Re: [Fink-devel] the gpl and openssl

2005-04-04 Thread David R. Morrison
I've begun the implementation of the new license policy by re-licensing
all of the packages that Lars listed in the stable/crypto category,
re-licensing them in all four active trees.  (I made them all Restrictive, 
but put a note in DescPackaging to indicate the original license.)  I'll 
work on the others later.

As package maintainers make progress on the other approaches, they can
revise their packages.

I'll also put a statement about the new policy in the fink documentation.

  -- Dave


Lars Rosengreen [EMAIL PROTECTED] wrote:

  I guess once we have this, for each package we'll need to:
  - Notify the upstream developers that they're sitting on a time bomb. 
  :-)
 
  - Do one of the following, in order of preference:
  * Get permission from the upstream devel to link with OpenSSL
  * Link the package against OpenTLS
  * Link the package against the system OpenSSL (BuildConflict with 
  Fink's version)
  * Remove the package from the bindist, possibly from unstable too.
 
  Any other options?
 
 To me the solution seems fairly simple: if a package has gpl (or lgpl) 
 in its license field and has a builddep on fink's openssl, then it 
 should no longer be included in the binary distribution, unless someone 
 can establish that the upstream authors permit linking against openssl. 
   We could change the license field of such packages to restrictive, or 
 better yet, create a new license category for cases like this where 
 fink may distribute source code but not binaries.


---
SF email is sponsored by - The IT Product Guide
Read honest  candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
http://ads.osdn.com/?ad_id=6595alloc_id=14396op=click
___
Fink-devel mailing list
Fink-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/fink-devel


Re: [Fink-devel] the gpl and openssl

2005-04-04 Thread David H.
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

David R. Morrison wrote:
 I've begun the implementation of the new license policy by re-licensing
 all of the packages that Lars listed in the stable/crypto category,
 re-licensing them in all four active trees.  (I made them all Restrictive, 
 but put a note in DescPackaging to indicate the original license.)  I'll 
 work on the others later.
 
 As package maintainers make progress on the other approaches, they can
 revise their packages.
 
 I'll also put a statement about the new policy in the fink documentation.
 
Could we please put Variants on the License: filed then ?
I am _not_ going to maintain msmtp-ssl and msmtp-sasl because of this license
change as seperate files. Thank you

- -d

-BEGIN PGP SIGNATURE-
Version: GnuPG v1.3.6 (Darwin)

iD8DBQFCUiKmPMoaMn4kKR4RAu7zAKCgQ3vV9D7pbC3RGQP1iKevOWXVDACeLSmN
E3mfU6rFN5qVhmOXvYgsx40=
=4frQ
-END PGP SIGNATURE-


---
SF email is sponsored by - The IT Product Guide
Read honest  candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
http://ads.osdn.com/?ad_id=6595alloc_id=14396op=click
___
Fink-devel mailing list
Fink-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/fink-devel


Re: [Fink-devel] the gpl and openssl

2005-03-29 Thread Lars Rosengreen
On Mar 26, 2005, at 5:10 PM, Dave Vasilevsky wrote:
On Mar 16, 2005, at 2:39 PM, Lars Rosengreen wrote:
Yes, I think we do.  I'll try to construct a list of packages that 
may be affected.
Thanks Lars.
Here is a preliminary list.  I have only had a chance to verify a few 
of these, so there are bound to be several false positives in here.

unstable/main

net/lftp.info   GPL Justin F. Hallett
unstable/crypto
-
amule.info  GPL ASARI Takashi
aqbanking.info  GPL Peter O'Gorman
aqhbci-qt-tools.infoGPL Peter O'Gorman
aqhbci.info GPL Peter O'Gorman
bazaar-ssl.info GPL/GFDLLars Rosengreen
ccvssh.info GPL David Bacher
cfengine.info   GPL Matthew Flanagan
clamav.info GPL Remi Mommsen
dods.info   GPL Jeffrey Whitaker
ejabberd.info   GPL Daniel Henninger
ekg-ssl.infoGPL/LGPLBenjamin Reed
elinks-ssl.info GPL Daniel Macks
ethereal-ssl.info   GPL Max Horn
fetchmail-ssl.info  GPL Eric Knauel
fwbuilder.info  GPL Vadim Zaliva
gftp-ssl.info   GPL Justin F. Hallett
gnome-vfs-ssl.info  GPL/LGPLNone
gnome-vfs2-ssl.info GPL/LGPLThe Gnome Core Team
gnomemeeting.info   GPL/LGPLShawn Hsiao
gwenhywfar.info LGPLPeter O'Gorman
htmldoc-1.8.23-13.info  GPL Thomas Kotzian
htmldoc-nox-1.8.23-3.info   GPL Thomas Kotzian
irssi-ssl.info  GPL Max Horn
jpilot-ssl.info GPL None
jwgc-ssl.info   GPL Daniel Henninger
kdebase3-ssl.info   GPL/LGPLBenjamin Reed
kdelibs3-ssl.info   GPL/LGPLBenjamin Reed
kdenetwork3.infoGPL/LGPLBenjamin Reed
lftp-ssl.info   GPL Justin F. Hallett
libnasl3-ssl.info   GPL Corey Halpin
libnessus-ssl.info  GPL None
libnessus3-ssl.info GPL Corey Halpin
libsoup-ssl.infoGPL/LGPLThe Gnome Core Team
links-ssl.info  GPL Finlay Dobbie
lynx-ssl.info   GPL None
msmtp.info  GPL Darian Lanx
mutt-ssl.info   GPL Christian Swinehart
neon23-ssl-0.23.9-11.info   LGPLChristian Schaffner
neon24-ssl.info LGPLChristian Schaffner
openhbci.info   LGPLPeter O'Gorman
proftpd.infoGPL Justin F. Hallett
pyopenssl-py.info   LGPLDaniel Henninger
qca.infoLGPLBenjamin Reed
samba-ldap.info GPL None
samba.info  GPL None
sitecopy-ssl.info   GPL Max Horn
socat-ssl.info  GPL Chris Dolan
soup-ssl.info   GPL/LGPLNone
squid-ssl.info  GPL Benjamin Reed
stunnel4.info   GPL Thomas Diemer
sylpheed-ssl.info   GPL None
vtun.info   GPL None
wget-ssl.info   GPL Sylvain Cuaz
xchat-ssl.info  GPL Max Horn
stable/main

