After an evaluation, GNOME has moved from Bugzilla to GitLab. Learn more about GitLab.
No new issues can be reported in GNOME Bugzilla anymore.
To report an issue in a GNOME project, go to GNOME GitLab.
Do not go to GNOME Gitlab for: Bluefish, Doxygen, GnuCash, GStreamer, java-gnome, LDTP, NetworkManager, Tomboy.
Bug 704503 - Reconsider glib-networking dependency on gnutls 3.0
Reconsider glib-networking dependency on gnutls 3.0
Status: RESOLVED FIXED
Product: glib
Classification: Platform
Component: network
unspecified
Other Linux
: Normal critical
: ---
Assigned To: gtkdev
gtkdev
Depends on:
Blocks:
 
 
Reported: 2013-07-18 21:02 UTC by Jeremy Bicha
Modified: 2013-07-22 13:04 UTC
See Also:
GNOME target: ---
GNOME version: ---



Description Jeremy Bicha 2013-07-18 21:02:23 UTC
According to Debian, programs must be licensed under a LGPLv3 license to link against gnutls 3.0 [1]. I don't think a licensing change was intended by
https://git.gnome.org/browse/glib-networking/commit/?id=71e00c

Please strongly consider reverting as this change causes similar problems for any libraries that build against glib-networking (like libsoup and packages that build against it).

[1] http://ftp-master.metadata.debian.org/changelogs/main/g/gnutls28/unstable_copyright
Comment 1 Jeremy Bicha 2013-07-18 21:05:36 UTC
*LGPLv3-compatible license to link...
Comment 2 Colin Walters 2013-07-18 21:17:15 UTC
Hm, yes, that is really messy, because most of the rest of the GNOME world is LGPLv2+, including several of my apps which use libsoup.
Comment 3 Emmanuele Bassi (:ebassi) 2013-07-19 09:34:50 UTC
we probably want to get some sort of legal opinion, here.
Comment 4 Dan Winship 2013-07-19 11:50:18 UTC
Ugh. OK, gnutls itself is LGPLv2+, but it pulls in gmp, which is LGPLv3+.

According to http://www.gnu.org/licenses/gpl-faq.html#AllCompatibility, we can link it into LGPLv2 or GPLv3 code, and can link it into GPLv2+ code by treating the GPLv2+ as GPLv3. The only thing it's completely incompatible with is GPLv2-only.

Now that evo has been relicensed, is there any GPLv2-only code left around in GNOME?
Comment 5 Dan Winship 2013-07-19 13:46:27 UTC
(In reply to comment #0)
> Please strongly consider reverting as this change causes similar problems for
> any libraries that build against glib-networking

To be precise, nothing actually builds against glib-networking. It is always dlopened, and the API used to communicate with it is not based on gnutls, and there have always been plans to add another backend as well (https://git.gnome.org/browse/glib-networking/log/?h=wip/nss). So that means... something.
Comment 6 Colin Walters 2013-07-19 14:56:35 UTC
(In reply to comment #4)
> The only thing it's completely incompatible with is
> GPLv2-only.

The LGPLv3 comes with some benefits too, like the ability to link with Apache 2.0.

> Now that evo has been relicensed, is there any GPLv2-only code left around in
> GNOME?

However...the reverse dependency set for libsoup is quite large.  On Fedora 19 for example, just do:

$ repoquery --whatrequires libsoup

In there of course is large libraries like webkitgtk3.  But looking at that list, one item popped up that I recognized: subsurface, Linus' toy diving app.

And you know the kernel bearing his name is the most famous example of a GPLv2 only codebase...so I was not at all surprised to see that the Fedora specfile says:

License: GPLv2

(without a +).  A look at the source code seems to confirm that.

There has to be a good tool out there to blend repoquery --recursive with license query...
Comment 7 Dan Winship 2013-07-19 15:16:15 UTC
(In reply to comment #6)
> There has to be a good tool out there to blend repoquery --recursive with
> license query...

repoquery --qf '%{name}: %{license}' --whatrequires libsoup
Comment 8 Emmanuele Bassi (:ebassi) 2013-07-19 15:57:20 UTC
not that I care that much, but subsurface was rewritten using Qt, so I don't think it links to libsoup any more.
Comment 9 Dan Winship 2013-07-22 13:04:45 UTC
glib-networking now only requires 2.12.8 (which still has enough new
API to make the earlier "Fix deprecation warnings" commit work).
However, 2.12 support is not likely to get tested, and some new
features (eg, DTLS) will be 3.x-only.