[jira] [Commented] (TS-2469) traffic_shell links against libreadline which is gpl licensed

["Arno Toell (JIRA)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/TS-2469?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13890164#comment-13890164 ] 

Arno Toell commented on TS-2469:
--------------------------------

Leif, this is an issue. You must not link software that is GPL licensed together with OpenSSL. This results in a undistributable binary, as this is a GPL violation. The alternative system you point out is legit, but only as long as you actually do use an alternative to libreadline in this case, never libreadline itself (http://www.gnu.org/licenses/license-list.html#OpenSSL). 

In practice this is not so much of an issue in our case, as traffic_shell links to OpenSSL only because it's overlinked as -lssl is in $LIBS. It does not use any of SSL's symbols. Thus, even if you would use readline, you could still use -Wl,--as-needed and get rid of the SSL dependency for free. That would be a start and make ATS binaries distributable again if you use readline. I say probably, because this is something bored lawyers need to find out (see http://www.gnu.org/licenses/gpl-faq.html#MereAggregation). 

In master (4.2/5.0) there is no way to use libreadline anymore, thanks to commit 3344fdfc which should ensure that readline is never used (but hey, who knows, it's automake).

However, this is not the case for 4.1 versions. This means that _all_ binary distributions of ATS and/or ATS instances in the wild in version 4.1 are essentially undistributable and a GPL violation. Thus, I'd suggest do backport 3344fdfc to 4.1, or add -Wl,--as-needed there:

{code}
diff --git a/cmd/traffic_shell/Makefile.am b/cmd/traffic_shell/Makefile.am
index 2a28086..8b7ccf1 100644
--- a/cmd/traffic_shell/Makefile.am
+++ b/cmd/traffic_shell/Makefile.am
@@ -64,7 +64,7 @@ libtrafficshell_a_SOURCES = \
   UtilCmds.cc \
   UtilCmds.h
 
-traffic_shell_LDFLAGS =        @EXTRA_CXX_LDFLAGS@ @LIBTOOL_LINK_FLAGS@
+traffic_shell_LDFLAGS =        -Wl,--as-needed @EXTRA_CXX_LDFLAGS@ @LIBTOOL_LINK_FLAGS@
 traffic_shell_LDADD = \
   libtrafficshell.a \
   $(top_builddir)/mgmt/api/libtsmgmtshare.la \
{code}

However, jpeach pointed out that adding -Wl,--as-needed  unconditionally might have portability issues. 



tl;dr:

editline + openssl = okay
readline + openssl = nonono
readline + gnutls = okay but god forbid
readline + openssl + -Wl,--as-needed = probably okay


> traffic_shell links against libreadline which is gpl licensed
> -------------------------------------------------------------
>
>                 Key: TS-2469
>                 URL: https://issues.apache.org/jira/browse/TS-2469
>             Project: Traffic Server
>          Issue Type: Bug
>            Reporter: Ben Aitchison
>            Assignee: Zhao Yongming
>            Priority: Minor
>              Labels: traffic_shell
>             Fix For: 5.0.0
>
>         Attachments: removereadline.txt
>
>
> libreadline is gpl licensed which is infectious.  libedit is a free alternative, and is already supported in the configure scripts so libreadline support should be removed.
> it seems traffic_shell is the only thing using libreadline/libedit currently.



--
This message was sent by Atlassian JIRA
(v6.1.5#6160)