(L)GPLv3 licensing dilemma: gpg stack

[Rex Dieter]

gpg dev's, could you clarify/verify if my understanding is correct?

In particular, as a package maintainer for much of the gpg-related software
stack in fedora, the change to GPLv3 and LGPLv3 in recent releases has got
us stuck in a bind on how to distribute these legally (ie, to comply with
the new licensing).

As it appears that the latest versions of libassuan, libksba, gnupg2 use
(L)GPLv3, there appears to be a licensing incompatibility brewing. According
to the FSF, GPLv2 is incompatible with GPLv3,
http://www.fsf.org/licensing/licenses/gpl-faq.html#v2v3Compatibility

libassuan-1.0.2 is LGPLv3
libksba-1.0.2 is GPLv3
gnupg2-2.0.5 is GPLv3

gpgme-1.1.5 is LGPLv2.  Fortunately, the LGPLv2 allows one to relicense code
under any version of the GPL since GPLv2.  So, distributing it as GPLv3
looks ok.  But... as there are many apps out there that currently link
against gpgme(1), this could lead to some serious consequences and other
potential licensing incompatibilities.

dirmngr-1.0.0 is GPLv2.  This looks like a problem too.

-- Rex


(1) in fedora anyway, including: basket, centericq, claws-mail, gpa, kdepim,
licq, mcabber, pygpgme, seahorse, sylpheed.  Many of these are currently
GPLv2 only.