tcl-trf included non-free codes.

Add Reference URI:

http://homes.esat.kuleuven.be/~bosselae/ripemd160.html

Reported upstream (debian).

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=751879

You are referring to generic/ripemd/rmd*.c, i believe (you should have made that clear) There's also generic/rmd*.c, which are libre. Now what I don't understand is why there are 2 different implementations of ripemd.

EDIT: The generic/rmd*.c seem to just be wrappers around the nonfree code. So either we should replace the nonfree code (I like that idea) or remove it like Fedora did. I could write an MIT/X11 licensed implementation if I have the time that is compatible with this nonfree one.

I started working on my free implementation of ripemd-160.
EDIT: I finished and will upload it later. It's a little faster than the nonfree implementation.

Here it is, both RIPEMD-128 and RIPEMD-160. Learned some stuff about hashing along the way.
EDIT: Strange that it didn't attach. I replied to the Debian bug and attached it.

Love the idea if something proprietary just got replaced with something free! Thanks alot Legimet! Unfortunately I'm not qualified to say if you did a good job.

Changing status to reflect there is a patch. Dunno if I got it right.

I can't seem to be able to open that attachment, clicking it takes me to what looks like trisquel.info frontpage, albeit with a funny URL https://trisquel.info/files/issues/

The attachment system of this website has some issues. I attached it to a new message in that Debian bug.
RIPEMD-128 and 160 are publicly available algorithms, and a description is there on that page which mejiko linked to. (I wonder if the authors really intended to make it nonfree) So, there are many free implementations of it, and the package maintainer was going to use one fom OpenSSL. Other implementations would have required some porting to make them compatible with this one, so I just decided to make my own. It was pretty simple to implement, and I learned some stuff along the way.

There is another issue with this package which was resolved in Debian. [0] The source package has a copy of msvcrt.dll, a nonfree library from Windows. This should be removed.

[0] https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=685207

Also, I think we should make it "patch (needs work)" because it hasn't been fixed upstream yet, and someone will need to write a package helper.

Fixed upstream in Debian, and package helper submitted to trisquel-devel. The helper just imports from Debian.

Legimet, what license are you using? It looks like the Expat license, but a bit different. The part which I am concerned about is this: "Permission is hereby granted, without written agreement and without license or royalty fees, to use, copy, modify, and distribute this software and its documentation for any purpose..."

It doesn't seem to say you can distribute modified copies, but correct me if I'm mistaken.

Usually I prefer GPL, but in this case tcl-trf itself was permissively licensed, so I decided to use its own license. I don't think the Expat license explicitly says you can distribute modified copies either, but it is generally interpreted as allowing it. (One notable exception is Pine, an old email client, because the University of Washington interpreted it as allowing modification but not distribution of those modified copies. [0]) However, the Expat license is almost always considered free, and this is pretty much the same thing.

Also, I changed the package helper to import from Ubuntu Utopic instead of Debian unstable.

[0] http://people.debian.org/~bap/dfsg-faq.html

This issue was fixed a few months ago: https://devel.trisquel.info/trisquel/package-helpers/merge_requests/47 and https://devel.trisquel.info/trisquel/package-helpers/merge_requests/51.

Automatically closed -- issue fixed for 2 weeks with no activity.