Skip to content

The OpenSSL / GPL Debate

GNOME has a good page describing some of the concerns with linking GPL’ed software against the OpenSSL libraries.

Debian believes that as long as OpenSSL and the GPL’ed software are delivered on the same medium or in the same distribution, the GPL’s ‘accompanying clause’ is invoked:

There is some disagreement about what this exception means when the both the GPL program and the GPL incompatible library are shipped as part of the operating system. The “unless that component itself accompanies the executable” clause suggests that the special exception does not cover this case and that it is a violation of the GPL. Debian takes this position on the issue.

There are three reasons I think this is an incorrect interpretation.
* First, the likely scenario envisioned in the GPL is the distribution of a program, by its authors, with another product bundled with it. This is very common, actually, for commercial code and it would be a way to achieve an end-run around the GPL in open-source. A distribution aggregating disparate authors’ work isn’t an attempt at an end-run around the GPL, so the purpose of the accompanying clause isn’t achieved.
* Second, making a distinction between physical media and the Internet has never been an essential part of the GPL (nor should it be), yet a distribution or metadistribution that references an Internet source for OpenSSL rather than including the bits on the media would satisfy the incorrect interpretation of the accompanying clause, but would not benefit the GPL or Free Software in any way. So, this interpretation fails a practical usefulness test.
* Third, and perhaps most importantly, so much of a typical distribution falls outside the purview of the GPL that it’s not sensible to try to apply the terms of a GPL on the scale of a distribution. The GPL is intended, and terribly useful for, software packages that are discrete in their purpose and construction, and its language is properly interpreted in that context. By making broader claims about its reach, the GPL itself stands to be weakened, for if one license can enforce terms on another by mere aggregation the entire concept of licensing fails to be coherent. Only by saying, “The GPL applies to this distro,” can one make the incorrect claim, and so that argument fails a test of common sense.