Since headers provided by OASIS PKCS11 are not-exactly free license (they do not allow modification), You can use an alternative header like p11-kit which is licensed under a more liberal license. Regards, Alvin Chen
I had a look at the PKCS #11 headers; the biggest problem is that NSS uses version 3.00 while the p11-kit headers have been forked at 2.40 and not (yet?) updated, so a few structs and #defines are missing. There's also a minor issue with CK_GCM_PARAMS, which used to have the wrong layout due to a documentation/header mismatch. NSS has two candidates of that struct, CK_GCM_PARAMS_V3 and CK_NSS_PARAMS, and selects one of those in pkcs11n.h depending on the NSS_PKCS11_2_0_COMPAT macro. I might be looking into this a bit more and see if I can fix the p11-kit headers, if the Mozilla team agrees that this is a viable way to resolve this bug. Cheers Timo
Upstream had a discussion about the license at https://phabricator.services.mozilla.com/D63241 and with OASIS at https://markmail.org/thread/4juvugfvj45iyrmp
On Tue, 23 Mar 2021 00:18:08 +0100 Bastian Germann wrote:> Upstream had a discussion about the license at As far as I can see, the license for NSS's PKCS#11 headers is MPL 2.0 (DFSG-free) and not the OASIS IPR.
Well, I can see from the discussion you linked that the OASIS IPR license is intended to apply to their work products, and not the shared code. And they do have separate rules for their open repositories, which default to BSD-3-Clause license unless stated otherwise [1]. However, the PKCS#11 repository [2] is not in the linked "oasis-open" namespace on Github, there is an explicit reference to the IPR license in that repository. As for the MPL 2.0 license, the Mozilla upstream added that to their version of the headers after stating that bug 1618918 had clarified the situation, but I can't seem to access that bug [3]. Cheers Timo [1] https://www.oasis-open.org/open-repositories/#licensingRules [2] https://github.com/oasis-tcs/pkcs11 [3] https://bugzilla.mozilla.org/show_bug.cgi?id=1618918
Control: severity -1 normal The nss PKCS#11 files have a different provenance from the OASIS ones. If Mozilla decides to license them as MPL 2.0, that is their choice. They have a legal department who was involved and decided they go this way. The point is, the license of the files is not the OASIS one as suggested by the bug submitter, so the bug is invalid. I do not think the license was OASIS in any of the public NSS releases, even though it might have been in some patch submission.