On 11/21/2013 05:02 PM, David Woodhouse wrote:
On Wed, 2013-11-20 at 15:48 -0500, Tom Callaway wrote:
> For OpenSSL, we consider that a system library, so the point is somewhat
> irrelevant in that case.
Of course, we should not let that dissuade people from porting to GnuTLS
and rendering the question irrelevant for that reason instead :)
That's actually not true—you still need to invoke the system library
exception for GPLv2-only programs because one of the dependencies, GMP,
is LGPLv3+ in its current versions. Attempts to dual-license it under
LPGLv3+ and GPLv2, like GNUTLS itself, have failed so far.
--
Florian Weimer / Red Hat Product Security Team