Michael Stone <mst...@debian.org> writes: > On Tue, Apr 15, 2025 at 03:38:38PM +0200, Simon Josefsson wrote: >>I believe that is a fairly new (~5 years?) approach within Debian. >>Debian used to treat OpenSSL incompatible with GPLv2 and that all code >>that link to OpenSSL has to have a GPL+OpenSSL exception. Does anyone >>recall how and when this decision was made? > > I think it was at least in part a pragmatic realization that debian > was being overly strict, as most other distributions (including those > with lawyers presumably incentivized to protect assets worth suing > over) were > following a different interpretation.
Yes that seems likely. I think that the decision in other distributions may have had more to do with aligning interests with organization who fund them, though. It is a calculated risk to be in a better position to get access to X money by breaching one interpretation of a license that is unlikely to hurt financially. Debian doesn't have to follow the same kind of reasoning, but I realize it is easy to do so. Was invoking the system library exception discussed or decided on project-wide in Debian? I tried to find some earlier discussion around this, and while many discussions is possible to find, I don't see any conclusions. > FWIW, I think the current interpretation is much more in line with the > spirit of the text: we're not including openssl for the specific > purpose of linking to git; libssl is a part of the distribution that > happens to be pulled in (indirectly) when building git. It also seems > not in keeping with the spirit of the license that a completly > non-free OS linking non-free software would have fewer restrictions > than a free OS linking free software. I disagree. I think the idea behind the "proprietary system library" GPL exception is to make it possible to distribute GPL binaries linked to non-free system libraries on systems where that is pretty much unavoidable, e.g. system libraries on AIX, IRIX etc. The exception is that you are not required to distribute source code for the non-free system libraries: https://www.gnu.org/licenses/gpl-faq.en.html#SystemLibraryException The exception in the GPLv2 says: However, as a special exception, the source code distributed need not include anything that is normally distributed (in either source or binary form) with the major components (compiler, kernel, and so on) of the operating system on which the executable runs, unless that component itself accompanies the executable. I believe that those components (compiler, kernel, OpenSSL, etc) accompany the executable for Debian. So the exception does not appear applicable to me. The system library exception was not intended for distributions to be able to link GPLv2 code to GPLv2-incompatible code: there is no "just happens to" occuring in this situation, it is an intentional decision made by packagers (which can be reversed to respect copyright holders). /Simon
signature.asc
Description: PGP signature
