updated with more recent facts

  Date: October 27, 2005

  Date: May 15, 2006

  Author: Daniel Stenberg <daniel@haxx.se>

  URL: http://curl.haxx.se/legal/distro-dilemma.html

Condition

 This document is written to describe the situation as it is right

 now. libcurl 7.15.0 is currently the latest version available. Things may (or

 perhaps will) of course change in the future.

 now. libcurl 7.15.3 is currently the latest version available. Things may of

 course change in the future.

 This document reflects my view and understanding of these things. Please tell

 me where and how you think I'm wrong, and I'll try to correct my mistakes.

 The Free Software Foundation has deemed the Original BSD license[1] to be

 "incompatible"[2] with GPL[3]. I'd rather say it is the other way around, but

 the point is the same: if you distribute a binary version of a GPL program,

 it MUST NOT be linked with any Original BSD-licensed parts or

 libraries. Doing so will violate the GPL license. For a long time, very many

 GPL licensed programs have avoided this license mess by adding an

 exception[8] to their license. And many others have just closed their eyes

 for this problem.

 it MUST NOT be linked with any Original BSD-licensed parts or libraries.

 Doing so will violate the GPL license. For a long time, very many GPL

 licensed programs have avoided this license mess by adding an exception[8] to

 their license. And many others have just closed their eyes for this problem.

 libcurl is MIT-style[4] licensed - how on earth did this dilemma fall onto

 our plates?

 Debian does however not take this stance and has officially(?) claimed that

 OpenSSL is not a required part of the Debian operating system

Debian-legal

 In August 2004 I figured I should start pulling people's attention to this to

 see if anyone has any bright ideas or if they would dismiss my worries based

 on some elegant writing I had missed somewhere:

 My post to debian-legal on August 12 2004:

        http://lists.debian.org/debian-legal/2004/08/msg00279.html

 Several people agreed then that this is a known and rather big problem, but

 the following discussion didn't result in much.

GnuTLS

 With the release of libcurl 7.14.0 (May 2005), it can now get built to use

 GnuTLS instead of OpenSSL. GnuTLS is a LGPL[7] licensed library that offers a

 matching set of features as OpenSSL does. Now, you can build and distribute

 an SSL capable libcurl without including any Original BSD licensed code.

 With the release of libcurl 7.14.0 (May 2005), libcurl can now get built to

 use GnuTLS instead of OpenSSL. GnuTLS is an LGPL[7] licensed library that

 offers a matching set of features as OpenSSL does. Now, you can build and

 distribute an TLS/SSL capable libcurl without including any Original BSD

 licensed code.

 I believe Debian is the first distro to provide libcurl/GnutTLS packages.

 and it has not been tested nor used very extensively, while the OpenSSL

 equivalent code has been used and thus matured for more than seven (7) years.

 In August 2005, the debian-devel mailing list discovered the license issue as

 a GPL licensed application wanted SSL capabilities from libcurl and thus was

 forced to use the GnuTLS powered libcurl. For a reason that is unknown to me,

 the application authors didn't want to or was unable to add an exception to

 their GPL license. Alas, the license problem hit the fan again.

 GnuTLS

   - LGPL licensened

   - supports SRP

   - lacks SSLv2 support

   - lacks MD2 support (used by at least some CA certs)

   - lacks the crypto functions libcurl uses for NTLM

 OpenSSL

   - Original BSD licensened

   - lacks SRP

   - supports SSLv2

   - older and more widely used

   - provides crypto functions libcurl uses for NTLM

   - libcurl can do non-blocking connects with it in 7.15.4 and later

The Better License, Original BSD or LGPL?

Application Angle of this Problem

 libcurl is built to use one SSL/TLS library. It uses a single fixed name (by

 default), and applications are built/linked to use that single lib. Replacing

 one libcurl instance with another one that uses the other SSL/TLS library

 might break one or more applications (due to ABI differences and/or different

 feature set). You want your application to use the libcurl it was built for.

 default) on the built/created lib file, and applications are built/linked to

 use that single lib. Replacing one libcurl instance with another one that

 uses the other SSL/TLS library might break one or more applications (due to

 ABI differences and/or different feature set). You want your application to

 use the libcurl it was built for.

Project cURL Angle of this Problem

 We distribute libcurl and everyone may build libcurl with either library. At

 We distribute libcurl and everyone may build libcurl with either library at

 their choice. This problem is not directly a problem of ours. It merely

 affects users - GPL application authors only - of our lib as it comes

 included and delivered on some distros.

 libcurl has different ABI when built with different SSL/TLS libraries due to

 two reasons:

 these reasons:

 1. No one has worked on fixing this. The mutex/lock callbacks should be set

    with a generic libcurl function that should use the proper underlying

 2. The CURLOPT_SSL_CTX_FUNCTION option is not possible to "emulate" on GnuTLS

    but simply requires OpenSSL.

 3. There might be some other subtle differences just because nobody has yet

    tried to make a fixed ABI like this.

Distro Angle of this Problem

 A distro can provide separate libcurls built with different SSL/TLS libraries

 to work around this, but at least Debian seems to be very hostile against

 such an approach, probably since it makes things like devel packages for the

 different libs collide since they would provide the same include files and

 man pages etc.

 To my knowledge there is only one distro that ships libcurl built with either

 one of the SSL libs supported.

 Debian Linux is now (since mid September 2005) providing two different

 libcurl packages, one for libcurl built with OpenSSL and one built with

 GnuTLS. They use different .so names and can this both be installed in a

 single system simultaneously. This has been said to be a transitional system

 not desired to keep in the long run.

Fixing the Only Problem

 The only problem is thus for distributions that want to offer libcurl

 versions built with more than one SSL/TLS library.

 Debian is now (since mid September 2005) providing two different devel

 packages, one for libcurl built with OpenSSL and one built with GnuTLS. They

 use different .so names and can this both be installed in a single system

 simultaneously. This has previously been said as a transitional system not

 desired to keep in the long run.

 Since multiple libcurl binaries using different names are ruled out, we need

 to come up with a way to have one single libcurl that someone uses different

 underlying libraries. The best(?) approach currently suggested involves this:

When Will This Happen

 Note again that this is not a problem in curl, it doesn't solve any actual

 technical problems in our project. Don't hold your breath for this to happen

 very soon (if at all) unless you step forward and contribute.

 This is not a problem in curl, it doesn't solve any actual technical problems

 in our project. Don't hold your breath for this to happen very soon (if at

 all) unless you step forward and contribute.

 The suggestion that is outlined above is still only a suggestion. Feel free

 to bring a better idea!

 code like today (without the use of lib2), should you decide to ignore the

 problems outlined in this document.

 Update: Work on this has been initiated by Richard Atterer:

 Work on this was suggested by Richard Atterer:

        http://curl.haxx.se/mail/lib-2005-09/0066.html