Mike Miller <mtmil...@octave.org> writes:
> On Wed, Aug 10, 2016 at 00:00:59 +0800, Alex Vong wrote:
>> Hi octave devs,
>>
>> During a look of the octave package in guix (a functional package
>> manager, part of gnu), we notice octave have an optional dependency on
>> openssl.
>>
>> However, since the license of octave (gpl3+) is incompatible
>> with that of openssl
>> (https://people.gnome.org/~markmc/openssl-and-the-gpl.html), the
>> resulting binary after linking is not re-distributable.
>
> Agreed.
>
>> So, we drop the optional dependency to avoid the problem.
>
> Precisely what is the optional dependency that is dropped?
>
> Octave does not directly link with OpenSSL nor use any OpenSSL
> functions. The Octave package on Debian builds with all optional
> dependencies enabled, and the resulting binary is linked with GnuTLS.
>
I thought it was an optional dependency because when I run
`./configure --help', it contains the following help:
--with-openssl use libcrypto hash routines. Valid ARGs are: 'yes',
'no', 'auto' => use if available, 'optional' => use
if available and warn if not available; default is
'no'
Perhaps someone unaware of the issue adds this? Should I open a bug
report on this?
>> Is there any plan to fix this problem? There are some solutions we think
>> of: 1. add openssl linking exception to the license 2. provide support
>> for linking with gnutls as an alternative. In any case, I think we
>> should warn the user about it.
>>
>> What are your ideas? (the messages below include the whole discussion on
>> the guix-devel mailing list)
>
> The Octave Guix package may be indirectly linking with OpenSSL through a
> direct dependency such as libcurl. I would recommend that you use a
> libcurl that is built against GnuTLS as we do on Debian.
>
Indeed, the Debian package does not depend on openssl.
> AFAICS, nothing needs to be fixed in Octave.
>
> HTH,
Thanks,
Alex
