[PATCH 0/2] gnutls update to 3.4.1

[PATCH 0/2] gnutls update to 3.4.1

[Armin Kuster]

The nettle and gnutls updates must be done as a pair.

The following changes since commit 4948bf62f63e311744ef2ba1e750d4c08a0794c4:

  tcmode-default: Test gcc 5.1 (2015-06-28 06:05:07 -0700)

are available in the git repository at:

  git://git.yoctoproject.org/poky-contrib akuster/gnutls_update
  http://git.yoctoproject.org/cgit.cgi//log/?h=akuster/gnutls_update

Armin Kuster (2):
  nettle: update package to 3.1.1 version.
  gnutls: update to 3.4.1

 meta/recipes-support/gnutls/gnutls.inc             |  4 ++-
 .../gnutls/configure.ac-fix-sed-command.patch      | 29 ++++++++++------------
 meta/recipes-support/gnutls/gnutls_3.3.14.bb       |  8 ------
 meta/recipes-support/gnutls/gnutls_3.4.1.bb        |  8 ++++++
 .../nettle/{nettle_2.7.1.bb => nettle_3.1.1.bb}    | 12 ++++-----
 5 files changed, 30 insertions(+), 31 deletions(-)
 delete mode 100644 meta/recipes-support/gnutls/gnutls_3.3.14.bb
 create mode 100644 meta/recipes-support/gnutls/gnutls_3.4.1.bb
 rename meta/recipes-support/nettle/{nettle_2.7.1.bb => nettle_3.1.1.bb} (48%)

-- 
1.9.1

[PATCH 1/2] nettle: update package to 3.1.1 version.

[Armin Kuster]

this requires the gnutls 3.4.1  update or the current gnutils build will break.

Signed-off-by: Armin Kuster <akuster808@gmail.com>
---
 .../nettle/{nettle_2.7.1.bb => nettle_3.1.1.bb}              | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)
 rename meta/recipes-support/nettle/{nettle_2.7.1.bb => nettle_3.1.1.bb} (48%)

diff --git a/meta/recipes-support/nettle/nettle_2.7.1.bb b/meta/recipes-support/nettle/nettle_3.1.1.bb
similarity index 48%
rename from meta/recipes-support/nettle/nettle_2.7.1.bb
rename to meta/recipes-support/nettle/nettle_3.1.1.bb
index f53afcc..ce5e756 100644
--- a/meta/recipes-support/nettle/nettle_2.7.1.bb
+++ b/meta/recipes-support/nettle/nettle_3.1.1.bb
@@ -1,17 +1,17 @@
 SUMMARY = "A low level cryptographic library"
 HOMEPAGE = "http://www.lysator.liu.se/~nisse/nettle/"
 SECTION = "libs"
-LICENSE = "LGPLv2.1 & GPLv2"
-LIC_FILES_CHKSUM = "file://COPYING.LIB;md5=2d5025d4aa3495befef8f17206a5b0a1 \
-                    file://serpent-decrypt.c;beginline=53;endline=67;md5=bcfd4745d53ca57f82907089898e390d \
-                    file://serpent-set-key.c;beginline=56;endline=70;md5=bcfd4745d53ca57f82907089898e390d"
+LICENSE = "GPLv2+ & GPLv3 & LGPLv3+"
+LIC_FILES_CHKSUM = "file://COPYINGv2;beginline=1;endline=2;md5=c70d8d3310941dcdfcd1e02800a1f548 \
+                    file://COPYINGv3;beginline=1;endline=2;md5=d1c727712ceba52db52e0ee449cadf43  \
+                    file://COPYING.LESSERv3;beginline=1;endline=2;md5=ff44a06d461487fb65f84ad672a1d1c8"
 
 DEPENDS += "gmp"
 
 SRC_URI = "http://www.lysator.liu.se/~nisse/archive/${BP}.tar.gz"
 
-SRC_URI[md5sum] = "003d5147911317931dd453520eb234a5"
-SRC_URI[sha256sum] = "bc71ebd43435537d767799e414fce88e521b7278d48c860651216e1fc6555b40"
+SRC_URI[md5sum] = "b40fa88dc32f37a182b6b42092ebb144"
+SRC_URI[sha256sum] = "5fd4d25d64d8ddcb85d0d897572af73b05b4d163c6cc49438a5bfbb8ff293d4c"
 
 EXTRA_OECONF = "--disable-openssl"
 
-- 
1.9.1

[PATCH 2/2] gnutls: update to 3.4.1

[Armin Kuster]

This version supports the nettle 3.x and higher and requires that version.

this include a security fix:
GNUTLS-SA-2015-2
no CVE assigned to date.

enable openssl compat via PACKAGECONFIG as iputils needs gnutls/openssl.h

for migration info:
http://www.gnutls.org/manual/gnutls.html#Upgrading-from-previous-versions

V2: Fix some build depends seen on some systems.
WARNING: QA Issue: gnutls-openssl rdepends on libidn, but it isn't a build dependency? [build-deps]
WARNING: QA Issue: gnutls-xx rdepends on libidn, but it isn't a build dependency? [build-deps]
WARNING: QA Issue: gnutls-dev rdepends on libidn, but it isn't a build dependency? [build-deps]
WARNING: QA Issue: gnutls-bin rdepends on libidn, but it isn't a build dependency? [build-deps]
WARNING: QA Issue: gnutls rdepends on libidn, but it isn't a build dependency? [build-deps]