net/lftp.info   GPL Justin F. Hallett
stable/crypto
-
clamav.info GPL Remi Mommsen
dcgui-qt-ssl.info   GPL Hanspeter Niederstrasser
dods.info   GPL Jeffrey Whitaker
ethereal-ssl.info   GPL Max Horn
fetchmail-ssl.info  GPL Eric Knauel
gabber-ssl-0.8.7-22.infoGPL Max Horn
gnome-vfs-ssl.info  GPL/LGPLNone
gnome-vfs2-ssl.info GPL/LGPLThe Gnome Core Team
gnomemeeting.info   GPL/LGPLShawn Hsiao
irssi-ssl.info  GPL Max Horn
kdebase3-ssl.info   GPL/LGPLBenjamin Reed
kdelibs3-ssl.info   GPL/LGPLBenjamin Reed
lftp-ssl.info   GPL Justin F. Hallett
libnessus-ssl.info  GPL None
libsoup-ssl.infoGPL/LGPLThe Gnome Core Team
links-ssl.info  GPL Finlay Dobbie
lynx-ssl-2.8.4-23.info  GPL Alexander Strange
lynx-ssl.info   GPL None
mutt-ssl-1.4i-31.info   GPL Christian Swinehart
neon23-ssl-0.23.9-11.info   LGPLChristian Schaffner
neon24-ssl.info LGPLChristian Schaffner
openhbci.info   LGPLPeter O'Gorman
samba-ldap-2.2.8a-21.info   GPL None
samba.info  GPL None
sitecopy-ssl.info   GPL Max Horn
soup-ssl.info   GPL/LGPLNone
squid-ssl.info  GPL Benjamin Reed
stunnel4.info   GPL Thomas Diemer
wget-ssl.info   GPL Sylvain Cuaz
xchat-ssl.info  GPL Max Horn
dclib0-ssl and valknut-ssl have modified their licenses to allow 
linking with openssl, but valknut also has a build dep on gt3-dev, 
which is gpl'd -- probably still not compatible

I guess once we have this, for each package we'll need to:
- Notify the upstream developers that they're sitting on a time bomb. 
:-)

- Do one of the following, in order of preference:
	* Get permission from the upstream devel to link with OpenSSL
	* Link the package against OpenTLS
	* Link the package against the system OpenSSL (BuildConflict with 
Fink's version)
	* Remove the package from the bindist, possibly from unstable too.

Any other options?
To me the solution seems fairly simple: if a package has gpl (or lgpl) 
in its license field and has a builddep on fink's openssl, then it 
should no longer be included in the binary distribution, unless someone 
can establish that 

Re: [Fink-devel] the gpl and openssl

2005-03-29 Thread TheSin
lftp doesn't link to ssl
[EMAIL PROTECTED] [~]$ deplist lftp
=== (lftp) ===
Depends: expat-shlibs, gettext, libiconv, libncurses5-shlibs,  
readline5-shlibs

---
TS
http://southofheaven.org/
Chaos is the beginning and end, try dealing with the rest.
On 29-Mar-05, at 10:09 AM, Lars Rosengreen wrote:
net/lftp.info   GPL Justin F. Hallett

---
SF email is sponsored by - The IT Product Guide
Read honest  candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
http://ads.osdn.com/?ad_id=6595alloc_id=14396op=click
___
Fink-devel mailing list
Fink-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/fink-devel


Re: [Fink-devel] the gpl and openssl

2005-03-29 Thread TheSin
ahh that shouldn't be that thanks.
---
TS
http://southofheaven.org/
Chaos is the beginning and end, try dealing with the rest.
On 29-Mar-05, at 10:58 AM, Lars Rosengreen wrote:
On Mar 29, 2005, at 9:27 AM, TheSin wrote:

lftp doesn't link to ssl
Package: lftp
Version: 3.1.1
Revision: 10
###
Depends: gettext, libiconv, readline5-shlibs, libncurses5-shlibs
BuildDepends: gettext-dev, libiconv-dev, readline5, openssl097,  
libncurses5

I looked at the BuildDepends line.  Also, I forgot to mention this  
is a list of .info files, _not_ packages.


[EMAIL PROTECTED] [~]$ deplist lftp
=== (lftp) ===
Depends: expat-shlibs, gettext, libiconv, libncurses5-shlibs,  
readline5-shlibs

---
TS
http://southofheaven.org/
Chaos is the beginning and end, try dealing with the rest.
On 29-Mar-05, at 10:09 AM, Lars Rosengreen wrote:

net/lftp.info   GPL Justin F. Hallett


---
SF email is sponsored by - The IT Product Guide
Read honest  candid reviews on hundreds of IT Products from real  
users.
Discover which products truly live up to the hype. Start reading now.
http://ads.osdn.com/?ad_id=6595alloc_id=14396op=click
___
Fink-devel mailing list
Fink-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/fink-devel


--
Lars Rosengreen[EMAIL PROTECTED]http://www.margay.org/~lars

---
SF email is sponsored by - The IT Product Guide
Read honest  candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
http://ads.osdn.com/?ad_id=6595alloc_id=14396op=click
___
Fink-devel mailing list
Fink-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/fink-devel


Re: [Fink-devel] the gpl and openssl

2005-03-29 Thread Freek Dijkstra
Lars Rosengreen wrote:
To me the solution seems fairly simple: if a package has gpl (or lgpl) 
in its license field and has a builddep on fink's openssl, then it 
should no longer be included in the binary distribution, unless someone 
can establish that the upstream authors permit linking against openssl. 
Only for GPL.
There is absolutely no problem to distribute a LGPL-licensed package
which is linked to OpenSSL.
The LGPL is more like the X11-licende (aka modified BSD-license), which
is also non-restrictive. rantIf you read the FSF website, you will see 
a lot of push towards the GPL rather then the LGPL. That's pure 
politics. The GPL is actually very restrictive, and the FSF want it to 
be that way: they like that everything to use the GPL, in order to push 
free software, which can never be used in a commercial product. That 
other free licenses suffer from that is collateral damage to the FSF./rant

Regards,
Freek

---
SF email is sponsored by - The IT Product Guide
Read honest  candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
http://ads.osdn.com/?ad_id=6595alloc_id=14396op=click
___
Fink-devel mailing list
Fink-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/fink-devel


Re: [Fink-devel] the gpl and openssl

2005-03-29 Thread Lars Rosengreen
On Mar 29, 2005, at 1:41 PM, Freek Dijkstra wrote:
Lars Rosengreen wrote:
To me the solution seems fairly simple: if a package has gpl (or 
lgpl) in its license field and has a builddep on fink's openssl, then 
it should no longer be included in the binary distribution, unless 
someone can establish that the upstream authors permit linking 
against openssl.
Only for GPL.
There is absolutely no problem to distribute a LGPL-licensed package
which is linked to OpenSSL.
I'm not sure that I agree.  Section 3 of the LGPL allows you to convert 
a LGPL'd work to the full GPL.  If you link against openssl, this is no 
longer possible because the aggregate is not compatible with the GPL 
due to the openssl advertising clause.  Section 10  says you may not 
impose any further restrictions on the recipients' exercise of the 
rights granted herein.

