md5 license problems

md5 license problems

[Lars Magne Ingebrigtsen]

pop3.el uses md5.el, and I've included both in the Red Gnus
distribution.  However, md5 can never be included in Emacs:

--------------------
;; The original copyright notice is given below, as required by the
;; licence for the original code.  This code is distributed under *both*
;; RSA's original licence and the GNU General Public Licence.  (There
;; should be no problems, as the former is more liberal than the
;; latter).
--------------------

Which is wrong:

;;; Original copyright notice: ------------------------------------------------

;; Copyright (C) 1990, RSA Data Security, Inc. All rights reserved.
;;
;; License to copy and use this software is granted provided that it is
;; identified as the "RSA Data Security, Inc. MD5 Message- Digest
;; Algorithm" in all material mentioning or referencing this software or
;; this function.
;;
;; License is also granted to make and use derivative works provided
;; that such works are identified as "derived from the RSA Data
;; Security, Inc. MD5 Message-Digest Algorithm" in all material
;; mentioning or referencing the derived work.
;;
;; RSA Data Security, Inc. makes no representations concerning either
;; the merchantability of this software or the suitability of this
;; software for any particular purpose.  It is provided "as is" without
;; express or implied warranty of any kind.
;;
;; These notices must be retained in any copies of any part of this
;; documentation and/or software.

There are three restrictions that are in conflict with the GPL: The
requirement that it should be identified in a certain way; the
requirement that derived works should be indentified in a certain way;
and the requirement that the notices must be retained.  The GPL
forbids any restrictions not included in the GPL itself, so we have a
license conflict here.

I'm sure RSA meant to be as nice as possible, but with the RSA license
as it stands, md5.el can't be included in Emacs.  (It would make Emacs
un-free.)

-- 
  "Yes.  The journey through the human heart 
     would have to wait until some other time."

Re: md5 license problems

[William Perry]

Lars Magne Ingebrigtsen writes:
>pop3.el uses md5.el, and I've included both in the Red Gnus
>distribution.  However, md5 can never be included in Emacs:
[...]
>
>There are three restrictions that are in conflict with the GPL: The
>requirement that it should be identified in a certain way; the requirement
>that derived works should be indentified in a certain way; and the
>requirement that the notices must be retained.  The GPL forbids any
>restrictions not included in the GPL itself, so we have a license conflict
>here.
>
>I'm sure RSA meant to be as nice as possible, but with the RSA license as
>it stands, md5.el can't be included in Emacs.  (It would make Emacs
>un-free.)

  Well, there is the ability to just rip out the md5 lisp code, and rely on
'md5' being an external program.  Then point people at either the md5 rfc
for sample code, or the elisp archive or w3 for the md5 lisp code.

-Bill P.

Re: md5 license problems

[Lars Magne Ingebrigtsen]

William Perry <wmperry@aventail.com> writes:

>   Well, there is the ability to just rip out the md5 lisp code, and rely on
> 'md5' being an external program.  Then point people at either the md5 rfc
> for sample code, or the elisp archive or w3 for the md5 lisp code.

Yes, that would be a possibility.  Richard, do you want to do that?
You could just include the external-md5 thingies from md5.el in
pop3.el or something?

-- 
(domestic pets only, the antidote for overdose, milk.)
  larsi@ifi.uio.no * Lars Ingebrigtsen

Re: md5 license problems

[Richard Pieri]

-----BEGIN PGP SIGNED MESSAGE-----

>>>>> "LMI" == Lars Magne Ingebrigtsen <larsi@ifi.uio.no> writes:

LMI> Yes, that would be a possibility.  Richard, do you want to do that?
LMI> You could just include the external-md5 thingies from md5.el in
LMI> pop3.el or something?

I think you and William are talking about two different things, here.
Based on the RSA licence, regardless of the form it takes, any
implementation of MD5 based on the RSA C source or derivatives of it
must have the notice that it is derived from RSA code.  So pop3.el would
need to carry the RSA licence, which defeats the purpose.