V3: fix typo in PACKAGECONFG

Signed-off-by: Armin Kuster <akuster808@gmail.com>
---
 meta/recipes-support/gnutls/gnutls.inc             |  4 ++-
 .../gnutls/configure.ac-fix-sed-command.patch      | 29 ++++++++++------------
 meta/recipes-support/gnutls/gnutls_3.3.14.bb       |  8 ------
 meta/recipes-support/gnutls/gnutls_3.4.1.bb        |  8 ++++++
 4 files changed, 24 insertions(+), 25 deletions(-)
 delete mode 100644 meta/recipes-support/gnutls/gnutls_3.3.14.bb
 create mode 100644 meta/recipes-support/gnutls/gnutls_3.4.1.bb

diff --git a/meta/recipes-support/gnutls/gnutls.inc b/meta/recipes-support/gnutls/gnutls.inc
index e9b138a..5585e8d 100644
--- a/meta/recipes-support/gnutls/gnutls.inc
+++ b/meta/recipes-support/gnutls/gnutls.inc
@@ -34,9 +34,11 @@ do_configure_prepend() {
 	done
 }
 
-PACKAGECONFIG ??= "zlib"
+PACKAGECONFIG ??= "zlib openssl_compat"
 PACKAGECONFIG[tpm] = "--with-tpm, --without-tpm, trousers"
 PACKAGECONFIG[zlib] = "--with-zlib, --without-zlib, zlib"
+PACKAGECONFIG[openssl_compat] = "--enable-openssl-compatibility"
+PACKAGECONFIG[libidn] = "--with-idn,--without-idn, libidn"
 
 PACKAGES =+ "${PN}-openssl ${PN}-xx"
 
diff --git a/meta/recipes-support/gnutls/gnutls/configure.ac-fix-sed-command.patch b/meta/recipes-support/gnutls/gnutls/configure.ac-fix-sed-command.patch
index 44a9934..342143f 100644
--- a/meta/recipes-support/gnutls/gnutls/configure.ac-fix-sed-command.patch
+++ b/meta/recipes-support/gnutls/gnutls/configure.ac-fix-sed-command.patch
@@ -13,19 +13,16 @@ Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
  configure.ac | 2 +-
  1 file changed, 1 insertion(+), 1 deletion(-)
 
-diff --git a/configure.ac b/configure.ac
-index c6818a0..1c4582d 100644
---- a/configure.ac
-+++ b/configure.ac
-@@ -466,7 +466,7 @@ if test "$NEED_LIBOPTS_DIR" = "true";then
- 	dnl replace libopts-generated files with distributed backups, if present
- 	missing_baks=
- 	for i in ${srcdir}/src/*-args.c.bak ${srcdir}/src/*-args.h.bak; do
--		nam=`echo $i|sed 's/.bak//g'`
-+		nam=`echo $i|sed 's/\.bak$//'`
- 		if test -f $i;then
- 			cp -f $i $nam
- 		else
--- 
-2.0.1
-
+Index: gnutls-3.4.1/configure.ac
+===================================================================
+--- gnutls-3.4.1.orig/configure.ac
++++ gnutls-3.4.1/configure.ac
+@@ -530,7 +530,7 @@ if test "$enable_tools" != "no" || test
+ 		dnl replace libopts-generated files with distributed backups, if present
+ 		missing_baks=
+ 		for i in ${srcdir}/src/*-args.c.bak ${srcdir}/src/*-args.h.bak; do
+-			nam=`echo $i|sed 's/.bak//g'`
++			nam=`echo $i|sed 's/\.bak$//'`
+ 			if test -f $i;then
+ 				cp -f $i $nam
+ 			else
diff --git a/meta/recipes-support/gnutls/gnutls_3.3.14.bb b/meta/recipes-support/gnutls/gnutls_3.3.14.bb
deleted file mode 100644
index f41d183..0000000
--- a/meta/recipes-support/gnutls/gnutls_3.3.14.bb
+++ /dev/null
@@ -1,8 +0,0 @@
-require gnutls.inc
-
-SRC_URI += "file://correct_rpl_gettimeofday_signature.patch \
-            file://configure.ac-fix-sed-command.patch \
-            file://use-pkg-config-to-locate-zlib.patch \
-           "
-SRC_URI[md5sum] = "7f4465f8c564cf9cb8f5cb38b909f7ca"
-SRC_URI[sha256sum] = "0dfa0030faad8909c1e904105198232d6bc0123cae8cf4933b2bac85ee7cec52"
diff --git a/meta/recipes-support/gnutls/gnutls_3.4.1.bb b/meta/recipes-support/gnutls/gnutls_3.4.1.bb
new file mode 100644
index 0000000..1b64813
--- /dev/null
+++ b/meta/recipes-support/gnutls/gnutls_3.4.1.bb
@@ -0,0 +1,8 @@
+require gnutls.inc
+
+SRC_URI += "file://correct_rpl_gettimeofday_signature.patch  \
+            file://configure.ac-fix-sed-command.patch \
+            file://use-pkg-config-to-locate-zlib.patch \
+          "
+SRC_URI[md5sum] = "2d04f34fa25b45f9dcb9104c0394e12e"
+SRC_URI[sha256sum] = "e9b5f58becf34756464216056cd5abbf04315eda80a374d02699dee83f80b12e"
-- 
1.9.1

Re: [PATCH 1/2] nettle: update package to 3.1.1 version.

[Burton, Ross]

[-- Attachment #1: Type: text/plain, Size: 519 bytes --]

On 28 June 2015 at 14:18, Armin Kuster <akuster808@gmail.com> wrote:

> this requires the gnutls 3.4.1  update or the current gnutils build will
> break.
>

This appears to brake our partial support for building core-image-base
without GPLv3:

https://autobuilder.yoctoproject.org/main/builders/nightly-non-gpl3/builds/372/steps/BuildImages/logs/stdio

Either we trim down what we consider buildable without v3, disable gnutls
in iputils, or include the older versions in oe-core.

Any thoughts?

Ross

[-- Attachment #2: Type: text/html, Size: 1150 bytes --]

Re: [PATCH 1/2] nettle: update package to 3.1.1 version.

[Anders Darander]

* Burton, Ross <ross.burton@intel.com> [150702 00:43]:

> On 28 June 2015 at 14:18, Armin Kuster <akuster808@gmail.com> wrote:

> > this requires the gnutls 3.4.1  update or the current gnutils build will
> > break.

> This appears to brake our partial support for building core-image-base
> without GPLv3:

> https://autobuilder.yoctoproject.org/main/builders/nightly-non-gpl3/builds/372/steps/BuildImages/logs/stdio

> Either we trim down what we consider buildable without v3, disable gnutls
> in iputils, or include the older versions in oe-core.

Without looking too much at this specific issue, I'd say that we should
keep the older version in oe-core. Just as we normally try to do when it
comes to GPLv2 / GPLv3 upgrades.

In my opinion, having as much as possible build in a non-GPLv3 build is
a desirable goal.

Cheers,
Anders

-- 
Anders Darander
ChargeStorm AB / eStorm AB

Re: [PATCH 1/2] nettle: update package to 3.1.1 version.

[Burton, Ross]

[-- Attachment #1: Type: text/plain, Size: 447 bytes --]

On 2 July 2015 at 12:30, Anders Darander <anders@chargestorm.se> wrote:

> Without looking too much at this specific issue, I'd say that we should
> keep the older version in oe-core. Just as we normally try to do when it
> comes to GPLv2 / GPLv3 upgrades.
>
> In my opinion, having as much as possible build in a non-GPLv3 build is
> a desirable goal.
>

I neglected to leave my opinion in my mail, but that's also my thought.

Ross

[-- Attachment #2: Type: text/html, Size: 870 bytes --]

Re: [PATCH 1/2] nettle: update package to 3.1.1 version.

[akuster808]

The current version of nettle 2.7 has one file that is GPL v3.
mini-gmp.*

so the license for 2.7 should be updated IMHO. So wont that put us in 
the same boat as the upgrade?

- armin


On 07/01/2015 03:42 PM, Burton, Ross wrote:
>
> On 28 June 2015 at 14:18, Armin Kuster <akuster808@gmail.com
> <mailto:akuster808@gmail.com>> wrote:
>
>     this requires the gnutls 3.4.1  update or the current gnutils build
>     will break.
>
>
> This appears to brake our partial support for building core-image-base
> without GPLv3:
>
> https://autobuilder.yoctoproject.org/main/builders/nightly-non-gpl3/builds/372/steps/BuildImages/logs/stdio
>
> Either we trim down what we consider buildable without v3, disable
> gnutls in iputils, or include the older versions in oe-core.
>
> Any thoughts?
>
> Ross

Re: [PATCH 1/2] nettle: update package to 3.1.1 version.

[Burton, Ross]

[-- Attachment #1: Type: text/plain, Size: 284 bytes --]

On 2 July 2015 at 18:04, akuster808 <akuster808@gmail.com> wrote:

> The current version of nettle 2.7 has one file that is GPL v3.
> mini-gmp.*
>
> so the license for 2.7 should be updated IMHO. So wont that put us in the
> same boat as the upgrade?
>

Yes.  Ouch.

Ross

[-- Attachment #2: Type: text/html, Size: 695 bytes --]

Re: [PATCH 1/2] nettle: update package to 3.1.1 version.

[akuster808]

On 7/2/15 11:46 AM, Burton, Ross wrote:
>
> On 2 July 2015 at 18:04, akuster808 <akuster808@gmail.com
> <mailto:akuster808@gmail.com>> wrote:
>
>     The current version of nettle 2.7 has one file that is GPL v3.
>     mini-gmp.*
>
>     so the license for 2.7 should be updated IMHO. So wont that put us
>     in the same boat as the upgrade?
>
>
> Yes.  Ouch.

So what now then? meta-oe-core-GPLv3  ; )

- armin
>
> Ross

Re: [PATCH 1/2] nettle: update package to 3.1.1 version.

[Anders Darander]

* akuster808 <akuster808@gmail.com> [150702 19:05]:

> The current version of nettle 2.7 has one file that is GPL v3.
> mini-gmp.*

> so the license for 2.7 should be updated IMHO. So wont that put us in the
> same boat as the upgrade?

Ouch, that's no good!

