A VPN GUI, a GPL Engine and an Installer: What Ships?

The question arrives as a licensing one, but the answer starts as an inventory. A VPN interface, the OpenVPN engine it drives, a TLS library and an installer can have four different sets of terms, and the product's appearance tells you nothing about which file belongs to which set. Work through the artifacts in the order they ship, and the legal question becomes much narrower by the time you hand it to someone qualified to answer it. Each step narrows it further: what is distributed, what was changed, and how the parts communicate.

Start with what the installer puts on disk

Take the released installer or package, not a development checkout, and list every file it places on a clean machine. Record versions for the interface, the engine and the TLS library, and note whether the engine is a separate executable or a library loaded into the same process.

That last fact shapes everything that follows. A separate executable launched over a socket raises a different set of questions from code compiled into one binary, and an installer that merely places both side by side does not decide the matter either way. Bundling is a packaging decision, while the relationship between the programs is an architectural one.

Write the list down with versions attached, because terms differ between major releases.

dpkg -L openvpn | head -n 40
openssl version -a

Separate the interface from the engine

The OpenVPN copying file states GPL version 2 and documents a linking exception for OpenSSL, which is a specific permission with a defined scope rather than a general licence to mix terms.

Capture the licence text that ships with your build, not the one on the project website today. A release that pinned an older branch carries that branch's document. Screenshots of a repository page are not a substitute, because the file you need is the one inside the artifact. Store it beside the installer so the pack is complete.

Then describe the integration honestly: does the interface start the engine as a child process and speak a text protocol, or does it link a library and exchange internal structures? The second arrangement is intimate in a way the first is not, and the distinction is what a reviewer will ask about first.

Note which files you changed

Modified source changes the analysis more than any packaging detail. If you patched the engine, the patch itself is derived work, and the obligation attaches to whoever distributes the result.

Record each patch, its purpose and whether it was sent upstream, because a patch that never left your repository is still part of what you ship if you ship the binary.

Configuration files, themes and translations usually live with the interface, but a translation that embeds engine source strings is a small reminder that the boundary is per file rather than per directory. Keep a diff between the upstream release and your build so the answer is available on request instead of reconstructed later. That diff is also the most useful artifact when an auditor asks what changed.

Check the OpenSSL version on its own

OpenSSL 3.0 and later are distributed under Apache License 2.0, while older releases carry the OpenSSL/SSLeay terms. Those are different documents with different obligations, and a bundled engine may link whichever one your build system found.

Confirm the version actually shipped rather than the one named in a build script.

An OpenVPN dependency does not convert every OpenSSL modification into GPL code, and the linking exception does not remove the other obligations that come with redistributing the library. Treat the exception as one clause in a larger analysis, and record the TLS library's own notices alongside everything else.

Assemble the evidence pack

The pack has four parts: the file inventory with versions, the integration description, the list of modifications with diffs, and the licence texts as shipped. Add the notice file you distribute and the place where source is offered, if your obligations require an offer.

Keep the pack under one owner so a release cannot ship without it.

None of this decides a legal question, and that is the point: it gives a qualified reviewer the facts instead of a summary someone assembled from memory. A vendor's marketing description is not evidence about their architecture, and your own guess about it is not evidence either.