I'm working on building a proprietary application that I would like to release as PGP-signed Debian packages.

I heard I might be forced to release the source to my proprietary application simply due to the fact that it would be signed by GnuPG, which is covered under GPLv3 containing the "Tivoization" clause.

Is this true? It is my understanding that the license for GnuPG would enforce disclosing any modifications to GnuPG itself, not the use of GnuPG to apply a signature to an arbitrary "object". Saying that the object I'm signing with GnuPG is now also open source makes no sense to me.

  • 5
    "I heard I might be forced..." Where on earth did you hear that? (Seriously, do you have a link for the exact claim being made?)
    – apsillers
    Oct 27 '16 at 16:09
  • Super late to respond, but it was a verbal conversation with a person at a meetup.
    – berto
    Dec 14 '17 at 20:59

In general, the GPL does not affect the output of a GPL-licensed program. From the GPL FAQ:

Is there some way that I can GPL the output people get from use of my program?For example, if my program is used to develop hardware designs, can I require that these designs must be free?

In general this is legally impossible; copyright law does not give you any say in the use of the output people make from their data using your program. If the user uses your program to enter or convert her own data, the copyright on the output belongs to her, not you. More generally, when a program translates its input into some other form, the copyright status of the output inherits that of the input it was generated from.

That is sufficient to show that the output of GnuPG is not automatically licensed under the GPL, so distributing such output within another work does not impose GPL requirements.

In your case, there is a further reason that a signature would not impose GPL requirements: I sincerely doubt that copyright law could ever recognize a cryptographic signature as a creative or derivative work. Cryptographic signing (which, as one of its steps, includes hashing) is a massively lossy transformation that completely destroys the original content of the work and is not designed to be reversed. As such, even if the GPL applied to the output of a GPL signing program (and again, it does not, per the FAQ item above), the output would not be eligible for copyright, so any copyright license such as the GPL would have no effect.

Finally, tivoization only applies if

  1. you are distributing a GPLv3-licensed program, and
  2. the program is intended to run on a specific hardware device, and
  3. the hardware of that device refuses to run an incorrectly signed executable.

As far as you've described your situation, absolutely none of those criteria apply to your case.

  • Cryptographic signing doesn't necessarily destroy the original content. One can distribute a program.tar.gz.asc alongside program.tar.gz ("gpg -abs program.tar.gz" creates the .asc, a.k.a. armored detached signature). It's akin to publishing an md5 or sha checksum with the file being signed. Oct 28 '16 at 23:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.