Ideally, we should look at that file and see for how long it's been part
of nettle. If it's just for a short time, maybe we could go back to a
point in time just prior to the inclusion (or license change) of that
file.

Has it been like this for far too long, well, then we either have to see
what impact this has on non-GPLv3 builds...

One option, depending on the age etc, could be to check if it's possible
to get that single file re-licensed. Short-term, we have to fix the
license and backport that fix to all supported versions that are
affected, even though that might introduce regressions in images around
the world... 

Cheers,
Anders

-- 
Anders Darander
ChargeStorm AB / eStorm AB

Re: [PATCH 1/2] nettle: update package to 3.1.1 version.

[Paul Eggleton]

On Friday 03 July 2015 09:07:16 Anders Darander wrote:
> * akuster808 <akuster808@gmail.com> [150702 19:05]:
> > The current version of nettle 2.7 has one file that is GPL v3.
> > mini-gmp.*
> > 
> > so the license for 2.7 should be updated IMHO. So wont that put us in the
> > same boat as the upgrade?
> 
> Ouch, that's no good!
> 
> Ideally, we should look at that file and see for how long it's been part
> of nettle. If it's just for a short time, maybe we could go back to a
> point in time just prior to the inclusion (or license change) of that
> file.
> 
> Has it been like this for far too long, well, then we either have to see
> what impact this has on non-GPLv3 builds...
> 
> One option, depending on the age etc, could be to check if it's possible
> to get that single file re-licensed. Short-term, we have to fix the
> license and backport that fix to all supported versions that are
> affected, even though that might introduce regressions in images around
> the world...

We also ought to poke upstream because as far as I can tell they have not 
noted the addition of this differently licensed source in any of the license 
notices shipped with it (other than in the added GPLv3 source files themselves, 
of course).

Armin, is that something you'd be able to take care of?

Cheers,
Paul

-- 

Paul Eggleton
Intel Open Source Technology Centre

Re: [PATCH 1/2] nettle: update package to 3.1.1 version.

[akuster808]

On 07/03/2015 12:07 AM, Anders Darander wrote:
> * akuster808 <akuster808@gmail.com> [150702 19:05]:
>
>> The current version of nettle 2.7 has one file that is GPL v3.
>> mini-gmp.*
>
>> so the license for 2.7 should be updated IMHO. So wont that put us in the
>> same boat as the upgrade?
>
> Ouch, that's no good!
>
> Ideally, we should look at that file and see for how long it's been part
> of nettle. If it's just for a short time, maybe we could go back to a
> point in time just prior to the inclusion (or license change) of that
> file.

this file has been in nettle for two years. It was introduced with th 
2.7 release.  Parts of that file are pulled from the gmp project.

>
> Has it been like this for far too long, well, then we either have to see
> what impact this has on non-GPLv3 builds...
>

Does "Lesser" GPLv3 count? Looked a the file again and 'Lesser' is near 
the beginning of the paragraph before 'version 3'.

Does this change things for nettle 2.7?

- armin

> One option, depending on the age etc, could be to check if it's possible
> to get that single file re-licensed. Short-term, we have to fix the
> license and backport that fix to all supported versions that are
> affected, even though that might introduce regressions in images around
> the world...
>
> Cheers,
> Anders
>

Re: [PATCH 1/2] nettle: update package to 3.1.1 version.

[Paul Eggleton]

Hi Armin,

On Friday 03 July 2015 14:54:22 akuster808 wrote:
> On 07/03/2015 12:07 AM, Anders Darander wrote:
> > * akuster808 <akuster808@gmail.com> [150702 19:05]:
> >> The current version of nettle 2.7 has one file that is GPL v3.
> >> mini-gmp.*
> >> 
> >> so the license for 2.7 should be updated IMHO. So wont that put us in the
> >> same boat as the upgrade?
> > 
> > Ouch, that's no good!
> > 
> > Ideally, we should look at that file and see for how long it's been part
> > of nettle. If it's just for a short time, maybe we could go back to a
> > point in time just prior to the inclusion (or license change) of that
> > file.
> 
> this file has been in nettle for two years. It was introduced with th
> 2.7 release.  Parts of that file are pulled from the gmp project.
> 
> > Has it been like this for far too long, well, then we either have to see
> > what impact this has on non-GPLv3 builds...
> 
> Does "Lesser" GPLv3 count? Looked a the file again and 'Lesser' is near
> the beginning of the paragraph before 'version 3'.
> 
> Does this change things for nettle 2.7?

Well, at minimum for our purposes LGPLv3 (or LGPLv3+?) needs to be added to 
LICENSE in the nettle recipe (with &). Whether or not someone chooses to 
exclude that license in their configuration through INCOMPATIBLE_LICENSE is a 
completely separate matter (and that is, as you allude to, a distinct license 
from GPLv3).

I just think it's something that upstream ought to be noting in their license 
statement, because they don't appear to be at the moment.

Cheers,
Paul

-- 

Paul Eggleton
Intel Open Source Technology Centre

Re: [PATCH 1/2] nettle: update package to 3.1.1 version.

