#1034358 libvncclient1: license conflict with libsasl2

Package:
libvncclient1
Source:
libvncclient1
Description:
API to write one's own VNC server - client library
Submitter:
Bastian Germann
Date:
2023-08-01 15:39:03 UTC
Severity:
normal
Tags:
#1034358#5
Date:
2023-04-13 13:42:59 UTC
From:
To:
Hi,

libvncclient1 depends on libsasl2-2, which is licensed under CMU's BSD-3-Clause-Attribution license and covered by the
RSA-MD license. They have clauses in place, which are known to be incompatible with GPL (libvncclient1's license).
There are several possible solutions to this problem:

1) Build without SASL support. The affected symbols GetTLSCipherBits, HandleSASLAuth, and ReadFromSASL are not used by
any of the reverse dependencies.

2) Support my request at #996892.

3) Ask upstream to add a license exception for libsasl2-2, similar to the one that was required by Debian for OpenSSL
for a long time.

Thanks for your consideration,
Bastian
#1034358#10
Date:
2023-05-21 19:48:37 UTC
From:
To:
Hi Bastian,

I have now (sorry for the delay) forwarded this issue upstream and
suggested to them adding the license exception as proposed under (3).

I'd suggest ignoring this for the bookworm release as I presume that
Christian Beier (upstream author/maintainer of src:libvncserver) will
be cooperative on this issue. Let me know if this works for you that
this gets fixed only for trixie.

Greets,
Mike
#1034358#19
Date:
2023-05-21 20:02:58 UTC
From:
To:
Am 21.05.23 um 21:48 schrieb Mike Gabriel:
#1034358#24
Date:
2023-08-01 15:36:23 UTC
From:
To:
The RSA-MD license is gone from cyrus-sasl's binaries now, so derivative works can ignore it.
For BSD-3-Clause-Attribution, the incompatibility case is not as strong, so I am lowering the severity.