Re: Bug#1094969: git linked with OpenSSL

2025-04-16 Thread Ansgar πŸ™€
Hi, On Wed, 2025-04-16 at 17:12 +, Bill Allombert wrote: > Le Wed, Apr 16, 2025 at 08:39:18AM +0200, Ansgar πŸ™€ a Γ©crit : > > > Debian has always allowed GPL-2-only code linked against GPL-3+-only > > libraries such as the libstdc++ or GCC runtime libraries. (You ignore > > that libraries aside

Re: Bug#1094969: git linked with OpenSSL

2025-04-16 Thread Bill Allombert
Le Wed, Apr 16, 2025 at 08:39:18AM +0200, Ansgar πŸ™€ a Γ©crit : > Hi, > > On Wed, 2025-04-16 at 07:27 +0200, Simon Josefsson wrote: > > Yes that seems likely.Β  I think that the decision in other distributions > > may have had more to do with aligning interests with organization who > > fund them, tho

Re: Bug#1094969: git linked with OpenSSL

2025-04-16 Thread Matthias Urlichs
On 16.04.25 09:46, Henrik Ahlgren wrote: But we can also just decide to synchronize and contact all copyright holders on record if/when the occasion arises. Linus Torvalds should have known better than to be *that* optimistic. The number of such notices might serve as a rough indicator for

Re: Bug#1094969: git linked with OpenSSL

2025-04-16 Thread Simon Josefsson
Henrik Ahlgren writes: > Simon Josefsson writes: > >> I think the idea behind the "proprietary system library" GPL exception >> is to make it possible to distribute GPL binaries linked to non-free >> system libraries on systems where that is pretty much unavoidable, e.g. >> system libraries on A

Re: Bug#1094969: git linked with OpenSSL

2025-04-16 Thread Matthias Urlichs
On 16.04.25 07:27, Simon Josefsson wrote: I think the idea behind the "proprietary system library" GPL exception is to make it possible to distribute GPL binaries linked to non-free system libraries on systems where that is pretty much unavoidable, which, if you remove the "proprietary" and "no

Re: Bug#1094969: git linked with OpenSSL

2025-04-16 Thread Henrik Ahlgren
Pirate Praveen writes: > But the crucial point here is that the git upstream is choosing not to > correct that mistake by moving to GPLv3 (probably they don't like some > other changes introduced) or giving another specific exception to > linking with Apache 2.0. Well, Torvalds founded Git, and

Re: Bug#1094969: git linked with OpenSSL

2025-04-16 Thread Pirate Praveen
On 4/16/25 12:34 PM, Henrik Ahlgren wrote: BTW, FSF considers Apache 2.0 as a good license and that "it's unfortunate that the Apache License 2.0 isn't compatible with some free software licenses like GPLv2". Compatibility with it was one important goal for GPLv3. So, this incompatibility was not

Re: Bug#1094969: git linked with OpenSSL

2025-04-16 Thread Henrik Ahlgren
Simon Josefsson writes: > I think the idea behind the "proprietary system library" GPL exception > is to make it possible to distribute GPL binaries linked to non-free > system libraries on systems where that is pretty much unavoidable, e.g. > system libraries on AIX, IRIX etc. The exception is

Re: Bug#1094969: git linked with OpenSSL

2025-04-15 Thread Ansgar πŸ™€
Hi, On Wed, 2025-04-16 at 07:27 +0200, Simon Josefsson wrote: > Yes that seems likely.Β  I think that the decision in other distributions > may have had more to do with aligning interests with organization who > fund them, though. This is moving into conspiracy theory territory... We can as well

Re: Bug#1094969: git linked with OpenSSL

2025-04-15 Thread Andreas Metzler
On 2025-04-16 Simon Josefsson wrote: [...] > Was invoking the system library exception discussed or decided on > project-wide in Debian? I tried to find some earlier discussion around > this, and while many discussions is possible to find, I don't see any > conclusions. Good morning, iirc it ca

Re: Bug#1094969: git linked with OpenSSL

2025-04-15 Thread Simon Josefsson
Michael Stone writes: > On Tue, Apr 15, 2025 at 03:38:38PM +0200, Simon Josefsson wrote: >>I believe that is a fairly new (~5 years?) approach within Debian. >>Debian used to treat OpenSSL incompatible with GPLv2 and that all code >>that link to OpenSSL has to have a GPL+OpenSSL exception. Does

Re: Bug#1094969: git linked with OpenSSL

2025-04-15 Thread Pirate Praveen
On 14/04/2025 1:59 pm, Henrik Ahlgren wrote: Pirate Praveen writes: Didn't OpenSSL switch license to Apache 2.0 and now compatible with GPL? What am I missing here? https://gplv3.fsf.org/wiki/index.php/Compatible_licenses#GPLv2-incompatible_licenses Thanks, so only GPL v3/v2+ is compatible,

Re: Bug#1094969: git linked with OpenSSL

2025-04-15 Thread brian m. carlson
On 2025-04-15 at 05:58:42, Ansgar πŸ™€ wrote: > Hi, Hi, > As Git doesn't seem any different, I think we should close this bug. I agree with you that we should close the bug, which I did a few minutes ago. I provided slightly different reasons in the close message, but I agree this would cause a lo

Re: Bug#1094969: git linked with OpenSSL

2025-04-15 Thread Michael Stone
On Tue, Apr 15, 2025 at 03:38:38PM +0200, Simon Josefsson wrote: I believe that is a fairly new (~5 years?) approach within Debian. Debian used to treat OpenSSL incompatible with GPLv2 and that all code that link to OpenSSL has to have a GPL+OpenSSL exception. Does anyone recall how and when thi

Re: Bug#1094969: git linked with OpenSSL

2025-04-15 Thread Simon Josefsson
Ansgar πŸ™€ writes: > No, that is not the core problem. Debian, like most other binary > distributions, heavily relies on the system library exception in many, > many places. I believe that is a fairly new (~5 years?) approach within Debian. Debian used to treat OpenSSL incompatible with GPLv2 and

Re: Bug#1094969: git linked with OpenSSL

2025-04-15 Thread Richard Laager
On 2025-04-14 11:10, Russ Allbery wrote: I do find it fairly hard to understand the logic behind a position that somehow our git-remote-https binary as distributed is a derived work of OpenSSL and thus violates the GPLv2 license based on the nature of this specific dependency chain, but then I wa

Re: Bug#1094969: git linked with OpenSSL

2025-04-15 Thread Ansgar πŸ™€
Hi, On Mon, 2025-04-14 at 16:18 -0500, Richard Laager wrote: > On 2025-04-14 11:10, Russ Allbery wrote: > > I do find it fairly hard to understand the logic behind a position that > > somehow our git-remote-https binary as distributed is a derived work of > > OpenSSL and thus violates the GPLv2 li

Re: Bug#1094969: git linked with OpenSSL

2025-04-14 Thread Simon Josefsson
Richard Laager writes: > As I have said before: I think that computer programmers have a > tendency to treat licenses as if they are self-executing (and precise > like software). Agreed, this is often a challenge when technical people discuss legal matters, and it helps to keep this in mind. >

Re: Bug#1094969: git linked with OpenSSL

2025-04-14 Thread Russ Allbery
Andreas Metzler writes: > well, we have decided to use the system library exception because we > thought we had the right to so, not because we hoped that no copyright > holder would notice. Undoing this for specific packages where a > copyright holders tells us he disagrees undermines this posit

Re: Bug#1094969: git linked with OpenSSL

2025-04-14 Thread Sam Hartman
> "Chris" == Chris Hofstaedtler writes: Chris> brian m. carlson (one of the git upstream copyright holders) Chris> claims in Bug #1094969 that git cannot be distributed when Chris> linked with OpenSSL. IIRC the Debian position is to use the Chris> system library exception. T

Re: Bug#1094969: git linked with OpenSSL

2025-04-14 Thread Sam Hartman
> "Chris" == Chris Hofstaedtler writes: Chris> brian m. carlson (one of the git upstream copyright holders) Chris> claims in Bug #1094969 that git cannot be distributed when Chris> linked with OpenSSL. IIRC the Debian position is to use the Chris> system library exception. [T

Re: Bug#1094969: git linked with OpenSSL

2025-04-14 Thread Robert Edmonds
Russ Allbery wrote: > I think the situation here is this dependency chain: > > libcurl-gnutls -> libldap2 -> libssl > > (There may be others; I didn't do a thorough check. Does anyone know if > there's a tool that will recursively analyze a binary's NEEDED sections > and build a human-readabl

Re: Bug#1094969: git linked with OpenSSL

2025-04-14 Thread Henrik Ahlgren
Pirate Praveen writes: > Didn't OpenSSL switch license to Apache 2.0 and now compatible with > GPL? What am I missing here? https://gplv3.fsf.org/wiki/index.php/Compatible_licenses#GPLv2-incompatible_licenses

Re: Bug#1094969: git linked with OpenSSL

2025-04-14 Thread Pirate Praveen
On 14/04/2025 11:14 am, Andreas Metzler wrote: On 2025-04-13 Chris Hofstaedtler wrote: brian m. carlson (one of the git upstream copyright holders) claims in Bug #1094969 that git cannot be distributed when linked with OpenSSL. IIRC the Debian position is to use the system library exception. I

Re: Bug#1094969: git linked with OpenSSL

2025-04-13 Thread Andreas Metzler
On 2025-04-13 Chris Hofstaedtler wrote: > brian m. carlson (one of the git upstream copyright holders) claims > in Bug #1094969 that git cannot be distributed when linked with > OpenSSL. IIRC the Debian position is to use the system library > exception. > Indeed our /usr/lib/git-core/git-remot

Re: Bug#1094969: git linked with OpenSSL

2025-04-13 Thread Chris Hofstaedtler
brian m. carlson (one of the git upstream copyright holders) claims in Bug #1094969 that git cannot be distributed when linked with OpenSSL. IIRC the Debian position is to use the system library exception. Indeed our /usr/lib/git-core/git-remote-https links against libssl.so.3, probably via li