GPL-3 vs. OpenSSL [licensing conflict] about qtbitcointrader

[JulyIghor]

Hi. Can you please send me example of license exception to use OpenSSL?

[thewizzy]

Shouldn't matter if its not statically linked and isn't a derived work.

On Thu, Jul 4, 2013 at 5:48 PM, IGHOR [email protected] wrote:

Hi. Can you please send me example of license exception to use OpenSSL?

—
Reply to this email directly or view it on GitHubhttps://github.com//issues/27#issuecomment-20463493
.

[onlyjob]

The following text of exception is recommended by debian-legal:

In addition, as a special exception, the copyright holders give
permission to link the code of portions of this program with the
OpenSSL library under certain conditions as described in each
individual source file, and distribute linked combinations including
the two.
.
You must obey the GNU General Public License in all respects for all
of the code used other than OpenSSL. If you modify file(s) with this
exception, you may extend this exception to your version of the
file(s), but you are not obligated to do so. If you do not wish to do
so, delete this exception statement from your version. If you delete
this exception statement from all source files in the program, then
also delete it here.

It was taken from
http://www.debian.org/doc/packaging-manuals/copyright-format/1.0/

I hope these links will provide the information you seek:

• https://lists.debian.org/debian-legal/2004/05/msg00595.html
• http://stackoverflow.com/questions/1156556/how-do-i-write-an-exception-under-section-7-of-the-gplv3
• https://en.wikipedia.org/wiki/GPL_linking_exception
• https://jira.mongodb.org/browse/SERVER-8886
• https://people.gnome.org/~markmc/openssl-and-the-gpl.html

courier-ssl have the following text:

This software is released under the GPL, version 3 (see COPYING.GPL).
Additionally, compiling, linking, and/or using the OpenSSL toolkit in
conjunction with this software is allowed.

[onlyjob]

@thewizzy: It does matter. Debian does not allow GPL-licensed code (dynamically) linked with OpenSSL libraries unless there is a license exception explicitly permitting this.

[JulyIghor]

I mast just add this lines to every source code file?

Additionally, compiling, linking, and/or using the OpenSSL toolkit in
conjunction with this software is allowed.

[onlyjob]

I've just noticed that file "src/LICENSE.GPL3" contains not a GPL-3 license but a LGPL-3 (GNU LESSER GENERAL PUBLIC LICENSE) which do not have a conflict with OpenSSL license. If you meant to use LGPL-3 for QtBitcoinTrader than fixing this would be just a matter of changing headers.

[rzhv]

Abandoning GPL (even for LGPL) due to such a minor formality is NOT a good idea!

@onlyjob : "Debian does not allow GPL-licensed code (dynamically) linked with OpenSSL libraries unless there is a license exception explicitly permitting this."

Well, the stuff made by the Debian project is meant for distributing with Debian OS, directly or indirectly (repos). Which means that GPL program and the GPL incompatible library are shipped as part of the OS, which in its turn violates the GPL clause "unless that component itself accompanies the executable" (https://people.gnome.org/~markmc/openssl-and-the-gpl.html), hence the need for a special OpenSSL exception by Debian.

But, I guess, as long as QtBitcoinTrader is not meant for shipping with any OS (at least, not yet ;), neither it is included in any official repos, and as long as QtBitcoinTrader is not distributed together with the OpenSSL by the author, then QtBitcoinTrader can benefit from the special exception for linking against GPL-incompatible SYSTEM libraries outlined in GPL v.3 (see "GPL program + PROPRIETARY library?" at http://blog.milkingthegnu.org/2008/04/gpl-for-dummies.html), considering OpenSSL being a SYTEM library for the users participating in the distribution.

@onlyjob : "I hope these links will provide the information you seek: https://en.wikipedia.org/wiki/GPL_linking_exception"
This wikipedia article speaks about exceptions when linking TO Gpl-licensed code FROM GPL-incompatible code. But with QtBitcoinTrader there is an opposite kind of linking: TO Gpl-incompatible code FROM Gpl-licensed code (QtBitcoinTrader). These are two DIFFERENT kinds of linking which have their own limitations, described in the GPL license. I am afraid @onlyjob is confusing things here.

However, as an additional precaution measure, the author might consider adding an OpenSSL exemption to every source code file, like it is shown here https://lists.debian.org/debian-legal/2004/05/msg00595.html. This should be enough to address the licensing issue.

NOTE: It is better to include such an OpenSSL exception (or replace OpenSSL with GnuTls, etc.) as soon as possible to avoid the need to ask other potential contributors for their written permission to add the exception!

LGPL is recommended for libraries by FSF. QtBitcoinTrader is not a library, but a full-fledged application.
However, a part of QtBitcoinTrader uses OpenSSL for inter-working with APIs provided by various exchanges. I guess, in the future this part could itself be isolated as a separate Qt/C++ library, which other projects could benefit from and improve upon. I saw quite a few API wrappers written in Python/PHP/Ruby, but there is no good Qt/C++ API wrapper out there to work with multiple exchanges MtGox/Bitstamp/Btc-e/BtcChina/etc., IMHO. Using LGPL exclusively for the library, but not for the entire application, would then make sense. If the author wishes to make the application completely free by using GPL, then the rest of the application code should include GPL headers, as it does now.

P.S. Of course, if there is an intention to use QtBitcoinTrader's code in proprietary software, then LGPL is a way to go, provided that modifications are released under the LGPL, even though the rest of the software can remain closed source. Btw, is it something that @onlyjob is in favor of, hence the the pull request with LGPL headers? ;)

[onlyjob]

@rzhv: First of all formality is not that little. LGPL is the appropriate license to avoid conflict with OpenSSL. MIT or BSD licenses could be used as well as GPL-3 + exception which is slightly more difficult to apply. Clearly you did not read comment to my pull request. I assume the least error (i.e. that the author incorrectly reference to chosen license by not using word "Lesser") and follow the actual text of the license which is LGPL. It could be that author actually meant to use GPL but mistakenly took the wrong license text but in this case I hope he will leave relevant comment regarding his intentions in pull request.

Even immature software can be useful for Debian users even if we don't ship it while it staged in "unstable".

@rzhv, please think about linking in terms of "linking with" in which case you won't be confused by linking direction.

I agree that it would be nice to use GnuTLS instead of OpenSSL to avoid licensing problem.

P.S. I have no other agenda than to help making QtBitcoinTrader available to Debian users.

[JulyIghor]

onlyjob, sorry for my bad English. Thats why I don't fixed it yet.
Can you send me fix, or what exactly I need to change in license file?

[onlyjob]

@JulyIghor: No worries, please review my pull request #118. I assumed that your license of choice is LGPL-3+ (according to license text) so I just consistently applied this license in headers. If you actually meant to use GPL-3+ instead of LGPL-3+ then pull request would have to be updated and OpenSSL liking exception added. Thank you.

[rzhv]

@onlyjob : "@rzhv, please think about linking in terms of "linking with" in which case you won't be confused by linking direction."
Direction does matter. Given code that is licensed under GPL3 with no exceptions, you still can link FROM it TO proprietary library under certain circumstances (http://www.gnu.org/licenses/gpl-faq.html#SystemLibraryException), but under no circumstances can you link FROM proprietary code TO Gpl-licensed library. There are other differences implied by the GPL-style licenses depending on how you link.

@onlyjob : "P.S. I have no other agenda than to help making QtBitcoinTrader available to Debian users."
I truly respect your intention, as I myself would like to see this wonderful project being available in major OSs via the standard packaging system. But let's do it properly: before making a huge pull request that touches the license in 90+ files, please explicitely ask the author if he really wants it done this way and get a definite answer from him first. And better make sure that the author understands the legal side of it.