Re: Howto prevent viral dependency propagation by ITK or GDCM?

[Mathieu Malaterre <mathieu.malaterre@gmail.com>]

On Wed, Apr 28, 2010 at 11:39 PM, Michael Hanke <michael.hanke@gmail.com> wrote:
> Hi,
>
> I working on packaging ITK-SNAP (http://www.itksnap.org). This software
> is GPL licensed. It is based on ITK, and ITK itself is linked or
> includes any known library on this planet.
>
> It happens that ITK (and GDCM) also links against OpenSSL -- meaning no
> matter what I do, I get a GPL-licensed binary linked against OpenSSL
> -- which is unless you put a special exemption -- a license violation.
>
>  http://people.gnome.org/~markmc/openssl-and-the-gpl.html
>
> This is somewhat crazy, because ITK-SNAP does not seem to be using a
> single symbol from OpenSSL. But first of all cmake does a nice job
> collecting all the "LIB_DEPENDS" and links the binary against everything
> its dependencies have been linked against -- whatever that is good for...
>
> But even if I manually remove all traces of OpenSSL from the build
> process I end up with this:
>
> michael@meiner ~/debian/itk-snap/git/build (git)-[debian] % ldd InsightSNAP
> ...
>        libssl.so.0.9.8 => /usr/lib/i686/cmov/libssl.so.0.9.8 (0xb53c4000)
>        libcrypto.so.0.9.8 => /usr/lib/i686/cmov/libcrypto.so.0.9.8 (0xb526c000)
> ...
>
> And this happens although there is no -lssl or -lcrypto anywhere during
> the ITK-SNAP build. Nevertheless, I get a linitan error pointing to the
> license violation.
>
> What can I do?
>
>
> I thought '-Wl,--as-needed' would fix it, but it doesn't.
>
>
> Help would be greatly appreciated.

Here is the culprit file:

$ grep -l ssl /usr/lib/gdcm-2.0/GDCMLibraryDepends.cmake
/usr/lib/gdcm-2.0/GDCMLibraryDepends.cmake

Try changing:

  SET("gdcmCommon_LIB_DEPENDS"
"general;dl;general;/usr/lib/libssl.so;general;/usr/lib/libcrypto.so;")

into

  SET("gdcmCommon_LIB_DEPENDS" "")

This is really a long standing issue in cmake. If this works for you,
I'll try to see how to add a post build rule in debian/rules to clean
this cmake file.

Thanks and sorry for the troubles,
-- 
Mathieu
Ps: you should see how many dep VTK or ITK are pulling in...