2

Software component under a custom open-source license requires certain third-party GPLv2, Apache2, and MIT Linux packages:

  1. GPLv2 package is not part of the component but is usually used to integrate the component with Linux infrastructure.
  2. Apache2 and MIT packages include runtime and SDK used to write the component.

Some Linux distributions do not contain these packages in their repositories and require to sign external packages with the private key embedded in these distributions (key is generated and handed to developers by distribution maintainers).

I plan to sign these packages (with no modifications to the code) and then publish them on a public website or in a separate package repository devoted to this specific software solution.

  1. Licensing. Does the fact that I sign and distribute runtime & SDK used to write the component oblige me to change the component's license to MIT / Apache2?
  2. Signing. Is the signing of these packages allowed? Is it considered a modification?
  3. Distribution. Can I distribute signed packages? As far as I know, there are no limitations on distributing modified or unmodified versions of software in any of these licenses.
  4. Private key distribution. Do I need to distribute private keys used for signing as well?

1 Answer 1

3

Does the fact that I sign and distribute runtime & SDK used to write the component oblige me to change the component's license to MIT / Apache2?

No, software under Apache 2 or MIT/Expat/X11 licenses may be used within software under virtually any license. These are "permissive" licenses which means they don't impose many requirements (other than attribution) and they don't require other code to be licensed in any particular way.

You should be aware that the GPLv2 imposes requirements when it is distributed with other code in such a way that it forms a derivative work: the whole new derivative work must be licensed under the GPL. The information you supply here doesn't clearly suggest that case is happening -- especially since you're packaging and distributing the components separately, and the GPLv2 component appears to be optional -- but I mention it because it is quite similar to the concerns you ask about in your first question here.

Is the signing of these packages allowed? Is it considered a modification?

Signing is allowed, and it is probably not a modification. Cryptographically speaking, a signature is the output of some operation Sign(input, private_key) => signature and it does not preserve any of the original expression of the input. A signature itself isn't a derivative work under copyright, and placing a signature (which has no creative expression) alongside a work probably doesn't make a derivative either.

You are absolutely allowed to produce and distribute a cryptographic signature by performing a Sign operation using some freely-licensed code as input. Even if it did result in a derivative work (which it does not), the licenses allow you to prepare and distribute derivative works.

Can I distribute signed packages? As far as I know, there are no limitations on distributing modified or unmodified versions of software in any of these licenses.

Correct, all free and open source licenses allow distribution of the licensed material in modified or unmodified form.

Do I need to distribute private keys used for signing as well?

No, you may keep your private key private.

The only possible way the answer to this might ever be "yes," is if

  • You are using software under the GPLv3 (or AGPLv3),
  • Embedded in a hardware device that can run modified code, and
  • That device uses your signature to decide what code to run or not run (i.e., the device will refuse to run unsigned or wrongly-signed code)

in which case, the GPLv3 requires you to give users some way to produce their own valid signatures. From the information you've provided, you do not meet even one of these three criteria; you do not need to share your signing key.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.