[Top][All Lists]
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
code signing with foreign function interface?
From: |
joakim |
Subject: |
code signing with foreign function interface? |
Date: |
Sun, 07 Mar 2010 07:24:47 +0100 |
User-agent: |
Gnus/5.13 (Gnus v5.13) Emacs/23.1.90 (gnu/linux) |
The GPL cannot prevent free and non-free code being distributed
together. Therefore a distributor can push GPL non-compliance to an
unknowing user.
If code signing of dynamic libraries is employed, the end-user can be
made aware he is breaking the intentions of the GPL. Would this be
enough to satisfy the requirements for an Emacs FFI?
Recently I was involved in a project which made me understand better why
dynamic linking might be problematic for a free project. Also I didn't
find a mention of this particular approach to an Emacs FFI, so that's why
I (probably mistakenly) bring up this subject again.
Here are some statements the list might want to refute or confirm:
- While DRM is evil, code signing is not in itself.
- Supporting code signing in Emacs should be simple on some platforms,
but maybe not all interesting ones.
- Removing the code-signing check is of course trivial, but no more
trivial than adding a FFI to Emacs withouth checks today.
- We don't necessarily need a complete secure infrastructure for this. A
simple solution might be to check for the presence of a form of GNU
license in binary form in the dll. This particular GNU license is
itself protected by copyright and cannot be combined with other works
without creating a derived work. This signature might be added
to an existing dll by code signing. While this is of course
circumventable, I dont see that it opens any new holes.
--
Joakim Verona
Re: code signing with foreign function interface?, Eli Zaretskii, 2010/03/07
Re: code signing with foreign function interface?, Richard Stallman, 2010/03/08