lftp: linked against libssl

[Debian Bug Importer]

Automatically imported from Debian bug report #305160 http://bugs.debian.org/305160

[Noël Köthe (noel)]

Am Montag, den 18.04.2005, 12:42 +0200 schrieb Bartosz Fenski aka fEnIo:

Hello Bartosz,

> lftp seems to be linked with OpenSSL library being at the same time GPLed.
>
> These are not compatible licenses and you should either use some GPLed
> crypto library or ask authors to add exception about OpenSSL.

Yes you are right. I will talk with the author about the exception which
I forgot.

--
Noèl Köthe <noel debian.org>

[Debian Bug Importer (debzilla)]

Automatically imported from Debian bug report #305160 http://bugs.debian.org/305160

[Debian Bug Importer (debzilla)]

Message-Id: <email address hidden>
Date: Mon, 18 Apr 2005 12:42:21 +0200
From: Bartosz Fenski aka fEnIo <email address hidden>
To: Debian Bug Tracking System <email address hidden>
Subject: lftp: linked against libssl

Package: lftp
Version: 3.1.2-1
Severity: serious
Justification: unknown

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hello.

lftp seems to be linked with OpenSSL library being at the same time GPLed.

These are not compatible licenses and you should either use some GPLed
crypto library or ask authors to add exception about OpenSSL.

More details can be found at:
http://www.gnome.org/~markmc/openssl-and-the-gpl.html

regards
fenIo

- -- System Information:
Debian Release: 3.1
  APT prefers unstable
  APT policy: (500, 'unstable'), (1, 'experimental')
Architecture: i386 (i686)
Kernel: Linux 2.4.27-2-686
Locale: LANG=pl_PL, LC_CTYPE=pl_PL (charmap=ISO-8859-2)

Versions of packages lftp depends on:
ii libc6 2.3.2.ds1-21 GNU C Library: Shared libraries an
ii libexpat1 1.95.8-1 XML parsing C library - runtime li
ii libgcc1 1:3.4.3-12 GCC support library
ii libncurses5 5.4-4 Shared libraries for terminal hand
ii libreadline4 4.3-15 GNU readline and history libraries
ii libssl0.9.7 0.9.7e-3 SSL shared libraries
ii netbase 4.21 Basic TCP/IP networking system

- -- no debconf information

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.0 (GNU/Linux)

iD8DBQFCY48NhQui3hP+/EARAp32AKC7ZSunM/7EtOxsbD3weooJm7VD/ACfQCAk
NXKgfqxIi4uI9xnIP2/ieZc=
=X87E
-----END PGP SIGNATURE-----

[Debian Bug Importer (debzilla)]

Message-Id: <email address hidden>
Date: Mon, 18 Apr 2005 21:42:53 +0200
From: =?ISO-8859-1?Q?No=E8l_K=F6the?= <email address hidden>
To: <email address hidden>,
 Bartosz Fenski aka fEnIo <email address hidden>
Subject: Re: Bug#305160: lftp: linked against libssl

--=-jZXRDzNUE7/XvKk4Ytsk
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

Am Montag, den 18.04.2005, 12:42 +0200 schrieb Bartosz Fenski aka fEnIo:

Hello Bartosz,

> lftp seems to be linked with OpenSSL library being at the same time GPLed=
.
>=20
> These are not compatible licenses and you should either use some GPLed
> crypto library or ask authors to add exception about OpenSSL.

Yes you are right. I will talk with the author about the exception which
I forgot.

--=20
No=C3=A8l K=C3=B6the <noel debian.org>

--=-jZXRDzNUE7/XvKk4Ytsk
Content-Type: application/pgp-signature; name=signature.asc
Content-Description: This is a digitally signed message part

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.0 (GNU/Linux)

iD8DBQBCZA299/DnDzB9Vu0RAmrYAJ95+3VfC8coS4NxVTw0bYYYFX+qYQCfcSyc
xwtQh4/C08N1VSv8pmPY7vQ=
=wik/
-----END PGP SIGNATURE-----

--=-jZXRDzNUE7/XvKk4Ytsk--

[Noël Köthe (noel)]

tags 305160 + upstream confirmed
forwarded 305160 http://www.mail-archive.com/lftp%40uniyar.ac.ru/msg02012.html
thanks

Am Montag, den 18.04.2005, 12:42 +0200 schrieb Bartosz Fenski aka fEnIo:
> Package: lftp
> Version: 3.1.2-1
> Severity: serious
> Justification: unknown
>
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Hello.
>
> lftp seems to be linked with OpenSSL library being at the same time GPLed.

--
Noèl Köthe <noel debian.org>
Debian GNU/Linux, www.debian.org

[Noël Köthe (noel)]

Source: lftp
Source-Version: 3.1.3-1

We believe that the bug you reported is fixed in the latest version of
lftp, which is due to be installed in the Debian FTP archive:

lftp_3.1.3-1.diff.gz
  to pool/main/l/lftp/lftp_3.1.3-1.diff.gz
lftp_3.1.3-1.dsc
  to pool/main/l/lftp/lftp_3.1.3-1.dsc
lftp_3.1.3-1_i386.deb
  to pool/main/l/lftp/lftp_3.1.3-1_i386.deb
lftp_3.1.3.orig.tar.gz
  to pool/main/l/lftp/lftp_3.1.3.orig.tar.gz

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to <email address hidden>,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Noèl Köthe <email address hidden> (supplier of updated lftp package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing <email address hidden>)

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.7
Date: Thu, 28 Apr 2005 18:11:59 +0200
Source: lftp
Binary: lftp
Architecture: source i386
Version: 3.1.3-1
Distribution: unstable
Urgency: medium
Maintainer: Noèl Köthe <email address hidden>
Changed-By: Noèl Köthe <email address hidden>
Description:
 lftp - Sophisticated command-line FTP/HTTP client programs
Closes: 305160
Changes:
 lftp (3.1.3-1) unstable; urgency=medium
 .
   * new upstream from 2005-04-15
   * disabled ssl support because of license problem. See:
     http://bugs.debian.org/305160
     http://www.mail-archive.com/lftp%40uniyar.ac.ru/msg02012.html
     http://www.openssl.org/support/faq.html#LEGAL2
     http://www.gnome.org/~markmc/openssl-and-the-gpl.html
     If the author add the needed exception to allow to link
     against openssl it will be enabled again.
     Better a lftp without ssl than no lftp in sarge.
     (closes: Bug#305160)
Files:
 8312cfef4e1b21ea083ee658d395dd95 598 net optional lftp_3.1.3-1.dsc
 ad35c121c456be9f0796f84075dda9f2 1675312 net optional lftp_3.1.3.orig.tar.gz
 375d01328a87cea02031b74af05db49c 9837 net optional lftp_3.1.3-1.diff.gz
 236c5045f57c985874754e718c0472ca 532044 net optional lftp_3.1.3-1_i386.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.0 (GNU/Linux)

iD8DBQFCcNPd9/DnDzB9Vu0RAv9lAJwJgcaaeR5GtKk7hxG6nm2zWZ0oQwCfXlaH
ae5fNZo4mQ/YT8avI8TqfCc=
=P1ny
-----END PGP SIGNATURE-----

[Guillaume Morin (gmorin)]

SSL support was removed in the previous lftp version, because of a
license problem with openssl.

But at the end of the README of lftp the author says explicitly :

"In addition, as a special exception, permission is given to link the
code of this release of lftp with the OpenSSL project's "OpenSSL"
library (or with modified versions of it that use the same license as
the "OpenSSL" library), and distribute the linked executables. You
must obey the GNU General Public License in all respects for all of
the code used other than "OpenSSL". If you modify this file, you may
extend this exception to your version of the file, but you are not
obligated to do so. If you do not wish to do so, delete this exception
statement from your version."

The maintainer of msmtp keeps the ssl support (Bug #305159), he just
includes proper information in /usr/share/doc/<package>/copyright.

Could you please re-enable ssl support in lftp ?

Is this bug the reason why lftp was removed from sarge ?

Regards,

Guillaume Morin

[Noël Köthe (noel)]

Am Samstag, den 14.05.2005, 10:39 +0000 schrieb Guillaume Morin:
> SSL support was removed in the previous lftp version, because of a
> license problem with openssl.

Yes. This is right.

> But at the end of the README of lftp the author says explicitly :
>
> "In addition, as a special exception, permission is given to link the
> code of this release of lftp with the OpenSSL project's "OpenSSL"
> library (or with modified versions of it that use the same license as
> the "OpenSSL" library), and distribute the linked executables. You
> must obey the GNU General Public License in all respects for all of
> the code used other than "OpenSSL". If you modify this file, you may
> extend this exception to your version of the file, but you are not
> obligated to do so. If you do not wish to do so, delete this exception
> statement from your version."

Hmm, I'm confused. Its not included in the COPYING file and upstream
answered me he could not include it:

http://www.mail-archive.com/lftp%40uniyar.ac.ru/msg02022.html

> The maintainer of msmtp keeps the ssl support (Bug #305159), he just
> includes proper information in /usr/share/doc/<package>/copyright.
>
> Could you please re-enable ssl support in lftp ?

I cann and will reenable it if the license question is clear.

> Is this bug the reason why lftp was removed from sarge ?

Yes.

--
Noèl Köthe <noel debian.org>

[Matt Zimmerman (mdz)]

lftp (3.1.3-1) unstable; urgency=medium
 .
   * new upstream from 2005-04-15
   * disabled ssl support because of license problem. See:
     http://bugs.debian.org/305160
     http://www.mail-archive.com/lftp%40uniyar.ac.ru/msg02012.html
     http://www.openssl.org/support/faq.html#LEGAL2
     http://www.gnome.org/~markmc/openssl-and-the-gpl.html
     If the author add the needed exception to allow to link
     against openssl it will be enabled again.
     Better a lftp without ssl than no lftp in sarge.
     (closes: Bug#305160)
      lftp | 3.2.1-1 | http://us.archive.ubuntu.com breezy/main Packages