GNOME Bugzilla – Bug 437212
gnome-db-entry-password uses openssl to generate md5 hash
Last modified: 2007-05-17 10:22:23 UTC
The gnome-db-entry-password uses the openssl crypto library to generate the md5 hash of the password. Unfortunately, openssl's license isn't compatible with the GPL; so any GPL application linked against libgnomedb might have to add an openssl exemption clause to its license (not sure if it would be needed due only to an indirect link, but it would certainly be needed if the application ends directly linked against openssl). I'm attaching a patch (untested) to use the LGPLed libgcrypt instead.
Created attachment 87894 [details] [review] Untested patch to use libgcrypt insteado of openssl
What about when the crypto library is not installed, should we compile against openssl (which does not seem to be a good solution because of the license problem), or should we just disable building the gnome-db-entry-password plugin?
IMHO, libgcrypt is lightweight enough to be considered an obligatory dependency. (ie, fail the configure if it isn't available). Another option would be to disable the md5 stuff and just return a null gvalue.
Correction committed to SVN, the plugin is now built only if the libgcrypt library is present. If you think it's OK, I'll close the bug.
That's great for me; feel free to close the bug. Thanks for the great work.
Thanks!