The LGPL is more like the X11-licende (aka modified BSD-license), which
is also non-restrictive. rantIf you read the FSF website, you will 
see a lot of push towards the GPL rather then the LGPL. That's pure 
politics. The GPL is actually very restrictive, and the FSF want it to 
be that way: they like that everything to use the GPL, in order to 
push free software, which can never be used in a commercial product. 
That other free licenses suffer from that is collateral damage to the 
FSF./rant
 I personally think the MIT/BSD/X11 licenses are a lot more permissive 
in what they allow than the LGPL is.  When I first started writing open 
source software in the early 1980's, we all released our code into the 
public domain and didn't worry about all this license stuff.  Sometimes 
I miss those days ;)

-Lars
Regards,
Freek

---
SF email is sponsored by - The IT Product Guide
Read honest  candid reviews on hundreds of IT Products from real 
users.
Discover which products truly live up to the hype. Start reading now.
http://ads.osdn.com/?ad_id=6595alloc_id=14396op=click
___
Fink-devel mailing list
Fink-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/fink-devel

--
Lars Rosengreen[EMAIL PROTECTED]http://www.margay.org/~lars


smime.p7s
Description: S/MIME cryptographic signature


Re: [Fink-devel] the gpl and openssl

2005-03-28 Thread David H.
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

Daniel Macks wrote:
 On Sun, Mar 27, 2005 at 04:48:04PM -0800, Trevor Harmon wrote:
 
On Mar 27, 2005, at 6:22 AM, David H. wrote:

Yes, ignoring this bullshit licensing issue all together. Four
highly paid, very well known and rather well respected lawyers have
told me, seperately, that we should exactly do that.

I assume you're joking about the lawyer bit, 

no, I am not. That are exactly the words that they told me. The likelyhood
that we will end up in court because we violate the GPL is about 0. Not to
mention that we are not the active party in this case. The long version on
this topic is about 2 hours and a dinner worth.

but if I understand your 
point correctly, I disagree. We shouldn't take licensing issues 
lightly. It would be hypocritical to ignore licensing for .info files 
while at the same time expecting everyone to respect the license for 
Fink itself. There are enough GPL violations going on already 
(http://gpl-violations.org/) without setting bad examples.
 
 
 /me nods
 
 
In this case the GPL does not good. It is a pain in our ass requiring us to
take measures which influence the way we setup our infrastructure and the
like. That is nowhere near being fesable.

Furthermore, although I do not have four highly paid lawyers at my 
disposal, I believe the law says that only the copyright holder -- that 
is, the author of the .info file -- can choose what license his work is 
distributed under. The Fink community cannot choose for him.
 
 
 This is in agreement with other US copyright-law executive summaries
 I've read.
 
Yes, but not with European.

 In practice here, .info submissions go via SourceForge, which is
 slathered with notices that it is for open source software
 development only, and Fink is distributed under GPL. Especially by
 that latter point, it appears that anyone contributing a file to be
 part of fink would be placing that file under GPL as well.
 
Sorry, but that is downright wrong. As long as I do nto sign my right of sole
use and enjoyment over to Fink Developer Network, the copyright as well as the
licensing remains in my hands. Of course Fink may choose to reject my patch
when its licensing does not fit into a scheme we choose, but as long as that
not happens, that patch is mine to deal with and it is licensed as I find fit.
That is why all my patches would be licensed as BSD for example.

- -d

 dan
 

-BEGIN PGP SIGNATURE-
Version: GnuPG v1.3.6 (Darwin)

iD8DBQFCSAGYPMoaMn4kKR4RAheRAJ43To7CSTVsBS++hFxFQOz6PX+XTACgnL3m
oFUP0irYxexS6ensghK+tqY=
=4iG+
-END PGP SIGNATURE-


---
SF email is sponsored by - The IT Product Guide
Read honest  candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
http://ads.osdn.com/?ad_id=6595alloc_id=14396op=click
___
Fink-devel mailing list
Fink-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/fink-devel


Re: [Fink-devel] the gpl and openssl

2005-03-28 Thread Benjamin Reed
David H. wrote:
no, I am not. That are exactly the words that they told me. The likelyhood
that we will end up in court because we violate the GPL is about 0. Not to
mention that we are not the active party in this case. The long version on
this topic is about 2 hours and a dinner worth.
As the PR guy I'm amazed that that is the only concern you have.  :P
I think bucking the GPL with that kind of attitude is a bad idea.  If it 
were the 'system library' thing is a bit murky, I think it could still 
be considered such, even though we're installing an updated version in 
an alternate location that's one thing, but if it's f**k it, let them 
try to sue us that's another thing altogether.

Is it really that hard to set things that want openssl097 to Restrictive 
until we can get them either building against the system libcrypto or 
updated to use GNUTLS?  (Or confirmed to have a compatible license?)

Yes, but not with European.
And where is Fink incorporated again?
Sorry, but that is downright wrong. As long as I do nto sign my right of sole
use and enjoyment over to Fink Developer Network, the copyright as well as the
licensing remains in my hands. Of course Fink may choose to reject my patch
when its licensing does not fit into a scheme we choose, but as long as that
not happens, that patch is mine to deal with and it is licensed as I find fit.
That is why all my patches would be licensed as BSD for example.
I agree here.  I can't imagine there's such thing as implied copyright 
assignment just by uploading.  Copyright is always the creator's unless 
specifically notified.  I doubt it will be much of a big deal to contact 
all maintainers and ask them for consent to consider their .info files 
to be released under the GPL, and to put a notice up that all future 
submissions will be the same.

---
SF email is sponsored by - The IT Product Guide
Read honest  candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
http://ads.osdn.com/?ad_id=6595alloc_id=14396op=click
___
Fink-devel mailing list
Fink-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/fink-devel


Re: [Fink-devel] the gpl and openssl

2005-03-28 Thread David H.
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

Benjamin Reed wrote:
 David H. wrote:
 
 no, I am not. That are exactly the words that they told me. The
 likelyhood
 that we will end up in court because we violate the GPL is about 0.
 Not to
 mention that we are not the active party in this case. The long
 version on
 this topic is about 2 hours and a dinner worth.
 
