3

We have a closed source software written in C# that we sell. All of our assemblies are signed. We want to use a third party assembly, that is published under the GNU Lesser General Public License v2.1. As all our assemblies are signed, we need the third party assembly to be signed. Are we allowed, to compile the library and to sign it, so we can use it in our signed.

4

Firstly, and this is important, IANAL/IANYL. If you are betting a business on this idea, you had better get some proper legal advice, and not rely solely on postings by random strangers on internet fora.

That said, the interesting point here is the code signing. One of the major differences between GNU GPLv3 and GNU GPLv2 (I know your question is about LGPL; bear with me) is the anti-tivoisation language in GPLv3, which says

If you convey an object code work under this section in, or with, or specifically for use in, a User Product [...] the Corresponding Source conveyed under this section must be accompanied by the Installation Information.

[...]

"Installation Information” for a User Product means any [...] authorization keys [...] required to install and execute modified versions of a covered work in that User Product from a modified version of its Corresponding Source.

If such language were in LGPLv2, it would strongly suggest that you'd need to include code-signing keys. However, no such language is to be found in LGPLv2, so as far as I can tell you may ship your signed binary-only application, along with a signed object-code version of the LGPL'ed library ("the library"), provided that you also

Accompany the work with the complete corresponding machine-readable source code for the Library including whatever changes were used in the work (which must be distributed under Sections 1 and 2 above) and, if the work is an executable linked with the Library, with the complete machine-readable "work that uses the Library", as object code and/or source code, so that the user can modify the Library and then relink to produce a modified executable containing the modified Library (GNU LGPL v2.1 s6)

That is, you need to provide the source of the library, and your code in object form, ready for re-linking (there are other s6 obligations you could fulfil instead, but they seem to me to amount to the same thing except 6b, which you can't go for because you're distributing a custom (signed) copy of the library). The fact that the user cannot run this modified executable because it is unsigned doesn't seem to present a problem.

  • @scher: I would like to add that not being able to run the program with a modified (unsigned) version of the library might not be a legal problem, but it can result bad publicity and losing part of your user-base, because it goes against the spirit of the (L)GPL. That is also something to take into account. – Bart van Ingen Schenau Nov 7 '17 at 16:46
  • @BartvanIngenSchenau I'm not sure I agree. It would go against the spirit (and indeed the letter) of the GPL, for sure. But LGPL? That's specifically intended to allow proprietary software to be linked against it, without extending strong copyleft protections. If someone chose to release a library under those terms, I'm not sure we can have confidence that they intended to maximise user freedom in the way you describe. – MadHatter Nov 7 '17 at 17:28
  • 1
    I didn't mean that the entire program needs to be free. I meant that it is the intention (to my knowledge) of the LGPL that you can replace the LGPL library in an otherwise closed-source program and still have a chance at a working program. Using technical measures to render a program with replaced LGPL library inoperable would go against that spirit. – Bart van Ingen Schenau Nov 7 '17 at 17:48
  • @BartvanIngenSchenau that's clearer, then, and though I still don't agree with you (neither LGPL 2.1 or 3 has the clear anti-Tivoisation language of GPLv3) I think the point is certainly capable of argument. – MadHatter Nov 7 '17 at 20:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.