Re: GPL-licensed packages with depend-chain to OpenSSL
On Thu, Sep 09, 2004 at 10:55:38PM -0400, Anthony DeRobertis wrote:
> (b) The method is what must be analyzed, not the end result. As a
> trivial example, take the end result of having Microsoft Windows
> installed on a PC. A legal contraption to do that would be to go to
> your local computer store and buy a copy. An illegal contraption to
> do that would be Kazaa.
>
> As an example, I think distributing a package which downloaded FOO
> source code and compiles it --- on the user's machine --- with OpenSSL
> might be fine, as we'd be distributing under GPL 2 (or even GPL 1), and
> GPL 2 doesn't require source to all modules contained in the program
> (only to the program and works based on it, which OpenSSL clearly
> isn't).
The GPL requires that all derived works be entirely available under the
terms of the GPL. One piece of the resulting binary--OpenSSL--is not.
This seems to clearly violate the spirit of the GPL.
I don't know if the actual mechanism here is infringing. This is really
just a case of the "distribute only source code, avoiding disributing
binaries, to circumvent some of the GPL's requirements" "loophole", which
we've discussed here several times, I think. I have no idea how this
would fare in court, but I hope we agree that this would not be an
acceptable thing for Debian to do. (I don't know if by "fine" you mean
"legally fine" or "actually fine".)
--
Glenn Maynard
Reply to: