Bacula: GPL and OpenSSL

John Goerzen · External Since: Nov 08, 2004 Posts: 961

On Fri, Jun 22, 2007 at 10:21:29PM +0200, Kern Sibbald wrote:
>
> In the mean time, I sincerely hope that Debian finds some way to continue
> releasing Bacula.

It sounds like Debian will simply have to disable the SSL support in
Bacula, yes? (this is a question to -legal)

--
To UNSUBSCRIBE, email to debian-legal-REQUEST DeleteThis @lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster DeleteThis @lists.debian.org

Walter Landry · External Since: Mar 31, 2004 Posts: 32

Kern Sibbald <kern RemoveThis @sibbald.com> wrote:
> On Friday 08 June 2007 10:30, Walter Landry wrote:
> > Kern Sibbald <kern RemoveThis @sibbald.com> wrote:
> > > On Friday 08 June 2007 01:46, Steve Langasek wrote:
> > > > I have seen various FSF FAQs over the years that have claimed that
> > > > distributing binaries linked against OpenSSL is ok, but these FAQs
> > > > have been mute on the matter of distribution as part of an OS. >
> > >
> > > I haven't seen them, but that doesn't surprise me as I don't believe
> > > that FSF ever really wanted to prohibit linking against OpenSSL, and
> > > if they did, they have clearly changed their minds since the GPL v3
> > > permits it.
> >
> > I do not think that GPLv3 permits it.
>
> GPL v3 *is* compatible with the OpenSSL (actually the Apache) license
> according to FSF.

The FSF claims that GPL v3 is compatible with the Apache 2.0 license,
which does not have the advertising clause. The Apache license used
to have the advertising clause, but it was removed in 2007 with the
Apache license 1.1.

Cheers,
Walter Landry
wlandry RemoveThis @ucsd.edu

--
To UNSUBSCRIBE, email to debian-legal-REQUEST RemoveThis @lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster RemoveThis @lists.debian.org

Kern Sibbald · External Since: Jun 29, 2006 Posts: 43

On Friday 08 June 2007 00:54, Michael Poole wrote:
> Kern Sibbald writes:
>
> > On Thursday 07 June 2007 19:00, Michael Poole wrote:
> >>
> >> Debian generally distributes OpenSSL logically near the packages that
> >> dynamically link against it, so the major system component option is
> >> not available to Debian ("... unless that component itself accompanies
> >> the executable").
> >>
> >> GPL section 3(a) also uses "accompany" in a way that Debian and others
> >> interpret to include distribution in the same directory tree on a
> >> particular server, so -- the usual line of reasoning goes -- it would
> >> be inconsistent to interpret "accompany" one way at the start of
> >> section 3 and a different way at the end of section 3.
> >
> > Well, the above is total Greek to me. However, I must say that there is
> > absolutely no reason why Bacula would every accompany OpenSSL in any sense
of
> > the the English meaning of accompany that I am aware of, nor is Bacula in
the
> > same directory tree as any OpenSSL shared object unless you consider
> > everything is under root thus everything on the server is in the same
> > directory "tree".
>
> Bacula and OpenSSL packages are both found on Debian install media and
> on mirrors. I am not sure how to define "accompany" in a way that
> excludes that. In addition, Debian Bacula packages are marked to work
> with the specific OpenSSL package at the same place (although others
> are compatible). GPL section 3 provides three options to someone who
> wishes to distribute executable binary versions of GPLed works:
>
> 3. You may copy and distribute the Program (or a work based on it,
> under Section 2) in object code or executable form under the terms of
> Sections 1 and 2 above provided that you also do one of the following:
>
> a) Accompany it with the complete corresponding machine-readable
> source code, which must be distributed under the terms of Sections
> 1 and 2 above on a medium customarily used for software interchange; or,
>
> b) Accompany it with a written offer, valid for at least three
> years, to give any third party, for a charge no more than your
> cost of physically performing source distribution, a complete
> machine-readable copy of the corresponding source code, to be
> distributed under the terms of Sections 1 and 2 above on a medium
> customarily used for software interchange; or,
>
> c) Accompany it with the information you received as to the offer
> to distribute corresponding source code. (This alternative is
> allowed only for noncommercial distribution and only if you
> received the program in object code or executable form with such
> an offer, in accord with Subsection b above.)
>
> 3(c) is not available to Debian. 3(b) is prohibitively expensive.
> That leaves 3(a), with this clarification at the end of section 3:
>
> If distribution of executable or object code is made by offering
> access to copy from a designated place, then offering equivalent
> access to copy the source code from the same place counts as
> distribution of the source code, even though third parties are not
> compelled to copy the source along with the object code.
>
> This seems to say that "offering equivalent access to copy [] from the
> same place" is one way to "accompany", at least in the sense used by
> section 3 of the GPL.
>
> > By the way, just to be clear, I consider all this (not you guys but these
> > license difficulties) to be a real pain. As long as the code is Open
Source
> > (i.e. I can get it, see it and modify it), I have no problem with it being
> > linked with Bacula.
>
> I think most of the Debian community that has dealt with this shares
> the sentiment. I certainly do; it has pushed me to make sure that my
> (small amount of) encryption-using code can use either OpenSSL or
> GnuTLS's OpenSSL compatibility mode.
>
> Michael Poole
>

