Re: openssl097a package retirement

[Debarshi Ray]

[Continuing from the fedora-maintainers list.]

On 22/08/2007, Tomas Mraz <tmraz(a)redhat.com&gt; wrote:
>  If there will not be any serious objections I'll retire
> openssl097a
>  package in rawhide.
>
>  It doesn't make much sense to maintain this old version of openssl in
>  Fedora. 
I am packaging httrack, which has the following snippet:

      /* We are compatible with 0.9.6/7/8 and potentially above */
      handle = dlopen("libssl.so.0.9.8", RTLD_LAZY);
      if (handle == NULL) {
        handle = dlopen("libssl.so.0.9.7", RTLD_LAZY);
      }
      if (handle == NULL) {
        handle = dlopen("libssl.so.0.9.6", RTLD_LAZY);
      }
      if (handle == NULL) {
        /* Try harder */
        handle = dlopen("libssl.so", RTLD_LAZY);
      }
      if (handle == NULL) {
        /* Try harder */
        handle = dlopen("libssl.so.0", RTLD_LAZY);

Are libssl.so.0.9.8 and libssl.so.9.8b compatible? Can I patch the
source to use libssl.so.9.8b?

Thanks,
Debarshi
-- 
GPG key ID: 63D4A5A7
Key server: pgp.mit.edu

openssl097a package retirement

[Matthias Clasen]

On Mon, 2007-11-12 at 16:14 +0530, Debarshi 'Rishi' Ray wrote:
>  [Continuing from the fedora-maintainers list.]
>  
>  On 22/08/2007, Tomas Mraz <tmraz(a)redhat.com&gt; wrote:
>  > If there will not be any serious objections I'll retire openssl097a
>  > package in rawhide.
>  >
>  > It doesn't make much sense to maintain this old version of openssl in
>  > Fedora.
>  
>  I am packaging httrack, which has the following snippet:
>  
>        /* We are compatible with 0.9.6/7/8 and potentially above */
>        handle = dlopen("libssl.so.0.9.8", RTLD_LAZY);
>        if (handle == NULL) {
>          handle = dlopen("libssl.so.0.9.7", RTLD_LAZY);
>        }
>        if (handle == NULL) {
>          handle = dlopen("libssl.so.0.9.6", RTLD_LAZY);
>        }
>        if (handle == NULL) {
>          /* Try harder */
>          handle = dlopen("libssl.so", RTLD_LAZY);
>        }
>        if (handle == NULL) {
>          /* Try harder */
>          handle = dlopen("libssl.so.0", RTLD_LAZY);
>  
>  Are libssl.so.0.9.8 and libssl.so.9.8b compatible? Can I patch the
>  source to use libssl.so.9.8b? 
Is there any reason not to patch the source to simply link against
libssl instead ?

openssl097a package retirement

[Debarshi Ray]

>  Is there any reason not to patch the source to simply link against
>  libssl instead ? 
If this is not compatible with libssl.so.9.8b, then would that make a
difference?

Cheers,
Debarshi
-- 
GPG key ID: 63D4A5A7
Key server: pgp.mit.edu

openssl097a package retirement

[Rex Dieter]

Matthias Clasen wrote:

>  Is there any reason not to patch the source to simply link against
>  libssl instead ? 
These dlopen hacks are often used for licensing compatibility (e.g. openssl
being gpl-incompatible).

-- Rex

openssl097a package retirement

[Bill Nottingham]

Rex Dieter (rdieter(a)math.unl.edu) said: 
>  > Is there any reason not to patch the source to simply link
> against
>  > libssl instead ?
>  
>  These dlopen hacks are often used for licensing compatibility (e.g. openssl
>  being gpl-incompatible). 
To push any license violations on to the user instead of the distributor?
Cute. Why not just add an exception to your license?

Bill

openssl097a package retirement

[Debarshi Ray]

>  To push any license violations on to the user instead of the
> distributor?
>  Cute. Why not just add an exception to your license? 
I am afraid you got me wrong here. I did not use the term "compatible"
to mean license compatibility. I wanted to know whether an application
which dlopens libssl.so.0.9.8 could safely use libssl.so.0.9.8b
instead, without causing any API/ABI breakage?

Sorry for the misunderstanding.

Thanks,
Debarshi
-- 
GPG key ID: 63D4A5A7
Key server: pgp.mit.edu

openssl097a package retirement

[Bill Nottingham]

Debarshi 'Rishi' Ray (debarshi.ray(a)gmail.com) said: 
>  I am afraid you got me wrong here. I did not use the term
> "compatible"
>  to mean license compatibility. I wanted to know whether an application
>  which dlopens libssl.so.0.9.8 could safely use libssl.so.0.9.8b
>  instead, without causing any API/ABI breakage? 
'Not necessarily'. It's why the soname changes.

Bill

openssl097a package retirement

[Debarshi Ray]

>  'Not necessarily'. It's why the soname changes. 
That is why I asked. :-)

The comments in the HTTrack code say that it should be compatible with
versions later than libssl.so.0.9.8. I have asked HTTrack upstream,
and wanted to know if the openssl packager knew something about what
might have changed or potential trouble spots. I am not familiar with
the openssl code myself.

Cheers,
Debarshi
-- 
GPG key ID: 63D4A5A7
Key server: pgp.mit.edu

openssl097a package retirement

[Tomas Mraz]

On Mon, 2007-11-12 at 23:04 +0530, Debarshi 'Rishi' Ray wrote:
>  > 'Not necessarily'. It's why the soname changes.
>  
>  That is why I asked. :-)
>  
>  The comments in the HTTrack code say that it should be compatible with
>  versions later than libssl.so.0.9.8. I have asked HTTrack upstream,
>  and wanted to know if the openssl packager knew something about what
>  might have changed or potential trouble spots. I am not familiar with
>  the openssl code myself. 
I think that you can safely patch it. But I'm curious why HTTrack
dlopens it and not directly links to it.
-- 
Tomas Mraz
No matter how far down the wrong road you've gone, turn back.
                                              Turkish proverb

openssl097a package retirement

[Rex Dieter]

Tomas Mraz wrote:

>  But I'm curious why HTTrack
>  dlopens it and not directly links to it. 
HTTrack is GPL, and openssl isn't GPL-compatible.

-- Rex

openssl097a package retirement

[Bill Nottingham]

Rex Dieter (rdieter(a)math.unl.edu) said: 
>  Tomas Mraz wrote:
>  
>  > But I'm curious why HTTrack
>  > dlopens it and not directly links to it.
>  
>  HTTrack is GPL, and openssl isn't GPL-compatible. 
Right, but there's nothing that says upstream can't add an exception
for OpenSSL.

Bill

openssl097a package retirement

[Tomas Mraz]

On Tue, 2007-11-13 at 10:34 -0500, Bill Nottingham wrote:
>  Rex Dieter (rdieter(a)math.unl.edu) said: 
>  > Tomas Mraz wrote:
>  > 
>  > > But I'm curious why HTTrack
>  > > dlopens it and not directly links to it.
>  > 
>  > HTTrack is GPL, and openssl isn't GPL-compatible.
>  
>  Right, but there's nothing that says upstream can't add an exception
>  for OpenSSL. 
Or even better they should use NSS library which is LGPL/GPL/MPL
trilicensed. With the help of the nss_compat_ossl library it is really
easy task to convert application which needs just SSL support.

-- 
Tomas Mraz
No matter how far down the wrong road you've gone, turn back.
                                              Turkish proverb

openssl097a package retirement

[Andrew Bartlett]

On Tue, 2007-11-13 at 09:31 -0600, Rex Dieter wrote:
>  Tomas Mraz wrote:
>  
>  > But I'm curious why HTTrack
>  > dlopens it and not directly links to it.
>  
>  HTTrack is GPL, and openssl isn't GPL-compatible. 
This is something that needs to be fixed, regardless of dlopen().  I
don't think you can argue that dlopen() is any different to the actions
of ld-linux.so.2...

Andrew Bartlett

-- 
Andrew Bartlett
http://samba.org/~abartlet/
Authentication Developer, Samba Team           http://samba.org
Samba Developer, Red Hat Inc.

openssl097a package retirement

[Rex Dieter]

Andrew Bartlett wrote:

>  I
>  don't think you can argue that dlopen() is any different to the actions
>  of ld-linux.so.2... 
Many projects *do* argue and believe that.

-- Rex