What William is suggesting is to simply remove md5.el from the
distribution (which is not too much of a problem, since the only thing
that uses it is APOP) and leave a pointer in the documentation as to
where md5.el can be retrieved.

-----BEGIN PGP SIGNATURE-----
Version: 2.6.3
Charset: noconv

iQCVAwUBMiw6fZ6VRH7BJMxHAQFJcgQAh3AkPKYK3wwfhYcqWKm1M3OsrpPwvRzW
szmy6iZeYAQQ6idFMUfxxoGF1SmtTy81bzNbvGs6jX8rGIwrLdq3Dr5lzz5lq8Du
fiX4xNuq9osuj1lEY1vrxTbJptV8nK9hk7/VPT7VY9SBQ5wFP7dEXosqTWJlnFUK
p81Ask/3u5g=
=sVaR
-----END PGP SIGNATURE-----
-- 
Richard Pieri/Information Services \ Curiosity never killed anything, except
<ratinox@unilab.dfci.harvard.edu>   \ maybe a few hours. -A cat's guide to life
http://www.dfci.harvard.edu/         \ 

Re: md5 license problems

[Jim Meyering]

There's a free (and probably fastest) implementation of MD5 written
by Ulrich Drepper in the GNU textutils-1.19 distribution: lib/md5.[ch].

Re: md5 license problems

[Mark Eichin]

There are *other* implementations of md5 that are not derived from the
RSA code, and thus do not need to carry the license.  Thus, a GPL'ed
one should be possible.

Re: md5 license problems

[Lars Magne Ingebrigtsen]

Richard Pieri <ratinox@unilab.dfci.harvard.edu> writes:

> I think you and William are talking about two different things, here.
> Based on the RSA licence, regardless of the form it takes, any
> implementation of MD5 based on the RSA C source or derivatives of it
> must have the notice that it is derived from RSA code.  So pop3.el would
> need to carry the RSA licence, which defeats the purpose.

No -- pop3 could have hooks to run the text through an *external*
(non-lisp) md5 process.  That would bypass the RSA licence.

-- 
(domestic pets only, the antidote for overdose, milk.)
  larsi@ifi.uio.no * Lars Ingebrigtsen

Re: md5 license problems

[Richard Pieri]

-----BEGIN PGP SIGNED MESSAGE-----

>>>>> "LMI" == Lars Magne Ingebrigtsen <larsi@ifi.uio.no> writes:

LMI> No -- pop3 could have hooks to run the text through an *external*
LMI> (non-lisp) md5 process.  That would bypass the RSA licence.

But requires installing the md5 program.  Might as well just put a
pointer to md5.el in whatever archives it exists in.

-----BEGIN PGP SIGNATURE-----
Version: 2.6.3
Charset: noconv

iQCVAwUBMi2JC56VRH7BJMxHAQELowQAmY033GxQjal+X21Q31Akha8P4KwJOB4k
GjI5ftDAvX2Aob0pJPgfyYtYf6QublmVZE7d7WALAnaX05cqccMRp46qvmfUV+39
KSk6hhAJil4wSyKZiBzg2y9DMAWoWZbSRPrj58tHBlci/ObS5hU8vBXYq4GnY5BH
eyolmjOdYLA=
=IFXJ
-----END PGP SIGNATURE-----
-- 
Richard Pieri/Information Services \ If you're not receiving enough attention,
<ratinox@unilab.dfci.harvard.edu>   \ try knocking over some very expensive
http://www.dfci.harvard.edu/         \ antique lamps. -A cat's guide to life

Re: md5 license problems

[Richard Pieri]

-----BEGIN PGP SIGNED MESSAGE-----

>>>>> "JM" == Jim Meyering <meyering@asic.sc.ti.com> writes:

JM> There's a free (and probably fastest) implementation of MD5 written
JM> by Ulrich Drepper in the GNU textutils-1.19 distribution: lib/md5.[ch].

