Recent changes to bugs

#21 docsis build depends on lin

2013-06-02T14:02:05.842000Z

Link to my post to debian-legal: http://lists.debian.org/debian-legal/2013/06/msg00001.html

#21 docsis build depends on lin

2013-06-02T14:01:16.364000Z

Yes, but what CRYPTOGRAPHY does docsis use via libsnmp?

IANAL, but as far as I understand, it doesn't needs to use it, just link. The problem here is that there is a library in the middle which is using libopenssl. According to some people this situation will require an OpenSSL exception, according to some others, not.

I have just sent a mail to debian-legal (will post link as soon as I have it) to ask them for their advice on the situation.

I'm sure this is not the only software which got involved in this change, so we will need to see what happens.

#21 docsis build depends on lin

2013-06-02T04:40:35.303000Z

status: open --> pending

#21 docsis build depends on lin

2013-05-31T08:47:09.278000Z

Hi!

Some time ago, I ask the original author, Cornel Ciocirlan, for change the license to the gpl with the openssl exception, and he answer ok to the change, but he forgot to change the license... and after that it was impossible to me to contact with him to confirm the license change...

So I only have a "verbal" approval :(

By the way, docsis don't use ssl encription, but use libsnmp that is linked with openssl for implement snmp v3 protocol... that docsis don't use...

#21 docsis build depends on lin

2013-05-31T06:01:52.622000Z

Yes, but what CRYPTOGRAPHY does docsis use via libsnmp?

#21 docsis build depends on lin

2013-05-31T01:17:27.094000Z

Is docsis one of those applications?

yes, it links to libsnmp which in turn links to libopenssl

what about providing a second binary of libsnmp that does not
have the SSL functionality?

It will not happen :(

#21 docsis build depends on lin

2013-05-31T00:32:15.742000Z

Is docsis one of those applications? I can't think of how it would be, but I'm not an expert, I'm really just slightly maintaining a more-or-less abandoned package. If not, what about providing a second binary of libsnmp that does not have the SSL functionality?

#21 docsis build depends on lin

2013-05-31T00:25:35.701000Z

The last version of libsnmp has added a direct link to -lcrypto, triggering the error in lintian (the app that does static analysis of Debian packages).

But libsnmp had already depended on libssl :-/

Yes, there are applications that depend on this behaviour. No, I really doubt we will see a libsnmp without OpenSSL or linked against GNUTLS :-(

#21 docsis build depends on lin

2013-05-31T00:09:28.571000Z

Why does libsnmp link to OpenSSL? Are there applications in Debian which depend on that behavior? If not, obviously eliminating that linkage entirely is the simplest answer. Assuming there are users of it, would it be possible to have the libsnmp source package be compiled a second time without that linkage to create a libsnmp-nossl binary package which docsis could use.

If so, isn't this academic? If docsis could be compiled against a libsnmp that doesn't use OpenSSL and work perfectly fine, then how do we have a problem?

Alternatively, could libsnmp link against GnuTLS? I think it has some level of OpenSSL source-compatbility (e.g. a porting layer).

#21 docsis build depends on lin

2013-05-28T16:18:06.919000Z

By the way, this change is needed to keep docsis in Debian :-/