 
 As the PR guy I'm amazed that that is the only concern you have.  :P

You know my stance on licensing very well, especially when it comes to the GPL.
 
 I think bucking the GPL with that kind of attitude is a bad idea.  If it
 were the 'system library' thing is a bit murky, I think it could still
 be considered such, even though we're installing an updated version in
 an alternate location that's one thing, but if it's f**k it, let them
 try to sue us that's another thing altogether.

If I had said that, yes indeed. What I meant to express is that we should not
waste our time adressing this issue when there are more important things to
get done. Let's take the g++ ABI changes for one thing.
And yes, I also think that we should not adopt a policy or attitude where we
try to go out of our way just because there might be legal implications.
When it comes down to hard facts, then I am more than willing to change
something, do something about a given situation. So please apologise for my
lack of emotional detachment when I said what I did.

 Is it really that hard to set things that want openssl097 to Restrictive
 until we can get them either building against the system libcrypto or
 updated to use GNUTLS?  (Or confirmed to have a compatible license?)
 
 Yes, but not with European.
 
 
 And where is Fink incorporated again?
 
That does not matter when it comes to copy right. Not at all.

 Sorry, but that is downright wrong. As long as I do nto sign my right
 of sole
 use and enjoyment over to Fink Developer Network, the copyright as
 well as the
 licensing remains in my hands. Of course Fink may choose to reject
 my patch
 when its licensing does not fit into a scheme we choose, but as long
 as that
 not happens, that patch is mine to deal with and it is licensed as I
 find fit.
 That is why all my patches would be licensed as BSD for example.
 
 
 I agree here.  I can't imagine there's such thing as implied copyright
 assignment just by uploading.
There is not. Just as the copyright is always bound to the countries copyright
where the work has been finished, or created.

  Copyright is always the creator's unless
 specifically notified.  I doubt it will be much of a big deal to contact
 all maintainers and ask them for consent to consider their .info files
 to be released under the GPL, and to put a notice up that all future
 submissions will be the same.
 
Actually I would very much enjoy it if we had a choice here between BSD ad GPL.

- -d
-BEGIN PGP SIGNATURE-
Version: GnuPG v1.3.6 (Darwin)

iD8DBQFCSB4FPMoaMn4kKR4RAsfxAKCKhKC0cVwiCjN7GV1xckPPk2ATZQCdEyqR
Lj7s+ahgp3+aNK8Jpax4098=
=su8v
-END PGP SIGNATURE-


---
SF email is sponsored by - The IT Product Guide
Read honest  candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
http://ads.osdn.com/?ad_id=6595alloc_id=14396op=click
___
Fink-devel mailing list
Fink-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/fink-devel


Re: [Fink-devel] the gpl and openssl

2005-03-28 Thread David R. Morrison
On Mar 28, 2005, at 10:08 AM, David H. wrote:
And yes, I also think that we should not adopt a policy or attitude 
where we
try to go out of our way just because there might be legal 
implications.

In this spirit, can we have our old slogan back?  Unix software for 
your Mac?  (taken down because there might be legal implications...)

  -- Dave

---
SF email is sponsored by - The IT Product Guide
Read honest  candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
http://ads.osdn.com/?ad_id=6595alloc_id=14396op=click
___
Fink-devel mailing list
Fink-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/fink-devel


Re: [Fink-devel] the gpl and openssl

2005-03-28 Thread David R. Morrison
On Mar 28, 2005, at 10:08 AM, David H. wrote:
Benjamin Reed wrote:
And where is Fink incorporated again?
That does not matter when it comes to copy right. Not at all.
Actually, what matters for copyright is the country in which the item 
was published.  If there are conflicting copyright laws, then the Bern 
convention (to which virtually all copyright-granting countries agreed) 
says that the governing law is that of the country in which the item 
was published.

I don't know how to interpret this for something which is published 
on the internet, but for something like fink, indeed the country of 
incorporation of the publishing entity would appear to be the relevant 
one.

  -- Dave

---
SF email is sponsored by - The IT Product Guide
Read honest  candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
http://ads.osdn.com/?ad_id=6595alloc_id=14396op=click
___
Fink-devel mailing list
Fink-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/fink-devel


Re: [Fink-devel] the gpl and openssl

2005-03-28 Thread David H.
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

David R. Morrison wrote:
 
 On Mar 28, 2005, at 10:08 AM, David H. wrote:
 
 And yes, I also think that we should not adopt a policy or attitude
 where we
 try to go out of our way just because there might be legal
 implications.

 
 In this spirit, can we have our old slogan back?  Unix software for
 your Mac?  (taken down because there might be legal implications...)
 
The term Unix is still a registered trademark :P

- -d
-BEGIN PGP SIGNATURE-
Version: GnuPG v1.3.6 (Darwin)

iD8DBQFCSEYKPMoaMn4kKR4RAsnhAKCVPRZWLSlLeFHNl5OjC4dbs34cYQCfYjU4
GPxtnvwdwM+HfkeIQOhaiCI=
=erJY
-END PGP SIGNATURE-


---
SF email is sponsored by - The IT Product Guide
Read honest  candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
http://ads.osdn.com/?ad_id=6595alloc_id=14396op=click
___
Fink-devel mailing list
Fink-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/fink-devel


Re: [Fink-devel] the gpl and openssl

2005-03-27 Thread David H.
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

Dave Vasilevsky wrote:
 
 On Mar 16, 2005, at 2:39 PM, Lars Rosengreen wrote:
 
 Yes, I think we do.  I'll try to construct a list of packages that may
 be affected.
 
 
 Thanks Lars.
 
 I guess once we have this, for each package we'll need to:
 
 - Notify the upstream developers that they're sitting on a time bomb. :-)
 
 - Do one of the following, in order of preference:
 * Get permission from the upstream devel to link with OpenSSL
 * Link the package against OpenTLS
 * Link the package against the system OpenSSL (BuildConflict with
 Fink's version)
 * Remove the package from the bindist, possibly from unstable too.
 
 Any other options?
 
Yes, ignoring this bullshit licensing issue all together. Four highly paid,
very well known and rather well respected lawyers have told me, seperately,
that we should exactly do that. Somehow I think that we should trust their
judgement. I know I would, but then again, that is just me.

- -d
-BEGIN PGP SIGNATURE-
Version: GnuPG v1.3.6 (Darwin)

iD8DBQFCRsGPPMoaMn4kKR4RAhdWAKCe3b/zjKprJVQ4t4Ui+u4wTntSvgCeLke1
4dXOgb5xcTfUOy1Z8hzPsD4=
=ryGd
-END PGP SIGNATURE-


---
SF email is sponsored by - The IT Product Guide
Read honest  candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
http://ads.osdn.com/?ad_id=6595alloc_id=14396op=click
___
Fink-devel mailing list
Fink-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/fink-devel


Re: [Fink-devel] the gpl and openssl

2005-03-27 Thread Chris Zubrzycki
On Mar 27, 2005, at 9:22 AM, David H. wrote:
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
Dave Vasilevsky wrote:
On Mar 16, 2005, at 2:39 PM, Lars Rosengreen wrote:

Yes, I think we do.  I'll try to construct a list of packages  
that may
be affected.


Thanks Lars.
I guess once we have this, for each package we'll need to:
- Notify the upstream developers that they're sitting on a time  
bomb. :-)

- Do one of the following, in order of preference:
* Get permission from the upstream devel to link with OpenSSL
* Link the package against OpenTLS
* Link the package against the system OpenSSL (BuildConflict with
Fink's version)
* Remove the package from the bindist, possibly from unstable  
too.

Any other options?

Yes, ignoring this bullshit licensing issue all together. Four  
highly paid,
very well known and rather well respected lawyers have told me,  
seperately,
that we should exactly do that. Somehow I think that we should  
trust their
judgement. I know I would, but then again, that is just me.
I highly agree. This is a can of legal worms and gordian knots we  
don't want to mess with. Say, for instance we license all our patches  
under the gpl. If someone wants to later add ssl to that app, they  
can't, unless they get our permission, etc. :-)

If we pretend it doesn't exist we don't have to care.  ;-)
-chris zubrzycki
- --
PGP public key: http://homepage.mac.com/beren/publickey.txt
ID: 0xA2ABC070 Fprint: 26B0 BA6B A409 FA83 42B3  1688 FBF9 8232 A2AB  
C070

A: Because it messes up the order in which people normally read text.
Q: Why is top-posting such a bad thing?
A: Top-posting.
Q: What is the most annoying thing on usenet and in e-mail?


---
SF email is sponsored by - The IT Product Guide
Read honest  candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
http://ads.osdn.com/?ad_id=6595alloc_id=14396op=click
___
Fink-devel mailing list
Fink-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/fink-devel


Re: [Fink-devel] the gpl and openssl

2005-03-27 Thread Trevor Harmon
On Mar 27, 2005, at 6:22 AM, David H. wrote:
Yes, ignoring this bullshit licensing issue all together. Four highly 
paid,
very well known and rather well respected lawyers have told me, 
seperately,
that we should exactly do that.
I assume you're joking about the lawyer bit, but if I understand your 
point correctly, I disagree. We shouldn't take licensing issues 
lightly. It would be hypocritical to ignore licensing for .info files 
while at the same time expecting everyone to respect the license for 
Fink itself. There are enough GPL violations going on already 
(http://gpl-violations.org/) without setting bad examples.

Furthermore, although I do not have four highly paid lawyers at my 
disposal, I believe the law says that only the copyright holder -- that 
is, the author of the .info file -- can choose what license his work is 
distributed under. The Fink community cannot choose for him. Now, 
realistically, I would say that all .info authors (myself included) 
don't really care about licensing and consider their work public 
domain, but that doesn't mean we are free to ignore the issue and treat 
licenses like BS, as you say.

Trevor

---
SF email is sponsored by - The IT Product Guide
Read honest  candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
http://ads.osdn.com/?ad_id=6595alloc_id=14396op=click
___
Fink-devel mailing list
Fink-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/fink-devel


Re: [Fink-devel] the gpl and openssl

2005-03-26 Thread David R. Morrison
Anthony,

Thanks very much for this very helpful message.

I'm curious of there is any difference for software released under the
LGPL instead of the GPL.  Can it legally link to openSSL?

  -- Dave


Anthony DeRobertis [EMAIL PROTECTED] wrote:

 As one of the regular participants on debian-legal, and probably one of 
 the participants in that thread, I'd like to clarify a few things:
 
  - OpenSSL is not considered 'part of the system libraries', and
thus does not fall under that excemption in the GPL.
 
 Debian can not ever use the system libraries exception. If you carefuly 
 read GPL(3), it's clear why: need not include anything that is normally 
 distributed...with the major components...of the operating 
 system...unless that component itself accompanies the executable. On a 
 Debian FTP server or cd/dvd set, everything accompanies each other. So 
 even if openssl is normally distributed with the major components of the 
 Debian OS, it doesn't matter; the executable is being distributed with 
 openssl.
 
 If you link against Apple's openssl, then Fink can probably use this 
 exception.
 
  - The FSF GPL seems to argue (in their GPL FAQ) that if a (GPL
licenced) application has specific code to interface with a
non-GPL package, then you may assume that such an exception is
implied by the authors of the code. I would then logically
conclude, that would imply those authors were at fault by just
distributing that specific code interfacing with OpenSSL. However,
I am not a lawyer, but had the impression that the legal people
did not agree with my logic here. So I gave up.
 
 There are two problems with this.
 
  1. Debian is very conservative on licensing issues. So we never
 allow this argument.
 
  2. This would really only apply if OpenSSL support was in the
 software from the start and no code has been borrowed from
 other GPL projects.
 
 If the OpenSSL code was added later then contributers before
 the addition of OpenSSL certainly can't be said to have
 intended their code to be used with gpl-incompatible OpenSSL.
 
 If the project has used GPL code from other projects then
 there is no reason to expect those authors are OK with OpenSSL
 either.
 
 
 


---
SF email is sponsored by - The IT Product Guide
Read honest  candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
http://ads.osdn.com/?ad_id=6595alloc_id=14396op=click
___
Fink-devel mailing list
Fink-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/fink-devel


Re: [Fink-devel] the gpl and openssl

2005-03-26 Thread Dave Vasilevsky
On Mar 16, 2005, at 2:39 PM, Lars Rosengreen wrote:
Yes, I think we do.  I'll try to construct a list of packages that may 
be affected.
Thanks Lars.
I guess once we have this, for each package we'll need to:
- Notify the upstream developers that they're sitting on a time bomb. 
:-)

- Do one of the following, in order of preference:
	* Get permission from the upstream devel to link with OpenSSL
	* Link the package against OpenTLS
	* Link the package against the system OpenSSL (BuildConflict with 
Fink's version)
	* Remove the package from the bindist, possibly from unstable too.

Any other options?
Dave


PGP.sig
Description: This is a digitally signed message part


Re: [Fink-devel] the gpl and openssl

2005-03-16 Thread Lars Rosengreen
On Mar 14, 2005, at 1:02 PM, David R. Morrison wrote:
Lars,
Thanks for raising this issue.  It has come up before, but it has 
perhaps
not received the attention it deserves.

My reading of the links you provided suggests that you are correct: we 
may
not link GPL'd software against fink's openssl package unless the 
license
explictly permits linking to openssl.  (In many cases, there is an
alternative -- link to the system's openssl -- although this is not 
great
because it doesn't get updated as frequently.)
I think we are ok, as long as we aren't distributing any binaries.  For 
packages in unstable, the only thing we are distributing is a recipe 
for creating a package which the user has to build from source 
themselves.  We are not actually distributing modified source or 
binaries.  The bindist may be another matter.

Do we do this in stable/crypto at all?  Did you happen to jot down the
names of the offending packages in unstable/crypto?
Yes, I think we do.  I'll try to construct a list of packages that may 
be affected.

-Lars
--
Lars Rosengreen[EMAIL PROTECTED]http://www.margay.org/~lars

---
SF email is sponsored by - The IT Product Guide
Read honest  candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
http://ads.osdn.com/?ad_id=6595alloc_id=14396op=click
___
Fink-devel mailing list
Fink-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/fink-devel


Re: [Fink-devel] the gpl and openssl

2005-03-16 Thread Anthony DeRobertis
As one of the regular participants on debian-legal, and probably one of 
the participants in that thread, I'd like to clarify a few things:

- OpenSSL is not considered 'part of the system libraries', and
  thus does not fall under that excemption in the GPL.
Debian can not ever use the system libraries exception. If you carefuly 
read GPL(3), it's clear why: need not include anything that is normally 
distributed...with the major components...of the operating 
system...unless that component itself accompanies the executable. On a 
Debian FTP server or cd/dvd set, everything accompanies each other. So 
even if openssl is normally distributed with the major components of the 
Debian OS, it doesn't matter; the executable is being distributed with 
openssl.

If you link against Apple's openssl, then Fink can probably use this 
exception.

- The FSF GPL seems to argue (in their GPL FAQ) that if a (GPL
  licenced) application has specific code to interface with a
  non-GPL package, then you may assume that such an exception is
  implied by the authors of the code. I would then logically
  conclude, that would imply those authors were at fault by just
  distributing that specific code interfacing with OpenSSL. However,
  I am not a lawyer, but had the impression that the legal people
  did not agree with my logic here. So I gave up.
There are two problems with this.
1. Debian is very conservative on licensing issues. So we never
   allow this argument.
2. This would really only apply if OpenSSL support was in the
   software from the start and no code has been borrowed from
   other GPL projects.
   If the OpenSSL code was added later then contributers before
   the addition of OpenSSL certainly can't be said to have
   intended their code to be used with gpl-incompatible OpenSSL.
   If the project has used GPL code from other projects then
   there is no reason to expect those authors are OK with OpenSSL
   either.
---
SF email is sponsored by - The IT Product Guide
Read honest  candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
http://ads.osdn.com/?ad_id=6595alloc_id=14396op=click
___
Fink-devel mailing list
Fink-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/fink-devel


Re: [Fink-devel] the gpl and openssl

2005-03-15 Thread Lars Rosengreen
On Mar 14, 2005, at 2:43 PM, Chris Zubrzycki wrote:
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
On Mar 14, 2005, at 5:09 PM, David Brown wrote:
On Mon, Mar 14, 2005 at 04:15:21PM -0500, Benjamin Reed wrote:
To me, it would seem kind of arbitrary for openssl 0.9.6 to be 
allowed,
but 0.9.7 to not be just because we're building our own copy of it.
When Apple releases some future OS release with 0.9.7 on it, is it
magically OK suddenly?
Yes.  Section 3 of the GPL:
  However, as a special exception, the source code distributed need 
not
  include anything that is normally distributed (in either source or 
binary
  form) with the major components (compiler, kernel, and so on) of the
  operating system on which the executable runs, unless that component
  itself accompanies the executable.

And it doesn't really matter what the OpenSSL intent is.  They use 
code
that is already licensed under a license with the advertising clause. 
 The
original authors are not willing to weaken that requirement, so it 
is, and
probably always will be incompatible with the GPL.
I remember this coming up before somewhere. If the orig. author adds 
openssl compatibility, there is no problem, as the author may do 
whatever he wants with his code. The problem would lie in a fork of 
GPL'd code that added ssl support via openssl.

As fink provides an update of a system library, we should not worry 
about the issue. We don't overwrite system libs as policy. Since it's 
already in os x, we're good.
It is a pretty odd update. Fink's openssl package is not available from 
Apple or endorsed by them.  Not only does it not upgrade 
/usr/lib/libssl or /usr/lib/libcryto, it doesn't touch any of the 
binaries in /bin and /usr/bin that link against these libraries.  In 
fact, it doesn't touch a single file distributed as part of OS X!  The 
only things that benefit from this update are packages included as 
part of fink, and perhaps some software a user may have compiled on 
their own.  We go out of our way to keep fink separate from the 
operating system.  I an not sure it makes sense to then turn around and 
claim we are part of the operating system when it suits our purposes.

- -chris zubrzycki
- - --
PGP public key: http://homepage.mac.com/beren/publickey.txt
ID: 0xA2ABC070
Fingerprint: 26B0 BA6B A409 FA83 42B3  1688 FBF9 8232 A2AB C070

ICBM Address: 39.795906N -75.056029W
-BEGIN PGP SIGNATURE-
Version: GnuPG v1.4.0 (Darwin)
iEYEARECAAYFAkI2E4YACgkQ+/mCMqKrwHDawgCdFHYjVuxJUCh8Jb9hbiRdp1mD
4Y0AnRUQwlCgDfPpVP/pZFTR3ouT+oJr
=VnjN
-END PGP SIGNATURE-

---
SF email is sponsored by - The IT Product Guide
Read honest  candid reviews on hundreds of IT Products from real 
users.
Discover which products truly live up to the hype. Start reading now.
http://ads.osdn.com/?ad_id=6595alloc_id=14396op=click
___
Fink-devel mailing list
Fink-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/fink-devel

--
Lars Rosengreen[EMAIL PROTECTED]http://www.margay.org/~lars


smime.p7s
Description: S/MIME cryptographic signature


Re: [Fink-devel] the gpl and openssl

2005-03-15 Thread Freek Dijkstra
Hi,
Sorry to jump in to this topic a bit late (I'm a loyal list-lurker).
About a year ago, I got annoyed by the fact that netatalk (a tool to 
provide AFP support) was not compiled with OpenSSL in the Debian 
distribution, meaning that passwords were not encrypted.

