Bug 878089

Summary: libdb-6 is licensed by AGPLv3+ and libdb-5 won't be supported forever
Product: [openSUSE] openSUSE 13.1 Reporter: Honza Horak <hhorak>
Component: BasesystemAssignee: Cristian Rodríguez <crrodriguez>
Status: RESOLVED WONTFIX QA Contact: E-mail List <qa-bugs>
Severity: Enhancement    
Priority: P5 - None CC: ciaran.farrell, coolo, jengelh, xose.vazquez
Version: Final   
Target Milestone: ---   
Hardware: All   
OS: openSUSE 13.2   
Whiteboard:
Found By: --- Services Priority:
Business Priority: Blocker: ---
Marketing QA Status: --- IT Deployment: ---

Description Honza Horak 2014-05-15 15:22:52 UTC
User-Agent:       Mozilla/5.0 (X11; Linux x86_64; rv:29.0) Gecko/20100101 Firefox/29.0

This is not a real bug yet, but rather a future-to-be issue with BerkeleyDB (libdb), which got changed license from GPLv2+ to AGPLv3+ since version 6. This change makes a license problem for many depended packages, that cannot be re-licensed to (A)GPLv3+.

One day, even openSUSE will need to solve the issue that libdb-4.8 is no supported by upstream any more (according to [3] libdb-5.3 will get eol in Dec 2016). Using this bug I'd like to establish cross-distribution collaboration to find some common way out of this.

Debian seems to drop affords for including libdb-6 for now and will stay with libdb-5.3 if it is possible. In Fedora, we are currently trying to find out the best solution in the threads [1] and [2].

I'd like to ask what is the plan for openSUSE, if there is one.

[1] https://lists.fedoraproject.org/pipermail/devel/2014-April/197788.html
[2] https://lists.fedoraproject.org/pipermail/devel/2014-May/199026.html
[3] http://www.oracle.com/us/support/library/lifetime-support-technology-069183.pdf

Reproducible: Always

Steps to Reproduce:
See license of libdb-6
Actual Results:  
Many packages won't be able to use libdb-6.

Expected Results:  
Some solution found.
Comment 1 Cristian Rodríguez 2014-05-16 15:14:26 UTC
This looks like a major pain indeed, both coolo and legal need to be aware.
Comment 2 Stephan Kulow 2014-05-16 16:07:38 UTC
we both know - and we even stayed on 4.8, and don't plan to even include 6.0. I wasn't aware that there is a 5.* actually as noone bothered submitting it. 6.0 was submitted by Jan to the devel prj: https://build.opensuse.org/request/show/179152

But we refused to accept it for openSUSE for the above reasons. So switching to a commonly maintained 5.3 sounds plausible for openSUSE, the only other alternative is staying with 4.8 till it hurts. Right now we even ship 4.5 :)

BTW: Thanks Honza for asking
Comment 3 Jan Engelhardt 2014-05-16 19:21:05 UTC
I dropped efforts on libdb{5,6}; it's not worth it. The way it looks, no distro will be shipping DB6. Projects, especially the bigger ones like perl, will likely want to not upset people due to introduction of a dependency on version 6 (which nobody is going to have in Linux-space). So everybody stays on the working combination they have, db4/db5, whose API is about the same as DB6.
From a build perspective, it won't be the distros to incur pain.

If it hurts - once it hurts sufficiently enough, that is - programs will (have to) stop depending on libdb.

There is Howard Chu's liblmdb[2], whose API is also close to libdb, while at the same time provides a much[1] more efficient storage engine.

[1] https://fosdem.org/2014/schedule/event/whats_new_in_openldap/
[2] http://www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=blob;f=libraries/liblmdb/sample-mdb.txt;hb=mdb.master
Comment 4 Jan Engelhardt 2014-05-16 20:11:47 UTC
Also note that the AGPL was introduced with db-6.0.20, not 6.0.
6.0.19 is still under that BSD-3-ish Sleepycat.
Comment 5 Cristian Rodríguez 2014-05-16 20:18:53 UTC
I could take a look at packages that do not strictly require libdb and can use an alternative.. and start reducing the amount of future pain ;-)
Comment 6 Jan Engelhardt 2014-09-10 19:09:08 UTC
The designated replacement is /systemsmanagement/lmdb. The API is a little different, but not too much according to its maintainer. Upstream projects are highly encouraged to switch to it, also because it promises being a lot more performant.
Comment 7 Xose Vazquez Perez 2015-04-21 13:56:33 UTC
(In reply to Jan Engelhardt from comment #4)

> Also note that the AGPL was introduced with db-6.0.20, not 6.0.
> 6.0.19 is still under that BSD-3-ish Sleepycat.

Latest release(6.0.19) with sleepycat licence was deleted from the oracle web:
http://www.oracle.com/technetwork/database/database-technologies/berkeleydb/downloads/index-082944.html

For future reference, it can be downloaded from freebsd.org site and mirrors:
http://distcache.freebsd.org/ports-distfiles/bdb/db-6.0.19.tar.gz
Comment 8 Jan Engelhardt 2015-04-21 14:11:29 UTC
A tarball is already in the build service for some almost 2 years.
Comment 9 Tomáš Chvátal 2018-04-12 13:37:20 UTC
This version of openSUSE changed to end-of-life (EOL [1]) status. As such
it is no longer maintained, which means that it will not receive any
further security or bug fix updates.
As a result we are closing this bug.

If you can reproduce this bug against a currently maintained version of 
openSUSE, or consider the bug still valid, please feel free to reopen this
bug against that version, or open a new ticket.

Thank you for reporting this bug and we are sorry it could not be fixed
during the lifetime of the release.

[1] https://en.opensuse.org/Lifetime