Giving up your keys [LWN.net]

Giving up your keys

Posted Aug 4, 2005 18:01 UTC (Thu) by man_ls (subscriber, #15091)
In reply to: Giving up your keys by MathFox
Parent article: Wiring DRM into the system

My point, apart from being a bit bogus itself, was not clear either. It may be integral to the process that you sign the executable; but the particular key that you use is not. You can choose a prime number (or a couple of them) at random, and you can use that to sign the package / executable / kernel / whatever. If you need a signed certificate, go to whomever signs them.

And then you complain that you cannot run it on your machine, because your hardware vendor is an evil company and has locked it up. The software vendor will say: "Well, that is not my problem; find another machine which accepts your signature (credentials) or build it yourself or forget about it. You have the source code, so suit yourself." You are in the jury; what would you say?

You can build a case for a judge, but IMHO you might as well complain that you need the root password to build and install a program, and Red Hat did not provide it.

(Log in to post comments)

Giving up your keys

Posted Aug 6, 2005 22:30 UTC (Sat) by giraffedata (subscriber, #1954) [Link]

I believe the argument that GPL requires the distributor to supply his signing key is this:

GPL says that if I give you a binary, I must also give you all the source material needed to build that binary. Not just a similar binary; the one I actually gave you. I have to give you the scripts that contain the linker options I used, for one thing. Giving you the signing key isn't much of a stretch from that.

You can argue technically either way, but the spirit of the GPL is that the recipient of a binary is supposed to be able to make useful modifications. Shipping a binary that works only because it's signed with a key the recipient doesn't know clearly does an end run around that goal and produces the same result as shipping object code without source.