2

For simplicity lets say i created a Server-Client programm which uses libraries under the GNU license. My understanding is that i now have to give everyone who asks my full client source-code and because the client communicates with the server also the server-source code.

My problem with that is, running server-Side there are configuration files(simple txt files an the like) wich include encryption configuration (memory cost, time cost, salt, pepper, hash lenght), without those the source code is not working.

Now my Questions
Do i also have to publish these configuration files?
Or is it enough to "just" publish the full (non working) server Source code, and the (working) client source code?


more detail:

configuration files on the server also include

-where the database is located
-initializing the database(commands to create all tables)
-time each user is allowed per session

The programm is pretty much working with Remote Method Invocation.

1 Answer 1

3

Usual practice is to do one or more of these:

  1. Make your project work without configuration, by having good default options. (But this doesn't sound like an option for your project.)
  2. Include a template for the configuration file and document that people have to copy and rename it, and then put in their proper values.
  3. Have a script which interactively asks for the config values and then builds the config file.
1
  • 2
    For #1, of course the server can't work without crypto keys, and using default keys would be disastrous, but it can have a set of default settings used to generate those keys if they are not present. Apr 24, 2020 at 7:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.