Open Source Stack Exchange is a question and answer site for people organizing, marketing or licensing open source development projects. It only takes a minute to sign up.
Sign up to join this community
Suppose I come across Project X on the Internet, which is released under the GNU GPL. I want to compile Project X into a strong-named .NET assembly, which is a type of cryptographically signed binary, and then distribute this .NET assembly.
If I do this, am I required to also distribute the private key that I used to sign the binary, or can I keep the private key private?
The GPL requires you to distribute the source and "must require no special password or key for unpacking, reading or copying". However, merely signing a binary does not prevent someone from using it without the corresponding private key (or public key, for that matter). And the private key should not be considered part of the program.
From what I can fined on their web site, it depends on your intentions.
If it's only signing to verify that the user got your version, then no, you don't have to give up the key. GPLv3 FAQ: https://www.gnu.org/licenses/gpl-faq.html#GiveUpKeys
If it is "Tivoization", i.e. signing a modified version the software is required to run the modified version of the software. Then yes, you have to provide the signing key. GPLv3 FAQ: https://www.gnu.org/licenses/gpl-faq.html#Tivoization and https://www.gnu.org/licenses/gpl-faq.html#TwoPartyTivoization
