From: Alex Graveley <[EMAIL PROTECTED]>
My comments below are my opinions only. Do not go around saying it's
official OpenSSL policy even though I am an OpenSSL developper.
alex> 1) What constitutes "use"? static linking, dynamic linking, runtime
alex> linking using dlopen(), all of the above?
My opinion: yes.
alex> 2) Is the process space boundry the limit of "use", as it is for the
alex> GPL?
My opinion: I'd put the boundary at the distribution level, where one
distribution uses OpenSSL, i.e. any component of the distribution does
direct calls to OpenSSL routines. The meaning of this is better
described below.
alex> 3) If an application (A) uses a proxy executable (B) for SSL
alex> communications, and B links with openssl and conforms to the openssl
alex> license. Must A still conform, even if the OpenSSL lib is never loaded
alex> into A's address space? What if A and B are distributed in the same
alex> project?
My opinion: If B has it's separate distribution and is called from A
as a protocol server (say, an HTTPS proxy), or if B is a library that
requires OpenSSL to function but does not export OpenSSL functions
directly, then distribution containing B should have in it's
documentation and possible advertisement the acknowledgment as stated
in clause 3 of the license. If B is a component of the same package
where A is distributed, the documentation of that distribution should
have that acknowledgment.
alex> 3) Does "this software" in the excerpt from the OpenSSL LICENSE file
alex> below mean OpenSSL or the software which is using OpenSSL? Does
alex> "features" below mean only things which are related to SSL or Crypto
alex> features?
alex>
alex> * 3. All advertising materials mentioning features or use of this
alex> * software must display the following acknowledgment:
alex> * "This product includes software developed by the OpenSSL
alex> Project
alex> * for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
"this software" means OpenSSL and the components therein.
alex> Right now I have proxy code written, which keeps OpenSSL code out
alex> of the library proper. However this is slow and hackish, I would like
alex> some
alex> way where applications could use my library, linking in OpenSSL to their
alex> address space, but not being forced to conform to the advertising
alex> clause.
My opinion: if you distribute the proxy code as a separate package and
the rest of your application doesn't call OpenSSL and your proxy and
application aren't bundled together in one distribution, then you can
get away with only acknowledging the use of OpenSSL in your proxy
distribution. This will obviously mean that you will have to tell
people that your application A requires or recommends the installation
of yoru proxy B, which will indirectly lead them to the acknowledgment
of OpenSSL :-).
Personally, I've some trouble understandnig why it's such a big deal
to acknowledge what you're using.
--
Richard Levitte \ Spannvägen 38, II \ [EMAIL PROTECTED]
Chairman@Stacken \ S-168 35 BROMMA \ T: +46-8-26 52 47
Redakteur@Stacken \ SWEDEN \ or +46-709-50 36 10
Procurator Odiosus Ex Infernis -- [EMAIL PROTECTED]
Member of the OpenSSL development team: http://www.openssl.org/
Software Engineer, Celo Communications: http://www.celocom.com/
Unsolicited commercial email is subject to an archival fee of $400.
See <http://www.stacken.kth.se/~levitte/mail/> for more info.
______________________________________________________________________
OpenSSL Project http://www.openssl.org
User Support Mailing List [EMAIL PROTECTED]
Automated List Manager [EMAIL PROTECTED]
