Re: [Pan-devel] OpenSSL and the GPL: License problems

[Duncan]

Heinrich Mueller posted on Sat, 24 Dec 2011 08:22:46 +0100 as excerpted:

> I don't see any tags in the git branch [of gnutls] leading to 2.10.5.

Was that before their conversion to git, or are there older version tags 
in the gnutls git tree?

But yes, he and I are both on gentoo, which compiles from sources, so a 
link to at least the tarball shouldn't be difficult to come up with as 
he's referring to the current gentoo versions.  Let me look...

Here's the list of the gnutls versions gentoo offers, if you're 
interested...

$ equery list -op gnutls
 * Searching for gnutls ...

[IP-] [  ] net-libs/gnutls-2.10.5:0

[-P-] [M ] net-libs/gnutls-2.12.14:0

[-P-] [M ] net-libs/gnutls-3.0.8:0

[-P-] [M ] net-libs/gnutls-3.0.9:0

In the first set of brackets, I indicates installed, P indicates the main 
portage tree, and O would indicate an overlay tree.  In the second set, M 
indicates hard-masked (masked as it's known to have problems or is 
seriously lacking testing, but available for admins who wish to risk 
unmasking for testing or because they depend on a hard-masked-for-
security version or whatever), ~ indicates testing branch for the arch 
portage is configured for.  The -op in the command tell it to include 
both overlays and main portage tree in addition to (the default) 
installed.  The :0 after the version name indicates the slot, used when 
packages can be installed in parallel.  Since they're all slot-0, gnutls 
is unslotted and installing one version implies uninstalling others. (I 
double-spaced to keep pan from wrapping if you have wrap turned on.)

So I have gnutls-2.10.5 installed.  It's marked stable for my arch 
(amd64), and exists (as do all reported versions) in the main portage 
tree.  (If there are overlays with gnutls, I don't have them 
configured.)  Since all versions are slot-0, that means I can only have 
one installed at a time.  All other versions are hard-masked.

To see why they are masked, I can either grep the maskfile or emerge
--pretend specific versions.  Here's the relevent entry from the grep, 
with the reason (double-spaced again):

grep -B4 gnutls /p/profiles/package.mask 

# Tomáš Chvátal <address@hidden> (18 Sep 2011)

# Mask latest revisions using dev-libs/nettle and app-crypt/p11-kit

# Needs tinderbox testing.

>=net-libs/gnutls-2.12

That's why the newer versions are masked as 2.12 and newer apparently 
needs nettle and p11-kit.

As for the sources, the ebuild has a bash-scripted conditional with a 
bunch of gentoo-specific package variables, etc, so I'll just translate 
it into the URL:

ftp://gnu.org/pub/gnu/gnutls/gnutls-2.10.5.tar.bz2

Actually checking there, there's also a corresponding gpg verification 
file:

ftp://gnu.org/pub/gnu/gnutls/gnutls-2.10.5.tar.bz2.sig

(There's also MS executables, presumably self-extracting archives, and 
zip files for the MS users.)

-- 
Duncan - List replies preferred.   No HTML msgs.
"Every nonfree program has a lord, a master --
and if you use the program, he is your master."  Richard Stallman