[Burton, Ross]

[-- Attachment #1: Type: text/plain, Size: 859 bytes --]

On 4 July 2015 at 12:38, Paul Eggleton <paul.eggleton@linux.intel.com>
wrote:

> Well, at minimum for our purposes LGPLv3 (or LGPLv3+?) needs to be added to
> LICENSE in the nettle recipe (with &). Whether or not someone chooses to
> exclude that license in their configuration through INCOMPATIBLE_LICENSE
> is a
> completely separate matter (and that is, as you allude to, a distinct
> license
> from GPLv3).
>

FWIW the YP documentation states to mark GPL LGPL and AGPL v3 in
INCOMPATIBLE_LICENSE to build a GPLv3 image, on the rationale that the
usual clauses that upset people are not specific to the GPL variation.  The
autobuilder just excludes GPL right now, but there's a bug to fix this.

Of course IANAL and the opinion of someone who actually does use
INCOMPATIBLE_LICENSE to remove GPLv3 software would be appreciated!

Ross

[-- Attachment #2: Type: text/html, Size: 1339 bytes --]

Re: [PATCH 1/2] nettle: update package to 3.1.1 version.

[Paul Eggleton]

On Monday 06 July 2015 14:04:46 Burton, Ross wrote:
> On 4 July 2015 at 12:38, Paul Eggleton <paul.eggleton@linux.intel.com>
> 
> wrote:
> > Well, at minimum for our purposes LGPLv3 (or LGPLv3+?) needs to be added
> > to
> > LICENSE in the nettle recipe (with &). Whether or not someone chooses to
> > exclude that license in their configuration through INCOMPATIBLE_LICENSE
> > is a
> > completely separate matter (and that is, as you allude to, a distinct
> > license
> > from GPLv3).
> 
> FWIW the YP documentation states to mark GPL LGPL and AGPL v3 in
> INCOMPATIBLE_LICENSE to build a GPLv3 image, on the rationale that the
> usual clauses that upset people are not specific to the GPL variation.  The
> autobuilder just excludes GPL right now, but there's a bug to fix this.
> 
> Of course IANAL and the opinion of someone who actually does use
> INCOMPATIBLE_LICENSE to remove GPLv3 software would be appreciated!

I'm also not a lawyer, but for that exact reason I don't think we want to get 
into any question of license equivalence or similarity - INCOMPATIBLE_LICENSE, 
if used, needs to list all of the licenses you wish to exclude, so if you want 
LGPLv3 excluded then you need to state that in addition to GPLv3 (and 
naturally any recipe that builds LGPLv3-licensed source needs to state as such 
in the LICENSE value).

Cheers,
Paul

-- 

Paul Eggleton
Intel Open Source Technology Centre

Re: [PATCH 1/2] nettle: update package to 3.1.1 version.

[Anders Darander]

* akuster808 <akuster808@gmail.com> [150702 19:05]:

> The current version of nettle 2.7 has one file that is GPL v3.
> mini-gmp.*

> so the license for 2.7 should be updated IMHO. So wont that put us in the
> same boat as the upgrade?

Well, after looking a little bit at the repo in question, my
understanding is that all files (well, those few I looked at, including
mini-gmp.*) is dual licensed LGPLv3 /or/ GPLv2+, in the current master
branch. It looks like this was done 2014-04-12, in 12 commits.

So could you double check the 3.1.1 release, and verify whether it only
consists of LGPLv3 | GPLv2+ licensed files, or if there actually are any
files having the GPLv3(+) restriction?

At least the commits from 2014-04-12 suggests that the whole nettle repo
was clarified to be dual-licensed as  LGPLv3 | GPLv2+ (though there's of
course a risk that some files are left untouched). Though, it also
suggests that upstream is willing to ensure that GPLv2 compatibility
remains as an option.

Cheers,
Anders

-- 
Anders Darander
ChargeStorm AB / eStorm AB

Re: [PATCH 1/2] nettle: update package to 3.1.1 version.

[Anders Darander]

* Paul Eggleton <paul.eggleton@linux.intel.com> [150706 15:58]:

> On Monday 06 July 2015 14:04:46 Burton, Ross wrote:
> > On 4 July 2015 at 12:38, Paul Eggleton <paul.eggleton@linux.intel.com>

> > wrote:
> > > Well, at minimum for our purposes LGPLv3 (or LGPLv3+?) needs to be
> > > added to LICENSE in the nettle recipe (with &). Whether or not
> > > someone chooses to exclude that license in their configuration
> > > through INCOMPATIBLE_LICENSE is a completely separate matter (and
> > > that is, as you allude to, a distinct license from GPLv3).

> > FWIW the YP documentation states to mark GPL LGPL and AGPL v3 in
> > INCOMPATIBLE_LICENSE to build a GPLv3 image, on the rationale that the
> > usual clauses that upset people are not specific to the GPL variation.  The
> > autobuilder just excludes GPL right now, but there's a bug to fix this.

Good. I had assumed that it was changed after the discussion that lead
to the additional mentioning of LGPL-3.0 and AGPL-3.0 in the YP Manual.

> > Of course IANAL and the opinion of someone who actually does use
> > INCOMPATIBLE_LICENSE to remove GPLv3 software would be appreciated!

Well, I guess that it's the opinion of someone who uses that, and has
been running that through lawyers that's needed. Maybe one of the
commercial distributors can chim in on that.

Otherwise I guess that a lot of people using INCOMPATIBLE_LICENSE are
doing that on a layman's basis, just like me...

