Project Maintenance

[fortanix]

Project Maintenance

[jethrogb]

I hope to have a (hopefully) satisfactory answer for all of you by the end of the week.

[jethrogb]

I will be publishing an updated version of this repo at https://github.com/fortanix licensed Apache 2.0/GPL 2.0, hopefully this week.

[jethrogb]

https://docs.rs/mbedtls/0.2.0/mbedtls/
https://docs.rs/mbedtls-sys-auto/2.12.0/mbedtls_sys/

[ekse]

Hi Jethro,

Could you provide a status update on this? I'm investigating using mbedtls at work, I would be glad to contribute to this project. An Apache/MIT compatible license is a hard requirement for us.

In the event that releasing the new code is possible not in the near future, I would suggest updating the license for the current version to Apache 2.0/GPL 2.0+. This way I could use it as the baseline for my work and we could integrate the changes once the new version is available.

Thanks!

Sébastien

[awakecoding]

@jethrogb I work with @ekse at Devolutions, and just like @spacekookie we are migrating from C to Rust and mbedTLS is one of our critical components. We are currently in the process of evaluating the required work to make mbedTLS a first-class citizen in the Rust ecosystem. I understand that you have some changes that would need to be pushed upstream, but that you don't know when you will get the time to do it. I totally understand that, as we maintain our own fork of mbedTLS with a bunch of useful patches I will soon find the time to properly submit back to the original project :) However, one thing that wouldn't take too much of your time would be to update the license on the project, because we can't start our own work on top of a GPL-licensed crate due to licensing requirements on our side. Since mbedTLS is dual-licensed under Apache 2.0/GPL v2.0, I suggest that we simply do the same. We wish to get started quickly on this, so the sooner the better. We'd be very grateful :)

[jethrogb]

Thanks for your interest!

This project is still being actively maintained internally in my company, Fortanix. We've made quite a few changes from this public version. We'll likely push those changes at some point (and then keep it updated), but the timeline for that is not clear right now (could be months). Considering your interest I can try to push to make it happen sooner rather than later, but I can't make any promises.

Considering that, PRs along the lines you mentioned are more than welcome. However, I'd be hesitant to accept large code contributions at this time, due to the difficulty of integrating that with our internal fork in the future.

When we do publish our latest version, it'll probably be based Apache-licensed, not GPL. I'd request that you explicitly dual-license your contributions Apache 2.0/GPL 2.0+.

[spacekookie]

Oh that is great to hear! I'm a core contributer to qaul.net (https://github.com/qaul/qaul.net) which uses mbedtls for cryptographic signature verification and is currently written in C. Over the next year we're planning on porting the entire thing over to Rust and I've started looking for all the pieces that we need to make the port.

Considering that we'll still be busy for at least 5 months with other components, it's not urgent, but it would be great to have your fork version released soon-ish 😁

Also, Apache 2.0/GPL 2.0+ is fine, I'll keep that in mind. Currently playing around with bumping bindgen to newest version and dealing with all the changes they did since then.