4

I would like to deploy OpenSSL, curl and perhaps other libraries as shared libraries in my package. I am a little worried that the someone may replace them with his own and "read" all my data, therefore I thought perhaps signing them would be an idea. Is this allowed?

P.S. I've read their licenses but there is no specific mention about this, so better to ask.

  • Related answer from SoftwareEngineering.SE: Signing redistributed files Although... in this case, you're not even distributing the signatures or binaries! Other than the network-use condition in the AGPL, I can't think of any open source license that restricts what you can do with your own private execution and/or modification of the code. – apsillers Sep 11 '17 at 16:07
  • 1
    What is the purpose you want to use the signature for? – Bart van Ingen Schenau Sep 11 '17 at 16:10
  • The purpose is to verify that the openssl and curl binaries are the one provided by me, and not replaced by someone else. So the main application checks their signatures before loading and using them. I sign a lot of binaries in my app(Unix app, I have a special in-house tool for signing), but not the 3rd party ones because I am not sure I am allowed to, from a legal perspective. – Taw Sep 11 '17 at 16:44
  • Debian signs all of their packages. @apsillers The Open Source definition and the Free Software definition prohibit “restrict what you can do”, that is why you know of none. – ctrl-alt-delor Sep 12 '17 at 12:07
  • 1
    What is the license of the shared libraries? If you are distributing signed libraries and any library is licensed under the GPL or LGPL, this might violate the license when your signature check prevents users of linking their modified versions. This DRM-like signature check but not the signature itself might be problematic. For more liberal licenses (MIT, Apache, and so on) I can't see a problem even for a check. Likewise there's no problem if the signed libraries are only used internally or if the signature check is optional. – amon Sep 12 '17 at 21:30
7

A signature is a non-reversible (but verifiable) cryptographic transformation on some input data. Signatures are not copyrightable since

  1. they do not require any creativity to produce (their creation is completely mechanical) and they do not contain any creativity themselves (it's just an arbitrary numerical value), and
  2. any copyrightable elements (indeed, any identifiable properties at all) from the input are completely and deliberately absent in the output of a signature algorithm (this is in contrast to compilation, which is purely mechanical but preserves the copyrightable, creative elements of its input)

Thus, anything a copyright license has to say about what the copyright holder does and does not allow you to do does not pertain to the creation of a cryptographic signature. In copyright terms, its analogous to the creation of a cryptographic hash. (And in case you're wondering if copyright can disallow you from distributing a hash: no, it cannot; you are always allowed to do that under copyright.)

As for whether or not you are allow to attach a signature to a binary (as opposed to keeping it separate), that's perhaps a slightly different legal question. That might or might not create a derivative work (even though the signature itself is devoid of copyright, some jurisdictions might view such an alteration as a derivative), but even if it is, any open source or free software license will allow you to make and distribute such an alteration.

In case you are concerned that your production of a signature might misrepresent you as the author of the work, that's not what signatures are for. Signatures just say, "Entity X had access to this work and asserts its contents are Y." After a recipient verifies the cryptographic validity of the signature and sees that the contents of the file are indeed still Y, the recipient can be sure it has not been changed from how it looked when Entity X had it, even if it first passed through the hands of Entities Y and Z.

No one ever asserted that Entity X was the author of the file. We can only be sure that Entity X had access to the file and chose to make a cryptographically unforgeable assertion about the state of the file at that time.

| improve this answer | |
  • Thank you for such a complete answer. Yes, I was worried that the signing would alter the binary and then it would be understood that I modified it somehow without the author consensus. Which would not be legal.:) – Taw Sep 11 '17 at 19:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.