License

[ppisar]

I'm confused regarding license that covers the Crypt-Rijndael-1.13.

Rijndael.xs states LGPLv2+.
Rijandel.pm stated LGPLv3.
ppport.h comes from perl and requires (GPL+ or Artistic).
COPYING quotes LGPLv3+.

While it's fine that each file has different license, after compiling the code and executing it, the effective license becomes GPLv3. Is that what you intended?

[Leont]

I hadn't realized the ppport issue, that was certainly not the intention. IMO the LGPL is unfortunate in this particular case, but that wasn't my choice. I'm considering replacing the AES implementation inside, which means pretty much a rewrite from scratch of most pieces I haven't rewritten already, that might actually be the cleanest way out eventually (but IANAL).

[ppisar]

On Wed, Sep 23, 2015 at 06:17:29AM -0700, Leon Timmermans wrote:

I hadn't realized the ppport issue, that was certainly not the intention.
IMO the LGPL is an unfortunate choice in this particular case, but that
wasn't my choice. I'm considering replacing the AES implementation inside,
which means pretty much a rewrite from scratch of most pieces I haven't
rewritten already, that might actually be the cleanest way out eventually.

I see. I know there is Crypt-OpenSSL-AES that uses OpenSSL for the
cryptography. If user pretends that OpenSSL is a system wide library, then
it's compatible with GPL. I don't know much about Artistic and OpenSSL
lincense compatibility. Is there reason why to keep Crypt-Rijandel alive?

-- Petr

[Leont]

OpenSSL may not be around on all systems, its license is a bit tricky in its own way, and Crypt-OpenSSL-AES doesn't implement the cryptographic modes (Crypt::CBC and the like add almost an order-of-magnitude in time, because they're implementing a tight loop in Perl).

[autarch]

Another issue is that the META.json file just specified license: open_source, which is obviously wrong.

[kentfredric]

Another issue is that the META.json file just specified license: open_source, which is obviously wrong.

Should be fixable: https://metacpan.org/pod/CPAN::Meta::Spec#license

But its not clear what one does to disambiguate between "LGPL-2.1 only" and "LGPL-2.1+" shrug

[kentfredric]

crypt-rijndael/rijndael.h

Lines 4 to 9 in 3ea315a

	* Currently maintained by brian d foy, <bdfoy@cpan.org>
	*
	* This library is free software; you can redistribute it and/or
	* modify it under the terms of the GNU Lesser General Public
	* License as published by the Free Software Foundation; either
	* version 2 of the License, or (at your option) any later version.

crypt-rijndael/Rijndael.xs

Lines 4 to 9 in 3ea315a

	* Currently maintained by brian d foy, <bdfoy@cpan.org>
	*
	* This library is free software; you can redistribute it and/or
	* modify it under the terms of the GNU Lesser General Public
	* License as published by the Free Software Foundation; either
	* version 2 of the License, or (at your option) any later version.

crypt-rijndael/Rijndael.pm

Lines 132 to 137 in 3ea315a

	=head1 LICENSE
	This software is licensed under the Lesser GNU Public License v3 (29
	June 2007). See the included COPYING file for details.
	=cut

crypt-rijndael/_rijndael.c

Lines 4 to 9 in 3ea315a

	* Currently maintained by brian d foy, <bdfoy@cpan.org>
	*
	* This library is free software; you can redistribute it and/or
	* modify it under the terms of the GNU Lesser General Public
	* License as published by the Free Software Foundation; either
	* version 2 of the License, or (at your option) any later version.

As-is, more files declare LGPL2.1+ than declare LGPL3.