OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
Re: [NEW] security/matrixssl

From: Stuart Henderson (stuspacehopper.org)
Date: Sat Sep 04 2010 - 10:20:55 CDT


On 2010/09/04 14:37, Remi Pointel wrote:
> Hello,
>
> I have ported matrixssl, an embedded SSL and TLS implementation
> designed for small footprint applications.

I think this is a nice thing to have in ports.

> The license is printed after installation of this software to
> specify dual-license.

No need to do that, we just choose GPL. Maybe worth saying
something like this in Makefile but I think that's all that is
needed really.

# GPLv2+ (commercial license also available)

but we definitely don't want the MESSAGE spam, and so we can also
lose files/LICENSE (which is prone to going out of date...)

You have this,

DISTNAME = matrixssl-3-1-3-open
PKGNAME = ${DISTNAME:S/-3-1-3-open/-3.1.3/}

this would be more sane:

VER = 3.1.3
DISTNAME = matrixssl-${VER:S/./-/g}-open
PKGNAME = matrixssl-${VER}

Also, the shared library is not built correctly, it should
have versioning information (and be registered in a SHARED_LIBS
line).

> Description:
> MatrixSSL is an embedded SSL and TLS implementation designed for small footprint applications and devices.

linewrap please.

> The software is fully downloadable under a dual licensing model; GNU
> Public License and a Standard Commercial license. Basically, the dual
> license means that you can use the library for free as long as you make
> public all code that links with it or otherwise uses the library.

That is not what the GPL means.

If you _distribute_ (including by way of sale) code that uses the
library, then you have to make your code available on request, but only
_to the people you have distributed that code to_. (Many people just
put a copy of the GPL'd code on a public http/ftp server for anyone to
download, but this is _not_ required by the license).

At that point, people who have a copy can then do what they like with
within the confines of the GPL, including making it available freely,
it is up to them whether or not they do that.