> I'm also not a lawyer, but for that exact reason I don't think we want to get 
> into any question of license equivalence or similarity - INCOMPATIBLE_LICENSE, 
> if used, needs to list all of the licenses you wish to exclude, so if you want 
> LGPLv3 excluded then you need to state that in addition to GPLv3 (and 
> naturally any recipe that builds LGPLv3-licensed source needs to state as such 
> in the LICENSE value).

Yes, we certainly don't want to state that everything except for a short
list of licenses is OK. In the end, that's up to each and every company
making products to decide.

Though, in the YP documentation, we state as an example on how to get
GPLv3-free builds, that you should set INCOMPATIBLE_LICENSE to "GPL-3.0
LGPL-3.0 AGPL-3.0", per an e-mail thread from last year (if I remember
correctly. I know that at least Mark Hatle was involved in that thread,
as well as I).

Cheers,
Anders

-- 
Anders Darander
ChargeStorm AB / eStorm AB

Re: [PATCH 1/2] nettle: update package to 3.1.1 version.

[Burton, Ross]

[-- Attachment #1: Type: text/plain, Size: 718 bytes --]

On 7 July 2015 at 06:34, Anders Darander <anders@chargestorm.se> wrote:
>
> So could you double check the 3.1.1 release, and verify whether it only
> consists of LGPLv3 | GPLv2+ licensed files, or if there actually are any
> files having the GPLv3(+) restriction?

The nettle manual says quite clearly:

"Nettle is dual licenced under the GNU General Public License version 2
or later, and the GNU Lesser General Public License version 3 or later"
<https://git.lysator.liu.se/nettle/nettle/blob/master/nettle.texinfo#L147>
(https://git.lysator.liu.se/nettle/nettle/blob/master/nettle.texinfo#L147)

An updated recipe that puts the "or" operator in the LICENSE field will
solve all the problems.

Ross

[-- Attachment #2: Type: text/html, Size: 1007 bytes --]

Re: [PATCH 1/2] nettle: update package to 3.1.1 version.

[akuster808]

On 07/07/2015 03:40 AM, Burton, Ross wrote:
>
> On 7 July 2015 at 06:34, Anders Darander <anders@chargestorm.se
> <mailto:anders@chargestorm.se>> wrote:
>  >
>  > So could you double check the 3.1.1 release, and verify whether it only
>  > consists of LGPLv3 | GPLv2+ licensed files, or if there actually are any
>  > files having the GPLv3(+) restriction?
>
> The nettle manual says quite clearly:
>
> "Nettle is dual licenced under the GNU General Public License version 2
> or later, and the GNU Lesser General Public License version 3 or later"
> <https://git.lysator.liu.se/nettle/nettle/blob/master/nettle.texinfo#L147>
> (https://git.lysator.liu.se/nettle/nettle/blob/master/nettle.texinfo#L147)
>
> An updated recipe that puts the "or" operator in the LICENSE field will
> solve all the problems.

which recipe? 2.7.1 / 3.1 or both?

- armin
( sucks at this licensing stuff)
>
> Ross
>
>

Re: [PATCH 1/2] nettle: update package to 3.1.1 version.

[Burton, Ross]

[-- Attachment #1: Type: text/plain, Size: 427 bytes --]

On 7 July 2015 at 21:09, akuster808 <akuster808@gmail.com> wrote:

> which recipe? 2.7.1 / 3.1 or both?
>
> - armin
> ( sucks at this licensing stuff)
>
>>
So: 2.7.1 is "LGPL" (v2).

3.1.1 is GPLv2+ or LGPLv3+.

An "interesting" choice to say the least. Because the v2 bit is not L, I'm
wondering if we will need to keep both versions.  But a 3.1.1 recipe with
GPLv2+ *or* LGPLv3+ would be a good start.

Ross

[-- Attachment #2: Type: text/html, Size: 1099 bytes --]

Re: [PATCH 1/2] nettle: update package to 3.1.1 version.

[Andre McCurdy]

On Tue, Jul 7, 2015 at 1:30 PM, Burton, Ross <ross.burton@intel.com> wrote:
> On 7 July 2015 at 21:09, akuster808 <akuster808@gmail.com> wrote:
>>
>> which recipe? 2.7.1 / 3.1 or both?
>>
>> - armin
>> ( sucks at this licensing stuff)
>
>
> So: 2.7.1 is "LGPL" (v2).
>
> 3.1.1 is GPLv2+ or LGPLv3+.
>
> An "interesting" choice to say the least. Because the v2 bit is not L, I'm
> wondering if we will need to keep both versions.  But a 3.1.1 recipe with
> GPLv2+ *or* LGPLv3+ would be a good start.

I'd vote YES to keeping the LGPLv2 version available.

GPL libraries are normally off limits for closed source apps, so the
new licensing options would be a problem for anyone with a proprietary
application using nettle in a distro which can't use [L]GPLv3. (I'm in
that category...).

> Ross
>
> --
> _______________________________________________
> Openembedded-core mailing list
> Openembedded-core@lists.openembedded.org
> http://lists.openembedded.org/mailman/listinfo/openembedded-core
>

Re: [PATCH 1/2] nettle: update package to 3.1.1 version.

