Please relicence everest under a dual Apache-2.0 OR GPL-2.0-or-later license #405

New issue

Open

opened 2025-08-03 08:24:32 -05:00 by Tachi107 · 2 comments

Tachi107 commented

2025-08-03 08:24:32 -05:00

(Migrated from github.com)

Suggested enhancement

Hi! It'd be great if the everest files could be relicensed to have the same license as the rest of TF-PSA-Crypto and MbedTLS. I don't know how doable this actually is though.

Justification

Having everest available only under the Apache-2.0 is problematic for the Debian mbedtls package, since we need to redistribute it under the dual license. Please see https://github.com/Mbed-TLS/mbedtls/pull/8284#issuecomment-2030088495 for more context

Impact

Without relicensing, Debian will have to ship a TF-PSA-Crypto with everest disabled

### Suggested enhancement Hi! It'd be great if the everest files could be relicensed to have the same license as the rest of TF-PSA-Crypto and MbedTLS. I don't know how doable this actually is though. ### Justification Having everest available only under the Apache-2.0 is problematic for the Debian mbedtls package, since we need to redistribute it under the dual license. Please see <https://github.com/Mbed-TLS/mbedtls/pull/8284#issuecomment-2030088495> for more context ### Impact Without relicensing, Debian will have to ship a TF-PSA-Crypto with everest disabled

gilles-peskine-arm commented

2025-08-04 06:06:12 -05:00

(Migrated from github.com)

Since last year, we checked internally. I can't find the email right now but I think I remember the answer was no — we don't have permission to release Everest under GPL.

In the long term, I think we'll move Everest out of TF-PSA-Crypto and into a repository of third-party drivers. I don't think we're ready for that yet. But maybe we could split Everest into a submodule of its own. Then git clone TF-PSA-Crypto; git submodule init framework would give you a tree that can be distributed under GPL or Apache, while git clone --recurse-submodules TF-PSA-Crypto would be Apache-only. I'm going to try this out.

Since last year, we checked internally. I can't find the email right now but I think I remember the answer was no — we don't have permission to release Everest under GPL. In the long term, I think we'll move Everest out of TF-PSA-Crypto and into a repository of third-party drivers. I don't think we're ready for that yet. But maybe we could split Everest into a submodule of its own. Then `git clone TF-PSA-Crypto; git submodule init framework` would give you a tree that can be distributed under GPL or Apache, while `git clone --recurse-submodules TF-PSA-Crypto` would be Apache-only. I'm going to try this out.

Tachi107 commented

2025-08-04 06:51:15 -05:00

(Migrated from github.com)

On Mon Aug 4, 2025 at 1:06 PM CEST, Gilles Peskine wrote:

Since last year, we checked internally. I can't find the email right
now but I think I remember the answer was no — we don't have
permission to release Everest under GPL.

What a shame! Thanks for checking though.

In the long term, I think we'll move Everest out of TF-PSA-Crypto and
into a repository of third-party drivers. I don't think we're ready
for that yet. But maybe we could split Everest into a submodule of its
own. Then git clone TF-PSA-Crypto; git submodule init framework
would give you a tree that can be distributed under GPL or Apache,
while git clone --recurse-submodules TF-PSA-Crypto would be
Apache-only. I'm going to try this out.

While I'm a bit sad we can only ship the suboptimal built-in driver for
license compatibility issues, this would still be very appreciated. Feel
free to retitle this issue to reflect this goal.

Thanks again :)

On Mon Aug 4, 2025 at 1:06 PM CEST, Gilles Peskine wrote: > Since last year, we checked internally. I can't find the email right > now but I think I remember the answer was no — we don't have > permission to release Everest under GPL. What a shame! Thanks for checking though. > In the long term, I think we'll move Everest out of TF-PSA-Crypto and > into a repository of third-party drivers. I don't think we're ready > for that yet. But maybe we could split Everest into a submodule of its > own. Then `git clone TF-PSA-Crypto; git submodule init framework` > would give you a tree that can be distributed under GPL or Apache, > while `git clone --recurse-submodules TF-PSA-Crypto` would be > Apache-only. I'm going to try this out. While I'm a bit sad we can only ship the suboptimal built-in driver for license compatibility issues, this would still be very appreciated. Feel free to retitle this issue to reflect this goal. Thanks again :)

No milestone

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

gh-Mbed-TLS/TF-PSA-Crypto#405

No description provided.

Rows
Columns