I engaged in a lenghty discussion on the debian-legal mailing list, and 
also asked the authors of the package about their opinion. Some things I 
recall about that discussion:

- You, as a person may link a GNU licensed application against
  OpenSSL (or visa versa, compile a non-GNU compatible app against
  a GNU library).
- However, you may not distribute the resulting binary, since that
  would be coverd by a single licence according to the FSF, and doing
  so would violate either the GPL or the OpenSSL licence.
- This also applies to dynamic linking, even though the resulting
  binary does not contain any bit of OpenSSL produced code (!).
- This previous statement is a controversial, and not everyone agrees
  with it. However, so far no-one is willing to go into legal battle
  over this with the FSF since if they loose, that would mean
  commercial application can easily incorporate GPL libraries,
  something the FSF sees as damaging to the open source community.
- OpenSSL is not considered 'part of the system libraries', and
  thus does not fall under that excemption in the GPL.
- The exception mentioned (like the one valknut-ssl has) is a
  good solution.
- However, such an exception to the GPL is very, very hard to later
  add. For example, the netatalk authors were most willing to add
  it, but felt they could not: they used sources from other GPL-based
  packages, and did not know anymore who contributed to that.
  Officialy, they would have to ask each and every contributer to
  agree with the change in licencing (adding the excempt). This is
  not practical.
- The FSF GPL seems to argue (in their GPL FAQ) that if a (GPL
  licenced) application has specific code to interface with a
  non-GPL package, then you may assume that such an exception is
  implied by the authors of the code. I would then logically
  conclude, that would imply those authors were at fault by just
  distributing that specific code interfacing with OpenSSL. However,
  I am not a lawyer, but had the impression that the legal people
  did not agree with my logic here. So I gave up.
- You can try to compile a package against GnuTLS instead of OpenSSL
  if you distribute it as a binary. (Note: GnuTLS is a package to
  mimick OpenSSL, but only under a different, GPL, licence.
  sarcasmSo much for the argument that Open Source prevents people
  from writing the same code twice/sarcasm).
- There is no problem if you distribute OpenSSL and a GNU-licenced
  application as source, and let the user compile it.
Kind regards,
Freek Dijkstra
---
SF email is sponsored by - The IT Product Guide
Read honest  candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
http://ads.osdn.com/?ad_id=6595alloc_id=14396op=click
___
Fink-devel mailing list
Fink-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/fink-devel


Re: [Fink-devel] the gpl and openssl

2005-03-14 Thread David H.
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
David R. Morrison wrote:
| Lars,
|
| Thanks for raising this issue.  It has come up before, but it has perhaps
| not received the attention it deserves.
|
| My reading of the links you provided suggests that you are correct: we may
| not link GPL'd software against fink's openssl package unless the license
| explictly permits linking to openssl.  (In many cases, there is an
| alternative -- link to the system's openssl -- although this is not great
| because it doesn't get updated as frequently.)
|
| Do we do this in stable/crypto at all?  Did you happen to jot down the
| names of the offending packages in unstable/crypto?
|
Personally i am _very_ unhappy with this nervousness about Licensing. the GPL
is not meant to inhibit what we are doing, nor is it meant to make our work
more complicated. This is one of the cases where I assume that it would be
correct to simply do as we wish, looking forward to whatever may come.
I will run this by our lawyers tomorrow, I think the risk is marginal compared
to tha mount of work we shall have to complete to fully comply with this.
My 2 cents.
- -d
-BEGIN PGP SIGNATURE-
Version: GnuPG v1.3.6 (Darwin)
iD8DBQFCNfzkPMoaMn4kKR4RAs6PAJ9ihHLk7A8VZ33VEc3389KrxSP5WACdHscy
fntPBFWyGTyL67oi7httYo0=
=ykNK
-END PGP SIGNATURE-
---
SF email is sponsored by - The IT Product Guide
Read honest  candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
http://ads.osdn.com/?ad_id=6595alloc_id=14396op=click
___
Fink-devel mailing list
Fink-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/fink-devel


Re: [Fink-devel] the gpl and openssl

2005-03-14 Thread Benjamin Reed
David R. Morrison wrote:

 My reading of the links you provided suggests that you are correct: we may
 not link GPL'd software against fink's openssl package unless the license
 explictly permits linking to openssl.  (In many cases, there is an
 alternative -- link to the system's openssl -- although this is not great
 because it doesn't get updated as frequently.)

To me, it would seem kind of arbitrary for openssl 0.9.6 to be allowed,
but 0.9.7 to not be just because we're building our own copy of it.
When Apple releases some future OS release with 0.9.7 on it, is it
magically OK suddenly?


---
SF email is sponsored by - The IT Product Guide
Read honest  candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
http://ads.osdn.com/?ad_id=6595alloc_id=14396op=click
___
Fink-devel mailing list
Fink-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/fink-devel


Re: [Fink-devel] the gpl and openssl

2005-03-14 Thread Daniel Macks
On Mon, Mar 14, 2005 at 10:06:44PM +0100, David H. wrote:
 
 Personally i am _very_ unhappy with this nervousness about
 Licensing. the GPL is not meant to inhibit what we are doing, nor is
 it meant to make our work more complicated. [...] I will run this by our
 lawyers tomorrow,

Would it also be good to ask OpenSSL themselves what their intent is?

Not directly related to this particular question but just wanted to
mention the existence of http://www.softwarefreedom.org/, who have
staff who are wise in the ways of open-source law and licensing.

dan

-- 
Daniel Macks
[EMAIL PROTECTED]
http://www.netspace.org/~dmacks



---
SF email is sponsored by - The IT Product Guide
Read honest  candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
http://ads.osdn.com/?ad_id=6595alloc_id=14396op=click
___
Fink-devel mailing list
Fink-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/fink-devel


Re: [Fink-devel] the gpl and openssl

2005-03-14 Thread Lars Rosengreen
On Mar 14, 2005, at 1:02 PM, David R. Morrison wrote:
Lars,
Thanks for raising this issue.  It has come up before, but it has 
perhaps
not received the attention it deserves.

My reading of the links you provided suggests that you are correct: we 
may
not link GPL'd software against fink's openssl package unless the 
license
explictly permits linking to openssl.  (In many cases, there is an
alternative -- link to the system's openssl -- although this is not 
great
because it doesn't get updated as frequently.)

