Re: Bacula and OpenSSL
Hi Shane,
On Thu, Jul 19, 2007 at 04:22:06PM +0200, Shane M. Coughlan wrote:
> Steve Langasek wrote:
> > I agree that the GPLv3 is not "compatible" with the OpenSSL license, in the
> > sense that code licensed under the OpenSSL license cannot be included in a
> > GPLv3 work. However, the GPLv3 does include a broader (if no more easily
> > understood) system exception clause, which seems to allow distributing GPLv3
> > binaries that are /dynamically linked/ against OpenSSL. Is this not the
> > position of FSF/FSF Europe?
> I discussed this issue with Brett Smith of FSF, and as a result of this
> he wrote the following brief summary:
> ===
> We do not believe that OpenSSL qualifies as a System Library in Debian.
> The System Library definition is meant to be read narrowly, including
> only code that accompanies genuinely fundamental components of the
> system. I don't see anything to suggest that that's the case for
> OpenSSL in Debian: the package only has important priority (as opposed
> to glibc's required), there are only about 350 packages depending on it
> (as opposed to glibc's 8500), and it isn't installed on a base system.
> To put it plainly, if OpenSSL actually were a System Library, I would
> expect it to look more like one.
> - -- Brett Smith Licensing Compliance Engineer, Free Software Foundation
> ===
IMHO that would be a rather unfortunate position for the FSF to take, as it
would mean the changes to the system exception clause are *only* of benefit
to distributors of proprietary operating systems, while GNU/Linux
distributors are left with the same license compatibility problems as ever.
But as AJ noted, the above analysis seems to get some facts wrong. In
addition to the fact that OpenSSL is part of the base system, the count of
reverse-dependencies seems to be off somewhat. There are 461 packages in
etch that depend on libssl0.9.8, plus another 11 depending on the
libssl0.9.7 that we aren't quite rid of. Of course that's nothing close to
glibc's 8500, but if we were to look at some of the individual libraries
within the libc6 package, like librt, libnsl, libm, or libdl, I would expect
that openssl's usage within Debian is at least within an order of magnitude
of some of these. Surely if libraries such as these qualify as System
Libraries (and I should hope they do!), shouldn't libssl qualify too?
Cheers,
--
Steve Langasek Give me a lever long enough and a Free OS
Debian Developer to set it on, and I can move the world.
vorlon@debian.org http://www.debian.org/
Reply to: