4

I am commercial software developer, and my piece of software dynamically calls the LGPL v2.1/LGPL v3 library. Am I allowed to notarize my installation package that includes LGPL dynamic loaded library binary? Addidional Option b) To protect my software from replacing dynamic loaded library with some malicious code is it allowed with LGPL to verify library code sign? Veryfing checksum I believe is strictly not allowed with LGPL.

Improve this question

1 Answer 1

Reset to default
4

The LGPL v3, Section 4(d)(1)(b) requires that your program

will operate properly with a modified version of the Library that is interface-compatible with the Linked Version.

(Very similar language exists in Section 6(b)(2) of the LGPL v2.1)

Verifying the checksum of the library will mean your program will not operate properly, so you are correct you are not allowed to do this; the LGPL is explicitly designed to allow users to replace the LGPL code when it is combined into a larger work.

The details of notarization are not entirely clear to me but the same principle applies: the user must be able to replace the LGPL code with an interface-compatible version and still run the software (and in the case of LGPL v3 software, still install the software as well). If as you say in comments it is possible to enable this with one simple command, I believe that would be acceptable.

Improve this answer
13
  • Thank you for your reply. How about notarization/code sign of the binary file? Is this considered as a modification of the original binary file?
    – thirty
    May 7 at 13:46
  • If your program checks the code signature and refuses to work with one that you didn't sign, that also means your program won't operate properly with a modified, but interface-compatible version. The point of the (L)GPL is to give the recipient of the software the freedom to do whatever they want, outside anyone's control.
    – John Dallman
    May 7 at 20:38
  • Is there a distinction between code signing which blocks functionality, versus code signing which is used to allow people who aren't interested in modifying a program to confirm it hasn't been tampered with? If someone substitutes their own version of a library, then by nature the author of an application that uses it would not be able to offer any guarantees about the overall application functionality; someone wanting to change the functionality of a program would have to accept responsibility for ensuring that the alternative library didn't do anything undesirable.
    – supercat
    May 7 at 22:20
  • 2
    I think I/we would need more information on exactly what the effect of notarizing an app is. If it just means a warning is skipped the first time the app is run, that's probably fine. If it means the app can't be run, that's obviously not fine. If you have to invoke an arcane command line ritual, I think that's a grey area - while that may be beyond "the average user", the average user won't be replacing LGPL components either.
    – Philip Kendall
    May 8 at 7:08
  • Hi. Some more info here: developer.apple.com/documentation/security/… and developer.apple.com/documentation/security/… tbh Ive never check the behavior of non signed dynamic libraries on MacOS. Regarding bundles, MacOS may check the sign of the bundle and don't allow to run them out of the box but you can run from command line sudo xattr -rd com.apple.quarantine /path/to/bundle and it'll work
    – thirty
    May 8 at 18:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.