4

The OpenSSL double license is available at: https://www.openssl.org/source/license.txt

I am not a lawyer and I am not sure whether I am more confused by the license agreement than I am scared of it.

I am working on a game that will encrypt and decrypt its local save files using OpenSSL. That's it.


The first license states:

  1. "Redistributions of any form whatsoever must retain the following acknowledgment: "This product includes software developed by the OpenSSL Project for use in the OpenSSL Toolkit (http://www.openssl.org/)"

Does that mean I need to add some credits screen to my game, which shows the following acknowledgement?


The second license further states that:

If this package is used in a product, Eric Young should be given attribution as the author of the parts of the library used. This can be in the form of a textual message at program startup or in documentation (online or textual) provided with the package.


In order to comply with the double license, do I need to give two acknowledgements in my app to OpenSSL and to Eric Young? Is there something else that I am missing and/or am I understanding the license correctly if I want to use OpenSSL in my game?

2
  • 1
    Note that the license is going to change to the Apache License v2 for OpenSSL 3.0. (See, e.g., here.) – user2357112 supports Monica Apr 15 at 22:10
  • @user2357112supportsMonica I noticed that, too. Yet it's still announced as alpha-grade. So especially in respect of security-critical components like SSL, I'd not plan with that until it is released as stable. Thus I removed that information from my answer again before I hit 'send' – planetmaker Apr 16 at 12:53
6

If a software is distributed under several different licenses, then you are usually allowed to choose which license offer you take up; you then have to abide by all the terms and conditions of the license - but not necessarily by all of the other license offer you did not take. This is common for dual-licensed software where one form is a copyleft licensed (e.g. GPL) and the other is a commercial license which have wildly different requirements on the licensee.

However, this particular case is different: the license file states that the source is governed by both licenses concurrently. Thus you have to abide by both and fulfill both conditions.

The license requires to show the copyright, the conditions and the attributions in both binary and source distributions. So in essence you have to display the whole license text or at least make it available on a separate page accessible by a link in a summary copyright overview for the different parts for your game.

That means for your first question of displaying the attribution: yes, it means exactly that: you have to give credits to OpenSSL in the form they require, thus basically have in the credits or about section of your game acknowledge the contributions from OpenSSL by including the (nearly) full license statement verbatim as required by the license.

 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in
 *    the documentation and/or other materials provided with the
 *    distribution.

Thus I'd probably do that 2-stage, one in the overview which reads like

Copyright (c) 1998-2019 The OpenSSL Project.  All rights reserved.
This product includes software developed by the OpenSSL Project
for use in the OpenSSL Toolkit (http://www.openssl.org/)

This product includes cryptographic software written by Eric Young
(eay@cryptsoft.com).  This product includes software written by Tim
Hudson (tjh@cryptsoft.com).

OpenSSL license (opens on separate page)

And this short copyright notice I would link to the full license text of the OpenSSL source you use to build your game.

You have to show the copyright notice in the same place in a similar fashion you display your own authorship and other credits.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.