Do we do this in stable/crypto at all?  Did you happen to jot down the
names of the offending packages in unstable/crypto?
It would be a long list!  Some examples that I found are xchat-ssl, 
wget-ssl, valknut-ssl, sylpheed-ssl, stunnel4, squid-ssl, socat-ssl, 
and sitecopy-ssl.  I assume the same packages in stable would also be 
affected if indeed this is a problem.  I realize licensing issue are a 
headache, and I am sorry for bringing this up, I just would like to do 
the right thing.  ...so would linking against the system's libssl be ok 
as far as fink's policies are concerned?

  Thanks,
  Dave
To: fink-devel@lists.sourceforge.net
From: Lars Rosengreen [EMAIL PROTECTED]
Subject: [Fink-devel] the gpl and openssl
Date: Mon, 14 Mar 2005 12:32:09 -0800
I would like to figure out if it is ok for me to create a gpl'd package
that links against fink's libssl.  Looking in unstable/crypto, it looks
like there are several packages that do this, yet I have read elsewhere
that doing so violates the gpl because openssl's license is not
compatible with the gpl.  The gpl has an exemption for libraries that
are distributed with the operating system, but I'm not sure if that
would also cover fink's openssl package.  Some enlightenment would be
much appreciated :)
http://www.gnome.org/~markmc/openssl-and-the-gpl.html
http://www.fsf.org/licensing/licenses/gpl-faq.html#GPLIncompatibleLibs
http://www.openssl.org/support/faq.html#LEGAL2
thanks,
-Lars


--
Lars Rosengreen[EMAIL PROTECTED]http://www.margay.org/~lars


smime.p7s
Description: S/MIME cryptographic signature


Re: [Fink-devel] the gpl and openssl

2005-03-14 Thread David Brown
On Mon, Mar 14, 2005 at 04:15:21PM -0500, Benjamin Reed wrote:

 To me, it would seem kind of arbitrary for openssl 0.9.6 to be allowed,
 but 0.9.7 to not be just because we're building our own copy of it.
 When Apple releases some future OS release with 0.9.7 on it, is it
 magically OK suddenly?

Yes.  Section 3 of the GPL:

  However, as a special exception, the source code distributed need not
  include anything that is normally distributed (in either source or binary
  form) with the major components (compiler, kernel, and so on) of the
  operating system on which the executable runs, unless that component
  itself accompanies the executable.

And it doesn't really matter what the OpenSSL intent is.  They use code
that is already licensed under a license with the advertising clause.  The
original authors are not willing to weaken that requirement, so it is, and
probably always will be incompatible with the GPL.

Dave


---
SF email is sponsored by - The IT Product Guide
Read honest  candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
http://ads.osdn.com/?ad_id=6595alloc_id=14396op=click
___
Fink-devel mailing list
Fink-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/fink-devel


Re: [Fink-devel] the gpl and openssl

2005-03-14 Thread Hanspeter Niederstrasser
Lars Rosengreen wrote:
On Mar 14, 2005, at 1:02 PM, David R. Morrison wrote:
Do we do this in stable/crypto at all?  Did you happen to jot down the
names of the offending packages in unstable/crypto?
It would be a long list!  Some examples that I found are xchat-ssl, 
wget-ssl, valknut-ssl, sylpheed-ssl, stunnel4, squid-ssl, socat-ssl, and 
sitecopy-ssl.
Note that valknut-ssl has a special exception in its license file 
followed by GPL v2:

blockquote
In addition, as a special exception, Mathias Küster give
permission to link the code of this program with the OpenSSL
library (or with modified versions of OpenSSL that use the
same license as OpenSSL), and distribute linked combinations
including the two.  You must obey the GNU General Public License
in all respects for all of the code used other than OpenSSL.
/blockquote
xchat-ssl does not have a similar exception listed.  So if any action is 
taken on this issue, it will have to be done on a case by case basis.

Hanspeter
--
Hanspeter Niederstrasser, Ph.D.Dept. of Cell Biology
hniederstrasser at cellbiology.wustl.edu   Campus Box 8228
Cooper Lab 660 South Euclid Avenue
Washington University in St. Louis St. Louis, MO 63110
---
SF email is sponsored by - The IT Product Guide
Read honest  candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
http://ads.osdn.com/?ad_id=6595alloc_id=14396op=click
___
Fink-devel mailing list
Fink-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/fink-devel


Re: [Fink-devel] the gpl and openssl

2005-03-14 Thread Chris Zubrzycki
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
On Mar 14, 2005, at 5:09 PM, David Brown wrote:
On Mon, Mar 14, 2005 at 04:15:21PM -0500, Benjamin Reed wrote:
To me, it would seem kind of arbitrary for openssl 0.9.6 to be 
allowed,
but 0.9.7 to not be just because we're building our own copy of it.
When Apple releases some future OS release with 0.9.7 on it, is it
magically OK suddenly?
Yes.  Section 3 of the GPL:
  However, as a special exception, the source code distributed need 
not
  include anything that is normally distributed (in either source or 
binary
  form) with the major components (compiler, kernel, and so on) of the
  operating system on which the executable runs, unless that component
  itself accompanies the executable.

And it doesn't really matter what the OpenSSL intent is.  They use code
that is already licensed under a license with the advertising clause.  
The
original authors are not willing to weaken that requirement, so it is, 
and
probably always will be incompatible with the GPL.
I remember this coming up before somewhere. If the orig. author adds 
openssl compatibility, there is no problem, as the author may do 
whatever he wants with his code. The problem would lie in a fork of 
GPL'd code that added ssl support via openssl.

As fink provides an update of a system library, we should not worry 
about the issue. We don't overwrite system libs as policy. Since it's 
already in os x, we're good.

- -chris zubrzycki
- - --
PGP public key: http://homepage.mac.com/beren/publickey.txt
ID: 0xA2ABC070
Fingerprint: 26B0 BA6B A409 FA83 42B3  1688 FBF9 8232 A2AB C070

ICBM Address: 39.795906N -75.056029W
-BEGIN PGP SIGNATURE-
Version: GnuPG v1.4.0 (Darwin)
iEYEARECAAYFAkI2E4YACgkQ+/mCMqKrwHDawgCdFHYjVuxJUCh8Jb9hbiRdp1mD
4Y0AnRUQwlCgDfPpVP/pZFTR3ouT+oJr
=VnjN
-END PGP SIGNATURE-

---
SF email is sponsored by - The IT Product Guide
Read honest  candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
http://ads.osdn.com/?ad_id=6595alloc_id=14396op=click
___
Fink-devel mailing list
Fink-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/fink-devel