[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: Cryptographic software in main archive



On Mon, Mar 25, 2002 at 11:53:56AM -0800, Walter Landry wrote:

> > > Sorry, this isn't precisely accurate on the OpenBSD folks part. The GPL
> > > allows you to use this exception "unless [the library] accompanies the
> > > executable" which it would if the executable were allowed into main. It's
> > > the exact same situation we had with KDE/Qt.

> > With this reasoning, the only other way it's legal to distribute 
> > GPL binaries linked against glibc and other LGPLed libraries (which 
> > are also distributed in main) is if those LGPLed libraries are
> > distributed under the GPL, per section 3 of the LGPL.  There is no 
> > qualitative difference between glibc and OpenSSL in this regard; if one 
> > must be GPLed to be linked against, then so must the other.  And we 
> > can't distribute glibc under the terms of the GPL, because then we can't 
> > link any other /non/ GPL software against it.

> Actually, under the GPL, Debian only has to be able to distribute the
> separate software under the same terms as the GPL.  In section 2 of
> the GPL, it states

>    But when you distribute the same sections as part of a whole which
>    is a work based on the Program, the distribution of the whole must
>    be on the terms of this License, whose permissions for other
>    licensees extend to the entire whole, and thus to each and every
>    part regardless of who wrote it.

> So Debian has to distribute the library under terms that are identical
> to the GPL.  Since the LGPL is trivially convertible to GPL, Debian is
> probably OK.  Technically, Debian might have to distribute two
> separate versions, one that is licensed under the GPL and one under
> the LGPL.

Although I can see that this conclusion appears reasonable (at least
superficially), I'm not convinced that "trivially convertible" is
sufficient to satisfy the GPL, precisely because of the one-way-trap
clause in the LGPL.  Although the LGPL allows someone to redistribute
affected code under the GPL, by itself it does NOT allow you to
simultaneously distribute that code under both the LGPL and the GPL; you
have to choose one or the other.  If you distribute under the LGPL to
comply with the copyrights of other non-GPL code in the archive, you are
therefore not distributing it under the GPL, and the conversion is no
longer trivial.  QED.

> I think that the GPL is vague enough in this area that Debian is just
> fine right now.

Although I don't think it is the /intent/ of the GPL to prohibit what 
we're doing, I'm also not entirely comfortable with the uncertainty of 
whether an entity with a minor copyright stake in a GPLed work we 
distribute, plus a lot of lawyers, could sue SPI for this and win.  
OTOH, I suppose the risk of this happening is only trivially ;) greater 
than the risk of some large, ill-intentioned company suing us over a
similarly arbitrary issue and winning by the virtue of better funding. 
<shrug>

> The OpenSSL license, on the other hand, is, AFAIK, not convertible to
> the GPL.  That is the problem.

That much is certain.  I just don't think that legally, LGPLed libraries 
look any different than OpenSSL libraries under the GPL.  Granted, just 
because there's precedent doesn't mean we should start violating the GPL 
deliberately; rather, I was hoping someone would come through with a 
loophole that says the normal-system-components exemption would apply. 
;)

Steve Langasek
postmodern programmer

Attachment: pgpHq15amnIVe.pgp
Description: PGP signature


Reply to: