From mboxrd@z Thu Jan 1 00:00:00 1970 From: Alex Vong Subject: Re: octave license is incompatible with openssl Date: Wed, 10 Aug 2016 14:43:57 +0800 Message-ID: <87k2fpktsi.fsf@gmail.com> References: <87h9b0ij9x.fsf@gmail.com> <87wpjvhfpg.fsf@elephly.net> <87eg62d5p4.fsf@gmail.com> <20160808200018.GA20179@jasmine> <871t1yvsn8.fsf@gmail.com> <20160809172728.b6wijrzccd5wdv37@galago.mtmxr.com> Mime-Version: 1.0 Content-Type: text/plain Return-path: Received: from eggs.gnu.org ([2001:4830:134:3::10]:40559) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bXNFN-00059w-V7 for guix-devel@gnu.org; Wed, 10 Aug 2016 02:44:15 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1bXNFI-0006LR-6i for guix-devel@gnu.org; Wed, 10 Aug 2016 02:44:12 -0400 In-Reply-To: <20160809172728.b6wijrzccd5wdv37@galago.mtmxr.com> (Mike Miller's message of "Tue, 9 Aug 2016 10:27:28 -0700") List-Id: "Development of GNU Guix and the GNU System distribution." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org Sender: "Guix-devel" To: Mike Miller Cc: guix-devel@gnu.org, help-octave@gnu.org Mike Miller writes: > On Wed, Aug 10, 2016 at 00:00:59 +0800, Alex Vong wrote: >> Hi octave devs, >> >> During a look of the octave package in guix (a functional package >> manager, part of gnu), we notice octave have an optional dependency on >> openssl. >> >> However, since the license of octave (gpl3+) is incompatible >> with that of openssl >> (https://people.gnome.org/~markmc/openssl-and-the-gpl.html), the >> resulting binary after linking is not re-distributable. > > Agreed. > >> So, we drop the optional dependency to avoid the problem. > > Precisely what is the optional dependency that is dropped? > > Octave does not directly link with OpenSSL nor use any OpenSSL > functions. The Octave package on Debian builds with all optional > dependencies enabled, and the resulting binary is linked with GnuTLS. > I thought it was an optional dependency because when I run `./configure --help', it contains the following help: --with-openssl use libcrypto hash routines. Valid ARGs are: 'yes', 'no', 'auto' => use if available, 'optional' => use if available and warn if not available; default is 'no' Perhaps someone unaware of the issue adds this? Should I open a bug report on this? >> Is there any plan to fix this problem? There are some solutions we think >> of: 1. add openssl linking exception to the license 2. provide support >> for linking with gnutls as an alternative. In any case, I think we >> should warn the user about it. >> >> What are your ideas? (the messages below include the whole discussion on >> the guix-devel mailing list) > > The Octave Guix package may be indirectly linking with OpenSSL through a > direct dependency such as libcurl. I would recommend that you use a > libcurl that is built against GnuTLS as we do on Debian. > Indeed, the Debian package does not depend on openssl. > AFAICS, nothing needs to be fixed in Octave. > > HTH, Thanks, Alex