GnuPG binaries with IDEA

[Werner Koch]

On Mon,  8 Sep 2003 10:47:45 -0500, Keith Ray said:

> I can understand your complaint about compiling IDEA in the binary, but
> how can distributing the IDEA cipher in DLL/module form be a violation of
> the GPL?  Are you saying that if I distributed the DLL as a separate
> download, that would make a difference?  At any rate, this is just being

The question is whether this is a combined work or a mere aggregation.
The GPL FAQ has this answer:

    Mere aggregation of two programs means putting them side by side
    on the same CD-ROM or hard disk. We use this term in the case
    where they are separate programs, not parts of a single
    program. In this case, if one of the programs is covered by the
    GPL, it has no effect on the other program.

    Combining two modules means connecting them together so that they
    form a single larger program. If either part is covered by the
    GPL, the whole combination must also be released under the GPL--if
    you can't, or won't, do that, you may not combine them.

    What constitutes combining two parts into one program? This is a
    legal question, which ultimately judges will decide. We believe
    that a proper criterion depends both on the mechanism of
    communication (exec, pipes, rpc, function calls within a shared
    address space, etc.) and the semantics of the communication (what
    kinds of information are interchanged).

    If the modules are included in the same executable file, they are
    definitely combined in one program. If modules are designed to run
    linked together in a shared address space, that almost surely
    means combining them into one program.

    By contrast, pipes, sockets and command-line arguments are
    communication mechanisms normally used between two separate
    programs. So when they are used for communication, the modules
    normally are separate programs. But if the semantics of the
    communication are intimate enough, exchanging complex internal
    data structures, that too could be a basis to consider the two
    parts as combined into a larger program.

So it is obvious that gpg and idea.{c,dll} are indeed a combined work
and thus idea also falls under the conditions of the GPL.  The GPL
does not allow the use of idea due to the patent clause, so this is an
illegal combination.  

If there already exists an idea.dll on some system and this happens in
a place where the patent is not valid, it is possible to use gpg with
idea.  In other countries you won't be able to do that because after
all idea.dll is still intended to be combined with gpg and thus it can
be seen in a way that it still does not count as a mere aggregation.
Even the first case is in a somewhat gray area. IANAL; maybe
licensing at gnu.org can help better.

> pedantic.  Users of my binary can very easily delete the idea.dll and have
> a non-patent encumbered version.  As a practical matter, when has Ascom

That does not matter - you distribute it and thereby you are violating
the GPL.

> gone after any noncommercial or PGP implementation?

I have been contacted several times by Mediacrypt and asked to
advertise their license ;-).  BTW, it doesn't depend on whether it
is commercially or non-commercially distributed or used - you need a
license and Mediacrypt/Ascom offers a royality free license on a
per-product basis for non-commercial use (they use a very narrow term
for this) _on request_.


Salam-Shalom,

   Werner


-- 
Werner Koch                                      <wk at gnupg.org>
The GnuPG Experts                                http://g10code.com
Free Software Foundation Europe	                 http://fsfeurope.org