As far as I understand, there can be issues with (L)GPL-licensed software in code-signing contexts where modified code is not allowed to run.
Now, suppose an organization (for example, a company or a university) uses (L)GPL-licensed software on its own devices. The devices can be used by employees or students internally, but is not distributed to the external public. For security reasons, the organization uses a strict code-signing setup for these internal devices, restricting the software that runs on the devices.
Now, is the organization required to comply with the distribution or conveying terms from the (L)GPL licenses with respect to the software it installs to the internal devices? The organization might even want to release the source code of its modifications to the (L)GPL code to the public, but having to allow arbitrary modifications to the software with respect to the internal devices might require a BYOD-capable environment since the software on the devices would not be trusted anymore.
From what I found, GPL-licensed software on devices that are privately lent does not have to comply with GPL software distribution requirements ([1]). But in this case, this might not apply because it is not a private sitation.
On the other hand, commercially lending devices for private use will make the installed software subject to the GPL software distributions requirements ([2]). But maybe this does also not apply here since the devices would not be lent by the organization for the purpose of being used privately, but they would be strictly supplied for internal, work- or study-related purposes.
So, what do you think? Would (L)GPL licenses make code signing based security policies unusable in such cases?
