Re: GPL-licensed packages with depend-chain to OpenSSL
On Thu, Aug 12, 2004 at 04:17:22PM -0700, Steve Langasek wrote:
> On Thu, Aug 12, 2004 at 03:22:34PM +0200, Daniel Stenberg wrote:
> > Please forgive a new subscriber if this subject already has been debated to
> > death. In that case, just let me know and I'll quietly crawl away again.
>
> > Ok, here's my explanation of the "problem":
>
> > There this package in recent Debian named 'curl' (using a MIT-like
> > license). It is built with OpenSSL (you all know the OpenSSL license).
>
> > With curl there comes two (that we care about here) debian packages
> > nowadays named libcurl2 and libcurl3 (libcurl3 being the new ABI and
> > libcurl2 the older one). Both are linked against the OpenSSL libraries.
>
> > Many applications use libcurl. Including several applications/packages in
> > Debian unstable that are GPL-licensed.
>
> > See where I'm drifting? Several packages in Debian unstable are licensed
> > GPL (without explicit allowance for linking with OpenSSL) but links with
> > libraries/components that link with OpenSSL... This creates binaries that
> > are not allowed to distribute due to GPL license violations. AFAICT.
>
> > I'm not a Debian guru, but I scanned through the list of apps depending on
> > curl to see what licenses they use, and I stopped when I had collected five
> > examples:
>
> > grip, logjam, ardour, fbi, xine-ui
>
> > They are all GPLv2 licensees.
>
> This is, in fact, a violation of the GPL as we understand it.
>
Uhm, please clarify. E.g. I - an upstream - link a library which in turn
links openssl, but I do not use ssl related functions at all in my
sources. Could you explain why I should add a clause for openssl?
Linking with it is of course a choice of curl upstream (and maintainer)
and of course not mandatory. I (again the typical upstream) link using
curl API, which should hide those kind of details, tamquam non esset.
The only upstream which should add the clause is curl one AFAIK, if needed
(I don't know what sort of license it uses). If you admit indirect
linking vincula, we could probably remove a good portion of main
in debian, due to bsd-gpl problem.
--
Francesco P. Lovergine
Reply to: