Debian Bug #1094969: "git-remote-http is linked against incompatibly licensed OpenSSL"

A discussion about whether git (GPL 2 only) can be distributed as a binary linked against OpenSSL (Apache 2.0) by a source (Debian) that distributes both.

It's a pretty complicated licensing issue. I thought I had a decent understanding of how GPL worked and I'm honestly stumped as to which position is correct here.

Apache believe that their license is compatible with GPL 2, but state that the FSF disagrees:

Despite our best efforts, the FSF has never considered the Apache License to be compatible with GPL version 2, citing the patent termination and indemnification provisions as restrictions not present in the older GPL license.

It seems that the issue may hinge on whether the GPL 2's system library exception applies here:

However, as a special exception, the source code distributed need not include anything that is normally distributed (in either source or binary form) with the major components (compiler, kernel, and so on) of the operating system on which the executable runs, unless that component itself accompanies the executable.

In this case, the component is OpenSSL, and the executable is git-remote-http.

One could argue that Debian is distributing the component with the executable (they're both in the same repo), and therefore the exclusion cannot apply. One could also argue that the component is not necessarily "accompanying" the executable in this case. One could probably argue a lot of things...

Daniel Stenberg (curl project lead) posted about this on the Fediverse, sparking some further discussion: https://mastodon.social/@bagder/114329630276196304