On Wed, 22 Jan 2014, Dushyant Chaudhary -X (duchaudh - ARICENT TECHNOLOGIES MAURIITIUS LIMITED at Cisco) wrote:

> Hi Alias,
>
> We have done some code changes related to NTLMv2 in libCURL code.

Lovely and good to see! Are you from the same team or independent from Prash
Dush? He just posted a first NTLMv2 patch set yesterday to the curl-library
list: http://curl.haxx.se/mail/lib-2014-01/0183.html

In general, that's the suitable list for discussing details and development of
this. I'm CC'ing my respone there since I'll talk a lot of dev stuff here.
Please consider taking follow-ups on curl-library.

> Steve Holme has replied over the same that it would take around 2 months for
> the next curl release( including 1 month for code review and 1 month for bug
> fixes etc)

In general we do releases every 2 months in a never-ending cycle:

  A - one month window allows new features and "changes"
  B - one monhs without featues only focusing on fixing bugs
  C - release

Repeat.

So, barring problems any change provided should be possible to get included in
a release within 2 months.

> We will send the code to you people(CURL Team ) for review.

Again, plese do that on the curl-library list. There are 1000+ developers
there...

> 1)We have our release coming very soon(within a month ) and we want to
> provide NTLMv2 support in our product using libCURL. Would it be possible
> that we start using those changes in CURL CODE at our end now before CURL
> official release? I want to know if there is any legal concern or not?

It is completely up to you. It is perfectly legal, it is fine both by the
license and by us in general.

I would say that there are just a few drawbacks, like:

- reviewers here may find and detect major flaws you otherwise ship

- we may not agree to how things are made so that they get changed a bit
before they go into the official repository, which may risk your early version
and the later public version to not be 100% compatible API/ABI wise.

> 2)Once Code review from CURL team and all the processes would be complete
> ,we would use the latest release of libCURL in our product. Is this feasible
> from legal points of view?

It is!

-- 
  / daniel.haxx.se
-------------------------------------------------------------------
List admin: http://cool.haxx.se/list/listinfo/curl-library
Etiquette:  http://curl.haxx.se/mail/etiquette.html