Mongodb links GPL code with SSL

Reassigning since this has been raised to the TB now:

https://lists.ubuntu.com/archives/technical-board/2013-May/001601.html

I'm working with 10gen upstream to get the OpenSSL linking exception written into the License for MongoDB. They want to get this sorted out so all distributions can enable SSL support without the license ambiguity that we currently have.

I'd like to clarify the process under which I enabled the SSL support in the MongoDB package; this feels like a suitable place todo that.

SSL support was requested by a number of people in the MongoDB package; specifically to support certain security related features for juju-core.

My initial stance was that this was not possible due to the know incompatibility between OpenSSL and GPL licenses - I discussed this with the Debian maintainer and we agreed; so I approached the copyright holder (10gen) for clarification on their position as to linking OpenSSL with MongoDB; their initial response was the they thought this was OK as OpenSSL is shipped with the distro so this fell under the 'system libraries' clause in GPL licensing.

I was uncomfortable as this is a grey area for the distro, so I requested a license exception be documented as part of MongoDB.

10gen clarified their position to me again in a formal letter rather than a documented License exception; I discussed with an archive admin and internal Canonical legal counsel and the opinion was that this was sufficient to enable this feature in Ubuntu. I agree this should have been documented in the package; this was my oversight.

At no point did I request a Ubuntu specific license exception.

As commented in #2 I'm working with 10gen to get this documented as a license exception in the MongoDB package itself as this appears to be the clearest path to resolving this issue.

Status changed to 'Confirmed' because the bug affects multiple users.

For posterity, today the Ubuntu TB reviewed the question of if openssl counted
as a system library per the GPL or if a specific GPL exception for openssl
linking was required. They concluded that it is required for both GPL v2 and
GPL v3:

http://ubottu.com/meetingology/logs/ubuntu-meeting/2013/ubuntu-meeting.2013-07-08-19.58.moin.txt

On what basis do you mark this fix released?

I'm going to assume that was accidental.

I've chased upstream on this issue again; the appropriate exceptions should be in the right headers for the next release of the 2.5.x series which is scheduled for the 5th September.

Fix committed in upstream repository:
https://github.com/mongodb/mongo/commit/ab0a0a92a1cc056e841dbcdac94c2f181ce29d2b

+ *
+ * As a special exception, the copyright holders give permission to link the
+ * code of portions of this program with the OpenSSL library under certain
+ * conditions as described in each individual source file and distribute
+ * linked combinations including the program with the OpenSSL library. You
+ * must comply with the GNU Affero General Public License in all respects
+ * for all of the code used other than as permitted herein. If you modify
+ * file(s) with this exception, you may extend this exception to your
+ * version of the file(s), but you are not obligated to do so. If you do not
+ * wish to do so, delete this exception statement from your version. If you
+ * delete this exception statement from all source files in the program,
+ * then also delete it here.

This bug was fixed in the package mongodb - 1:2.4.6-0ubuntu4

---------------
mongodb (1:2.4.6-0ubuntu4) saucy; urgency=low

  * d/copyright: Add details of MongoDB AGPL+OpenSSL license exception
    to support continued use of MongoDB with SSL support enabled
    (LP: #1175028).
 -- James Page <email address hidden> Thu, 29 Aug 2013 12:33:32 +0100

Status changed to 'Confirmed' because the bug affects multiple users.

raring has seen the end of its life and is no longer receiving any updates. Marking the raring task for this ticket as "Won't Fix".

saucy has seen the end of its life and is no longer receiving any updates. Marking the saucy task for this ticket as "Won't Fix".