17

I've decided to license some code I have yet to release under the GPL v3. However, OpenSSL is used quite a bit in the software and I know that the two licenses are explicitly cited as being incompatible.

I wanted to stay with my decision to go GPL but without having to refactor years of work to use something like GNU TLS instead. Doing some searching, I've found that people have combined openSSL into GPL works while adding an "openSSL exception". Deluge is one such example. Excerpt from the Deluge License:

Deluge is licensed under the GNU General Public License version 3 with the addition of the following special exception:

In addition, as a special exception, the copyright holders give permission to link the code of portions of this program with the OpenSSL library. You must obey the GNU General Public License in all respects for all of the code used other than OpenSSL. If you modify file(s) with this exception, you may extend this exception to your version of the file(s), but you are not obligated to do so. If you do not wish to do so, delete this exception statement from your version. If you delete this exception statement from all source files in the program, then also delete it here.

What are are the ramifications of this exception? Does it actually "work"? If the two licenses are deemed incompatible, can such an exception really make them compatible?

Edit:
More references to this practice:

http://curl.haxx.se/legal/licmix.html

(May be used for SSL/TLS support) Uses an Original BSD-style license with an announcement clause that makes it "incompatible" with GPL. You are not allowed to ship binaries that link with OpenSSL that includes GPL code (unless that specific GPL code includes an exception for OpenSSL - a habit that is growing more and more common). If OpenSSL's licensing is a problem for you, consider using another TLS library.

From the Fedora Project FAQ:

These two clauses are restrictions that aren't present in the GPL and therefore are incompatible with the portion of the GPL that says "You may not impose any further restrictions on the recipients' exercise of the rights granted herein."

However, we consider that the OpenSSL library is a system library, as defined by the GPL, on Fedora and therefore we are allowed to ship GPL software that links to the OpenSSL library. Treatment of OpenSSL as a system library does not extend to other operating systems or even some other Linux distributions, however, so upstreams that do this should definitely be encouraged to add an exception to their GPL licensed code that allows linking to OpenSSL. The Free Software Foundation has a FAQ entry on how to write such an exception.

7
+50

Yes, this is possible, and Deluge's approach appears to be roughly in line with the FSF's recommendations.

The GPL FAQ has this to say on exceptions for GPL-incompatible libraries:

What legal issues come up if I use GPL-incompatible libraries with GPL software?

If you want your program to link against a library not covered by the system library exception, you need to provide permission to do that...

Only the copyright holders for the program can legally release their software under these terms. If you wrote the whole program yourself, then assuming your employer or school does not claim the copyright, you are the copyright holder—so you can authorize the exception. But if you want to use parts of other GPL-covered programs by other authors in your code, you cannot authorize the exception for them. You have to get the approval of the copyright holders of those programs.

To think of it another way, you license your software under a license whose terms are almost identical to the GPL. The license is exactly like the GPL in all respects except that its copyleft provisions do not apply for the specific purpose of linking to some particular library. In essence, you sidestep the GPL compatibility problem by not licensing your own work under the (vallina) GPL! You license your work under the "almost-GPL" which has additional permissions. The GPLv3 has a mechanism in section 7 exactly for this purpose, and the FSF does not appear to object to authors adding exceptions to the GPLv2, either.

Broadly, adding exceptions works because you are the copyright holder, and therefore you may license your work however you please. Narrowly, this works because the FSF (and GPLv3 license text) permits you to add additional permissions to the GPL's license terms when you release your work. Within the FAQ item linked above, the FSF has published a guide explaining exactly how to implement exceptions in your GPL license text. For example, the following addendum is the FSF's suggested wording to add a linking exception to the GPLv3:

Additional permission under GNU GPL version 3 section 7

If you modify this Program, or any covered work, by linking or combining it with [name of library] (or a modified version of that library), containing parts covered by the terms of [name of library's license], the licensors of this Program grant you additional permission to convey the resulting work. {Corresponding Source for a non-source form of such a combination shall include the source code for the parts of [name of library] used as well as that of the covered work.}

(The bracket text should be removed for libraries whose source code cannot be distributed alongside your GPL-licensed work, e.g., because it is not publicly available.)

Note, however, that you can only add exceptions to work for which you have copyright control. If you want to include a third-party GPL-licensed library in your project, you cannot make that library adopt the exceptions present in your project. (Only the author of the third-party GPL-licensed library can do that.) This is an issue any time you (1) include someone else's third-party code in your project (2) in a way that creates a combined work with that third-party code, and (3) the license of that third-party code does not permit you to link to the library you want to make an exception for (e.g. OpenSSL). So, for example, this not a problem if the third-party code is under a permissive license like MIT, because the MIT license does not object to having its material combined with non-free or GPL-incompatible libraries. It is an issue for third-party GPL-licensed code, because that license does object to being combined with GPL-incompatible code.

Note also that any downstream recipient may remove exceptions for their own derivative of your work (but in this case, that seems unlikely to happen, since it would massively diminish the usefulness of their derivative).

  • 1
    Thanks for the detailed answer. I'm curious about the part If you want to include a third-party GPL-licensed library in your project, you cannot make that library adopt the exceptions. - Does this mean that I cannot use a third-party GPL library that does not have the openSSL exception in the same project? – user3570 Jan 4 '16 at 13:05
  • 1
    Err scratch that, may not apply because the third party lib I'm thinking of is LGPL. I think maybe this might warrant an entirely new question. – user3570 Jan 4 '16 at 13:06
  • 1
    @TechnikEmpire I expanded that paragraph a bit. If a third-party GPL library is combined with your code in such a way that it produces a new combined work, then your combined work must abide by the most restrictive set of permissions offered by the component parts. So, GPL-with-exception(s) combined with vanilla-GPL must link as if it's all vanilla-GPL, but GPL-with-exception(s) combined with MIT may link as GPL-with-exception(s). As I've said elsewhere, I think the LGPL would not introduce a smaller set of permissions than GPL-with-exception(s), but I am not 100% sure. – apsillers Jan 5 '16 at 17:13
  • The system library exception is not related to license compatibility at all. The system library exception just permits to omit a library from what has to be delivered with the complete source. – schily Jan 8 '16 at 16:17
  • 1
    @apsillers Got an official response from FSF that confirms you answer, BTW. Debating if it's worth adding a second answer with a direct quote (doesn't add anything new to the conversation), but just wanted to at least post a comment about it. – user3570 Feb 12 '16 at 16:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy