[Gajim-devel] Licence incompatibility -- GPL and OpenSSL

[Yavor Doganov]

On Tue, Jan 27, 2009 at 03:08:57PM +0100, Jonathan Schleifer wrote:
>> I never said you did.
>
> Then I fail to see the problem.

The problem is the linking.  You can't link a GPL'ed application against 
a library under incompatible license, unless it classifies as a "system 
library".

> We only combine our code with OpenSSL's code in memory.

That is precisely the problem.  You do that and the combination is 
impossible, which is why wget, gnubiff, exim and tons of other GPL'ed 
packages have this exception.

See also http://en.wikipedia.org/wiki/Openssl#Licensing -- this is 
widely known problem.  That's one of the reasons GnuTLS exists.

> This is perfectly legal, as the GPL only covers _DISTRIBUTION_.

Please reread the license.  Distributors are not allowed to distribute 
Gajim (at least in binary form, for sure), as it is not complying to its 
own license.  Several distros care about this (like Debian and Fedora), 
others assume OpenSSL is a "system library", and others simply ignore 
the problem like most licensing issues.

Only a very small portion of the bugs reported to Debian:
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=443451
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=497837
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=367024
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=358246
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=508292

(How such bugs are resolved: 1) the package is relicensed upstream to 
GPL+OpenSSL exception; 2) the package migrates to GnuTLS or NSS; 3) the 
openssl support is removed if 1) and 2) are impossible.)

> Right, it is loaded at runtime. So the combined work is created at  
> _RUNTIME_, and _NOT_ at distribution. This isn't covered by the GPL at  
> all. It doesn't say a single word that it's forbidden to combine GPL'd  
> and non-GPL'd code in RAM.

It is definitely covered by the GPL, as the work you distribute "as a 
whole" should be under the GPL (which in practical terms means that all 
dynamically linked libraries must be licensed under a GPL-compatible 
license).

See for example 
http://www.gnu.org/licenses/gpl-faq.html#AllCompatibilty.

Note the two distinguished usages "I want to copy code under" and "I 
want to use a library under" and read their explanations above the 
table.  You are basically arguing that to comply with the GPL, you only 
must make sure to include GPL-compatible code in the tarball.  That's 
only one of the things you have to do.