Re: [Pan-devel] OpenSSL and the GPL: License problems

[Duncan]

walt posted on Sun, 18 Dec 2011 12:49:27 -0800 as excerpted:

> On 12/18/2011 10:15 AM, Duncan wrote:
> 
> <wholesale snippage with apologies to Duncan's carpal tunnels>
> 
>> But for binary distros including both the big guys like Fedora and
>> Ubuntu, and binary-based distros based on source-based distros like
>> Sabayon (based on Gentoo), it's an ENTIRELY different matter!  They
>> won't be able to ship pan binaries with OpenSSL support as that'd
>> violate pan's GPL, which is the only thing giving them the legal right
>> to distribute pan binaries.
> 
> I just booted up my virtualbox install of kubuntu to see how they handle
> this problem.  (I use it just to keep up with kde's changes.)
> 
> For example, they install a binary package of openssl (as I suspect most
> other binary distributions do also) and they include a file named
> /usr/share/doc/openssl/copyright.bz2 which contains a copy of the
> openssl credits demanded by the license.
> 
> Couldn't they also install such a file in /usr/share/doc/pan to satisfy
> the openssl license?  I don't know what other binary distros do about
> their packages that use openssl.

Yes, that'd satisfy the openssl license, but satisfying the openssl 
license isn't the problem.  The problem is the gpl under which pan itself 
is licensed, as it bans additional restrictions and the advertising 
clause is exactly that, an additional restriction.  The openssl binaries 
can ship along with the pan binaries, as long as the pan binaries don't 
link the openssl binaries.  As soon as they do, that's a violation of 
pan's GPL and distribution of the binaries is no longer allowed.

Note however that the GPL is very specific in NOT applying to USE, only  
distribution.  Thus, a user getting the source can compile binaries and 
use them just fine.  They just can't distribute those binaries.

And changing pan's license by adding the exception, option #5, isn't 
simple either, because in ordered to legally change pan's license, all 
copyright holders must agree to the change.  Since pan has never required 
copyright assignment to accept patches, that means that beyond some level 
of triviality (where that line is drawn isn't settled, but it's 
presumably somewhere between one line and a few hundred lines of source 
code), every source contributor must sign onto the change, or the code 
they contributed must be rewritten by someone who does agree to the 
change.

It's also likely that the authors of pan's dependencies, gtk, glib, etc, 
would have to sign on too, if the proposed exception isn't already in 
line with the license of the dependency.  (gtk+ and glib at least are 
LGPL, which should be fine as long as we aren't modifying gtk+ code, 
which we aren't.  Other libraries... someone would need to check.)

> I know that you know that all the BSD's would be up shit creek without
> gcc and the autotools, so I don't think they have much room to complain,
> really.

You'd be surprised...  And that's one reason why all the interest in llvm, 
clang, etc, as they're quite interested in ridding themselves of that 
thorn in their flesh that the FSF and gcc, etc, have (from their 
perspective) been to them.

> In Real Life, isn't the whole fuss really about linking to closed-source
> binaries?

In real life, the whole fuss is about not getting sued. =:^(

And the legal line the GPL draws is between licenses with more 
restrictions than it, which it bans linking to, and those with less, 
which it is fine with.  Thus it's fine with the MIT and two-clause BSD 
style licenses, but incompatible with three-clause BSD style licenses, 
because that extra clause is an advertising restriction more restrictive 
than the GPL, which isn't allowed by the GPL, so linking between GPLed 
code and 3-clause BSD code is not allowed either.

The caveat, of course, is that it takes someone with copyright interest 
in the code in question to sue violators (or just go after them until 
they quit with the violation, sometimes with an often confidential 
settlement for past damage as well), and sometimes, they choose to look 
the other way, instead.  But while individuals and small distros often 
get away with such violations for a few years, once a distro gets above a 
certain size, they are a big enough target and there's enough money at 
stake that they tend to be be very careful about licenses.

> I've been reading mailing list threads about GPL issues for years and I
> still don't really understand what they're arguing about :-/

Within limits, I believe I usually understand the arguments.  And given 
that from my viewpoint the GPL is sort of like the constitution of the 
free as in freedom software movement, the guarantee of the software 
freedoms I live by every day, I take a rather deeper interest in this 
sort of thing than most.  But it takes a particular degree of patience 
and mental discipline to follow the logic step by step, that most folks 
don't have.

-- 
Duncan - List replies preferred.   No HTML msgs.
"Every nonfree program has a lord, a master --
and if you use the program, he is your master."  Richard Stallman