[Richard Purdie]

On Tue, 2015-07-07 at 14:03 -0700, Andre McCurdy wrote:
> On Tue, Jul 7, 2015 at 1:30 PM, Burton, Ross <ross.burton@intel.com> wrote:
> > On 7 July 2015 at 21:09, akuster808 <akuster808@gmail.com> wrote:
> >>
> >> which recipe? 2.7.1 / 3.1 or both?
> >>
> >> - armin
> >> ( sucks at this licensing stuff)
> >
> >
> > So: 2.7.1 is "LGPL" (v2).
> >
> > 3.1.1 is GPLv2+ or LGPLv3+.
> >
> > An "interesting" choice to say the least. Because the v2 bit is not L, I'm
> > wondering if we will need to keep both versions.  But a 3.1.1 recipe with
> > GPLv2+ *or* LGPLv3+ would be a good start.
> 
> I'd vote YES to keeping the LGPLv2 version available.
> 
> GPL libraries are normally off limits for closed source apps, so the
> new licensing options would be a problem for anyone with a proprietary
> application using nettle in a distro which can't use [L]GPLv3. (I'm in
> that category...).

Surely if you can't use [L]GPLv3, you want the 3.1.1 version which is
GPLv2 (or other things)?

Cheers,

Richard

Re: [PATCH 1/2] nettle: update package to 3.1.1 version.

[Andre McCurdy]

On Tue, Jul 7, 2015 at 4:04 PM, Richard Purdie
<richard.purdie@linuxfoundation.org> wrote:
> On Tue, 2015-07-07 at 14:03 -0700, Andre McCurdy wrote:
>> On Tue, Jul 7, 2015 at 1:30 PM, Burton, Ross <ross.burton@intel.com> wrote:
>> > On 7 July 2015 at 21:09, akuster808 <akuster808@gmail.com> wrote:
>> >>
>> >> which recipe? 2.7.1 / 3.1 or both?
>> >>
>> >> - armin
>> >> ( sucks at this licensing stuff)
>> >
>> >
>> > So: 2.7.1 is "LGPL" (v2).
>> >
>> > 3.1.1 is GPLv2+ or LGPLv3+.
>> >
>> > An "interesting" choice to say the least. Because the v2 bit is not L, I'm
>> > wondering if we will need to keep both versions.  But a 3.1.1 recipe with
>> > GPLv2+ *or* LGPLv3+ would be a good start.
>>
>> I'd vote YES to keeping the LGPLv2 version available.
>>
>> GPL libraries are normally off limits for closed source apps, so the
>> new licensing options would be a problem for anyone with a proprietary
>> application using nettle in a distro which can't use [L]GPLv3. (I'm in
>> that category...).
>
> Surely if you can't use [L]GPLv3, you want the 3.1.1 version which is
> GPLv2 (or other things)?

There are two separate issues.

Both GPLv3 and LGPLv3 block 'Tivoization', which rules out [L]GPLv3
for anyone needing to create signed firmware images which can not be
modified by the end user.

  http://www.gnu.org/licenses/rms-why-gplv3.en.html

Quite separate from that, linking an application with a GPL library
(any version of the GPL) requires that the application be released
under a GPL or GPL compatible license, so GPL libraries are generally
considered to be incompatible with closed source applications.
(Dynamically linking with an LGPL library is generally OK since the
LGPL license doesn't transfer to the application).

  http://www.gnu.org/licenses/gpl-faq.en.html#IfLibraryIsGPL
  http://www.gnu.org/licenses/gpl-faq.en.html#GPLStaticVsDynamic

So for someone with a proprietary application which links dynamically
with nettle in a distro which can't use [L]GPLv3, the older version of
nettle with an LGPLv2 license would be the only option.


> Cheers,
>
> Richard
>
>
>

Re: [PATCH 1/2] nettle: update package to 3.1.1 version.

[Anders Darander]

* Andre McCurdy <armccurdy@gmail.com> [150708 01:57]:
> There are two separate issues.

> Both GPLv3 and LGPLv3 block 'Tivoization', which rules out [L]GPLv3
> for anyone needing to create signed firmware images which can not be
> modified by the end user.

>   http://www.gnu.org/licenses/rms-why-gplv3.en.html

> Quite separate from that, linking an application with a GPL library
> (any version of the GPL) requires that the application be released
> under a GPL or GPL compatible license, so GPL libraries are generally
> considered to be incompatible with closed source applications.
> (Dynamically linking with an LGPL library is generally OK since the
> LGPL license doesn't transfer to the application).

>   http://www.gnu.org/licenses/gpl-faq.en.html#IfLibraryIsGPL
>   http://www.gnu.org/licenses/gpl-faq.en.html#GPLStaticVsDynamic

> So for someone with a proprietary application which links dynamically
> with nettle in a distro which can't use [L]GPLv3, the older version of
> nettle with an LGPLv2 license would be the only option.

Yep, that sounds correct to me and the sane thing for us to do.

Cheers,
Anders
-- 
Anders Darander
ChargeStorm AB / eStorm AB

[PATCH 2/2] gnutls: update to 3.4.1

[Armin Kuster]

This version supports the nettle 3.x and higher and requires that version.

this include a security fix:
GNUTLS-SA-2015-2
no CVE assigned to date.

enable openssl compat via PACKAGECONFIG as iputils needs gnutls/openssl.h

for migration info:
http://www.gnutls.org/manual/gnutls.html#Upgrading-from-previous-versions

Signed-off-by: Armin Kuster <akuster808@gmail.com>
---
 meta/recipes-support/gnutls/gnutls.inc             |  3 ++-
 .../gnutls/configure.ac-fix-sed-command.patch      | 29 ++++++++++------------
 meta/recipes-support/gnutls/gnutls_3.3.14.bb       |  8 ------
 meta/recipes-support/gnutls/gnutls_3.4.1.bb        |  8 ++++++
 4 files changed, 23 insertions(+), 25 deletions(-)
 delete mode 100644 meta/recipes-support/gnutls/gnutls_3.3.14.bb
 create mode 100644 meta/recipes-support/gnutls/gnutls_3.4.1.bb

diff --git a/meta/recipes-support/gnutls/gnutls.inc b/meta/recipes-support/gnutls/gnutls.inc
index e9b138a..6928cb9 100644
--- a/meta/recipes-support/gnutls/gnutls.inc
+++ b/meta/recipes-support/gnutls/gnutls.inc
@@ -34,9 +34,10 @@ do_configure_prepend() {
 	done
 }
 
-PACKAGECONFIG ??= "zlib"
+PACKAGECONFIG ??= "zlib openssl_compat"
 PACKAGECONFIG[tpm] = "--with-tpm, --without-tpm, trousers"
 PACKAGECONFIG[zlib] = "--with-zlib, --without-zlib, zlib"
+PACKAGECONFIG[openssl_compat] = "--enable-openssl-compatibility,,"
 
 PACKAGES =+ "${PN}-openssl ${PN}-xx"
 
diff --git a/meta/recipes-support/gnutls/gnutls/configure.ac-fix-sed-command.patch b/meta/recipes-support/gnutls/gnutls/configure.ac-fix-sed-command.patch
index 44a9934..342143f 100644
--- a/meta/recipes-support/gnutls/gnutls/configure.ac-fix-sed-command.patch
+++ b/meta/recipes-support/gnutls/gnutls/configure.ac-fix-sed-command.patch
@@ -13,19 +13,16 @@ Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
  configure.ac | 2 +-
  1 file changed, 1 insertion(+), 1 deletion(-)
 
-diff --git a/configure.ac b/configure.ac
-index c6818a0..1c4582d 100644
---- a/configure.ac
-+++ b/configure.ac
-@@ -466,7 +466,7 @@ if test "$NEED_LIBOPTS_DIR" = "true";then
- 	dnl replace libopts-generated files with distributed backups, if present
- 	missing_baks=
- 	for i in ${srcdir}/src/*-args.c.bak ${srcdir}/src/*-args.h.bak; do
--		nam=`echo $i|sed 's/.bak//g'`
-+		nam=`echo $i|sed 's/\.bak$//'`
- 		if test -f $i;then
- 			cp -f $i $nam
- 		else
--- 
-2.0.1
-
+Index: gnutls-3.4.1/configure.ac
+===================================================================
+--- gnutls-3.4.1.orig/configure.ac
++++ gnutls-3.4.1/configure.ac
+@@ -530,7 +530,7 @@ if test "$enable_tools" != "no" || test
+ 		dnl replace libopts-generated files with distributed backups, if present
+ 		missing_baks=
+ 		for i in ${srcdir}/src/*-args.c.bak ${srcdir}/src/*-args.h.bak; do
+-			nam=`echo $i|sed 's/.bak//g'`
++			nam=`echo $i|sed 's/\.bak$//'`
+ 			if test -f $i;then
+ 				cp -f $i $nam
+ 			else
diff --git a/meta/recipes-support/gnutls/gnutls_3.3.14.bb b/meta/recipes-support/gnutls/gnutls_3.3.14.bb
deleted file mode 100644
index f41d183..0000000
--- a/meta/recipes-support/gnutls/gnutls_3.3.14.bb
+++ /dev/null
@@ -1,8 +0,0 @@
-require gnutls.inc
-
-SRC_URI += "file://correct_rpl_gettimeofday_signature.patch \
-            file://configure.ac-fix-sed-command.patch \
-            file://use-pkg-config-to-locate-zlib.patch \
-           "
-SRC_URI[md5sum] = "7f4465f8c564cf9cb8f5cb38b909f7ca"
-SRC_URI[sha256sum] = "0dfa0030faad8909c1e904105198232d6bc0123cae8cf4933b2bac85ee7cec52"
diff --git a/meta/recipes-support/gnutls/gnutls_3.4.1.bb b/meta/recipes-support/gnutls/gnutls_3.4.1.bb
new file mode 100644
index 0000000..1b64813
--- /dev/null
+++ b/meta/recipes-support/gnutls/gnutls_3.4.1.bb
@@ -0,0 +1,8 @@
+require gnutls.inc
+
+SRC_URI += "file://correct_rpl_gettimeofday_signature.patch  \
+            file://configure.ac-fix-sed-command.patch \
+            file://use-pkg-config-to-locate-zlib.patch \
+          "
+SRC_URI[md5sum] = "2d04f34fa25b45f9dcb9104c0394e12e"
+SRC_URI[sha256sum] = "e9b5f58becf34756464216056cd5abbf04315eda80a374d02699dee83f80b12e"
-- 
2.3.5