readline ncurses"

 

Readline is GPLv3

 

meta-openembedded/meta-oe/recipes-connectivity/krb5/krb5_1.17.bb:

LICENSE = "MIT"

DEPENDS = "bison-native ncurses util-linux e2fsprogs e2fsprogs-native
openssl"

 

Util-linux is GPLv2

 

 

Thanks,

Yong


[-- Attachment #2: Type: text/html, Size: 3881 bytes --]

Re: license conflicts with OpenSSL

[Alexander Amelkin]

[-- Attachment #1.1.1: Type: text/plain, Size: 1649 bytes --]

Hi Young and all!

I checked and I can say that ipmitool needs readline solely for ipmishell
support. I think that if ipmitool is confgured with --disable-ipmishell, then
there will be no license clash with readline as it won't be linked.

The requirement for ncurses looks totally obsolete. Nothing seems to change if I
just drop the requirement for tgetent(), which is what requires ncurses. The
tgetent() function is never called from anywhere in ipmitool code. I think I
will just drop the requirement for ncurses from ipmitool soon.

With best regards,
Alexander Amelkin,
Maintainer of ipmitool
https://github.com/ipmitool/ipmitool

29.11.2019 9:56, Yong Li wrote:
>
> Hi All,
>
>  
>
> Just found that some packages included in openbmc have license conflict issues
> between OpenSSL and GPL
>
>  
>
> Ipmitool package and krb5 package are both linked to openssl and other GPL libs.
>
>  
>
> Based on the discussion in
> https://lists.debian.org/debian-legal/2004/05/msg00595.html, I think they are
> conflict licenses.
>
>  
>
> Just want to know if we need to do something? Such as add an additional
> license file?
>
>  
>
>  
>
> More information:
>
> meta-openembedded/meta-oe/recipes-kernel/ipmitool/ipmitool_1.8.18.bb
>
> LICENSE = "BSD-3-Clause"
>
> DEPENDS = "openssl readline ncurses"
>
>  
>
> Readline is GPLv3
>
>  
>
> meta-openembedded/meta-oe/recipes-connectivity/krb5/krb5_1.17.bb:
>
> LICENSE = "MIT"
>
> DEPENDS = "bison-native ncurses util-linux e2fsprogs e2fsprogs-native openssl"
>
>  
>
> Util-linux is GPLv2
>
>  
>
>  
>
> Thanks,
>
> Yong
>

[-- Attachment #1.1.2: Type: text/html, Size: 5213 bytes --]

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 819 bytes --]

RE: license conflicts with OpenSSL

[Yong Li]

Thanks Alexander for your quick response!

My understanding is that you will perform some changes in the upstream
https://github.com/ipmitool/ipmitool, to remove these unused/obsolete
dependencies.

But I notice the ipmitool_1.8.18.bb file in openembedded is using these
.tar.bz2 files from sourceforge.net. Just want to know do you upload the new
versions to sourceforge.net?

Thanks,
Yong
From: Alexander Amelkin <a.amelkin@yadro.com> 
Sent: Friday, November 29, 2019 7:28 PM
To: Yong Li <yong.b.li@linux.intel.com>; openbmc@lists.ozlabs.org
Subject: Re: license conflicts with OpenSSL

Hi Young and all!
I checked and I can say that ipmitool needs readline solely for ipmishell
support. I think that if ipmitool is confgured with --disable-ipmishell,
then there will be no license clash with readline as it won't be linked.
The requirement for ncurses looks totally obsolete. Nothing seems to change
if I just drop the requirement for tgetent(), which is what requires
ncurses. The tgetent() function is never called from anywhere in ipmitool
code. I think I will just drop the requirement for ncurses from ipmitool
soon.
With best regards,
Alexander Amelkin,
Maintainer of ipmitool
https://github.com/ipmitool/ipmitool
29.11.2019 9:56, Yong Li wrote:
Hi All,
 
Just found that some packages included in openbmc have license conflict
issues between OpenSSL and GPL
 
Ipmitool package and krb5 package are both linked to openssl and other GPL
libs. 
 
Based on the discussion in
https://lists.debian.org/debian-legal/2004/05/msg00595.html, I think they
are conflict licenses.
 
Just want to know if we need to do something? Such as add an additional
license file?
 
 
More information:
meta-openembedded/meta-oe/recipes-kernel/ipmitool/ipmitool_1.8.18.bb
LICENSE = "BSD-3-Clause"
DEPENDS = "openssl readline ncurses"
 
Readline is GPLv3
 
meta-openembedded/meta-oe/recipes-connectivity/krb5/krb5_1.17.bb:
LICENSE = "MIT"
DEPENDS = "bison-native ncurses util-linux e2fsprogs e2fsprogs-native
openssl"
 
Util-linux is GPLv2
 
 
Thanks,
Yong

Re: license conflicts with OpenSSL

[Alexander Amelkin]

[-- Attachment #1.1: Type: text/plain, Size: 867 bytes --]

02.12.2019 4:08, Yong Li wrote:
> Thanks Alexander for your quick response!
>
> My understanding is that you will perform some changes in the upstream
> https://github.com/ipmitool/ipmitool, to remove these unused/obsolete
> dependencies.

You're correct. I've already posted a PR to remove the ncurses dependency:
https://github.com/ipmitool/ipmitool/pull/175

I'd like at least Vernon to approve it before I merge it into master.

> But I notice the ipmitool_1.8.18.bb file in openembedded is using these
> .tar.bz2 files from sourceforge.net. Just want to know do you upload the new
> versions to sourceforge.net?

No, the sourceforge.net is abandoned and will not be updated.

New releases will be available at https://github.com/ipmitool/ipmitool/releases

I don't yet have any schedule for the next release though.

WBR, Alexander.




[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 819 bytes --]

RE: license conflicts with OpenSSL

[Yong Li]

Thanks Alexander for your information.

The .bb file in openBMC project also needs to remove the ncurse dependency.

Will monitor the PR and  submit the changes, also enabling " --disable-ipmishell"

Thanks,
Yong

-----Original Message-----
From: Alexander Amelkin <a.amelkin@yadro.com> 
Sent: Monday, December 2, 2019 11:13 PM
To: Yong Li <yong.b.li@linux.intel.com>; openbmc@lists.ozlabs.org
Subject: Re: license conflicts with OpenSSL

02.12.2019 4:08, Yong Li wrote:
> Thanks Alexander for your quick response!
>
> My understanding is that you will perform some changes in the upstream 
> https://github.com/ipmitool/ipmitool, to remove these unused/obsolete 
> dependencies.

You're correct. I've already posted a PR to remove the ncurses dependency:
https://github.com/ipmitool/ipmitool/pull/175

I'd like at least Vernon to approve it before I merge it into master.

> But I notice the ipmitool_1.8.18.bb file in openembedded is using 
> these
> .tar.bz2 files from sourceforge.net. Just want to know do you upload 
> the new versions to sourceforge.net?

No, the sourceforge.net is abandoned and will not be updated.

New releases will be available at https://github.com/ipmitool/ipmitool/releases

I don't yet have any schedule for the next release though.

WBR, Alexander.