0

As far as I understand, there can be issues with (L)GPL-licensed software in code-signing contexts where modified code is not allowed to run.

Now, suppose an organization (for example, a company or a university) uses (L)GPL-licensed software on its own devices. The devices can be used by employees or students internally, but is not distributed to the external public. For security reasons, the organization uses a strict code-signing setup for these internal devices, restricting the software that runs on the devices.

Now, is the organization required to comply with the distribution or conveying terms from the (L)GPL licenses with respect to the software it installs to the internal devices? The organization might even want to release the source code of its modifications to the (L)GPL code to the public, but having to allow arbitrary modifications to the software with respect to the internal devices might require a BYOD-capable environment since the software on the devices would not be trusted anymore.

From what I found, GPL-licensed software on devices that are privately lent does not have to comply with GPL software distribution requirements ([1]). But in this case, this might not apply because it is not a private sitation.

On the other hand, commercially lending devices for private use will make the installed software subject to the GPL software distributions requirements ([2]). But maybe this does also not apply here since the devices would not be lent by the organization for the purpose of being used privately, but they would be strictly supplied for internal, work- or study-related purposes.

So, what do you think? Would (L)GPL licenses make code signing based security policies unusable in such cases?

[1] https://www.gnu.org/licenses/gpl-faq.en.html#LaptopLoan

[2] Lend/Distribute IoT device containing GPL software

1

I don't know with enough confidence what the situation is with regard to the students.

When it comes to employees of the organization, when they are provided with a copy of (L)GPL-licensed software, with the understanding that that software is provided to them so they can perform their duties on behalf of the organization, then that software is considered to remain within the same legal entity and the organization does not have to give any GPL-related rights to their employees.

What I am not certain about is if these rules for employees apply equally to software provided to students for their education.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.