Suppose I come across Project X on the Internet, which is released under the GNU GPL. I want to compile Project X into a strong-named .NET assembly, which is a type of cryptographically signed binary, and then distribute this .NET assembly.

If I do this, am I required to also distribute the private key that I used to sign the binary, or can I keep the private key private?

2 Answers 2


The GPL requires you to distribute the source and "must require no special password or key for unpacking, reading or copying". However, merely signing a binary does not prevent someone from using it without the corresponding private key (or public key, for that matter). And the private key should not be considered part of the program.


From what I can fined on their web site, it depends on your intentions.

If it's only signing to verify that the user got your version, then no, you don't have to give up the key. GPLv3 FAQ: https://www.gnu.org/licenses/gpl-faq.html#GiveUpKeys

If it is "Tivoization", i.e. signing a modified version the software is required to run the modified version of the software. Then yes, you have to provide the signing key. GPLv3 FAQ: https://www.gnu.org/licenses/gpl-faq.html#Tivoization and https://www.gnu.org/licenses/gpl-faq.html#TwoPartyTivoization

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.