The bottom line is that this license stuff for a developer such as me is all
absurd, and I'm not going to worry about it any longer.

I've decided for the moment to go with a straight GPL v2 license, and if I can
over time eliminate all the GPL copyrighted code by others, I will switch to
a nice simple license that provides a "tit for a tat" clause as Linus calls
it (i.e. requires releasing the source if you modify and distribute it).

In the mean time, I sincerely hope that Debian finds some way to continue
releasing Bacula.

Regards,

Kern

--
To UNSUBSCRIBE, email to debian-legal-REQUEST.RemoveThis@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster.RemoveThis@lists.debian.org

Michael Poole · External Since: Apr 12, 2004 Posts: 135

John Goerzen writes:

> On Fri, Jun 22, 2007 at 10:21:29PM +0200, Kern Sibbald wrote:
>>
>> In the mean time, I sincerely hope that Debian finds some way to continue
>> releasing Bacula.
>
> It sounds like Debian will simply have to disable the SSL support in
> Bacula, yes? (this is a question to -legal)

Barring other solutions, yes. But I hope there is a solution:

libgnutls has an OpenSSL compatibility mode. I don't know if it
provides all the features that Bacula requires; in my software it was
easy to add a configure-time choice between the two. Since gnutls is
licensed under LGPLv2.1+ and GPLv2+ (varying by component), there
should be no license concerns when using it with other GPLed code.

Having already put my foot in this mess, I will try that out with the
goal of producing patches this weekend, unless Kern, John or someone
else prefers to investigate for themselves. I may miss some run-time
cases (I don't currently use Bacula), but hopefully the input is
useful to Kern and to Debian.

Further discussion of that is a bit off-topic for -legal; I can post
questions to bacula-devel and patches to SourceForge. John, should I
post the patches somewhere for your (or other maintainers') benefit?

Michael Poole

--
To UNSUBSCRIBE, email to debian-legal-REQUEST.DeleteThis@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster.DeleteThis@lists.debian.org

John Goerzen · External Since: Nov 08, 2004 Posts: 961

On Fri, Jun 22, 2007 at 06:34:14PM -0400, Michael Poole wrote:
>
> Having already put my foot in this mess, I will try that out with the
> goal of producing patches this weekend, unless Kern, John or someone
> else prefers to investigate for themselves. I may miss some run-time
> cases (I don't currently use Bacula), but hopefully the input is
> useful to Kern and to Debian.

That would be awesome. Yes, if you post patches somewhere that Kern and
I can see them, that'd be great.

Thanks much for investigating.

-- John

--
To UNSUBSCRIBE, email to debian-legal-REQUEST DeleteThis @lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster DeleteThis @lists.debian.org