"Faster" is relative.  pop3.el only needs to generate a hash for a very
short string, an RFC 822-style date and a 'password'.  Regardless of how
fast an external C program is, I think that generating the hash via
'native' lisp code is faster than forking off an inferior process.
Besides, I do not have an md5sum program on my Win95 box, which is where
I have been doing my recent development work, so that is another factor;
I need to generate the hash internally.

It is looking a lot like I am going to have to go back to RFC 1321 and
implement from scratch.  Converting C code to Emacs-Lisp is not
something I want to contemplate.  Unless someone else wants to do it?

-----BEGIN PGP SIGNATURE-----
Version: 2.6.3
Charset: noconv

iQCVAwUBMi2N256VRH7BJMxHAQGSOgP/caHSSL/7hcLtpxMmp3zZudIC/jn+QoOS
PZn5/YgEWA3vCGSJCUIdYYSDbaB1ZeJPyUNNHBjZYgBQtZtFWdaJWu4Rc5h7rNUn
By98JFXAxJCaczOP2wdt1Buh6jKLCo+XtMUpSfrqUgGmytbqdE5EtfLfFh4Aqppq
YhscqjnGLIA=
=P1ds
-----END PGP SIGNATURE-----
-- 
Richard Pieri/Information Services \ If you're not receiving enough attention,
<ratinox@unilab.dfci.harvard.edu>   \ try knocking over some very expensive
http://www.dfci.harvard.edu/         \ antique lamps. -A cat's guide to life

Re: md5 license problems

[William Perry]

Lars Magne Ingebrigtsen wrote:
> 
> Richard Pieri <ratinox@unilab.dfci.harvard.edu> writes:
> 
> > I think you and William are talking about two different things, here.
> > Based on the RSA licence, regardless of the form it takes, any
> > implementation of MD5 based on the RSA C source or derivatives of it
> > must have the notice that it is derived from RSA code.  So pop3.el would
> > need to carry the RSA licence, which defeats the purpose.
> 
> No -- pop3 could have hooks to run the text through an *external*
> (non-lisp) md5 process.  That would bypass the RSA licence.

  Correct, which is exactly what the md5.el program in older versions of
Emacs-W3 did, before I merged in the code to do md5 internally.  Perhaps
someone would like to volunteer to convert the md5 code from textutils
into lisp, so we won't have this problem?

-Bill P.

Re: md5 license problems

[Richard Pieri]

-----BEGIN PGP SIGNED MESSAGE-----

>>>>> "WP" == William Perry <wmperry@aventail.com> writes:

WP> Perhaps someone would like to volunteer to convert the md5 code from
WP> textutils into lisp, so we won't have this problem?

This is my current project, but more to build the lisp from the RFC
rather than any existing reference implementation.  Like I said,
converting C code to lisp is not something I care to try.  The only
problem is that I have seen code derived from the reference
implementation, and that makes me "dirty" as far as a court is
concerned.

-----BEGIN PGP SIGNATURE-----
Version: 2.6.3
Charset: noconv

iQCVAwUBMi4ShJ6VRH7BJMxHAQGaVwQAwaSsuZREpL3neoxlJlhM7mSUq/VDvtL/
2dfViS5r/RPSMCu+hafCbKzQjl3MTunoym3RtuvWXFyabTv3KOIS7l0Zg4XpfBF6
6N9ymJqualrch3j9AqZTu0nbMmkeNzL7EYG98GyODDMJfwxRFyzUfoRqXoc28aeV
DcQCYhWagWs=
=VvnO
-----END PGP SIGNATURE-----
-- 
Richard Pieri/Information Services \ If you're not receiving enough attention,
<ratinox@unilab.dfci.harvard.edu>   \ try knocking over some very expensive
http://www.dfci.harvard.edu/         \ antique lamps. -A cat's guide to life