Slashdot Mirror
Microsoft Smartphone Code Signing and the GPL?
spacemonkey asks: "I am a professional developer, but in my spare time I have been developing games for the Microsoft Smartphone platform. Included in this work is a port of gnuboy a GPL gameboy colour emulator. Where does the GPL stand on the question of codesigning applications where required? Basically gnuboy is available, with full source for smartphone, however there are a large number of users out there who are unable/unwilling to remove the certification requirements from their smartphone devices, so to allow for these users, I need to sign the code. To enter into the code signing program will cost me approximately £500. I am interested in signing the application to make it available to a wider audience, however since I am not running a charity I was wondering whether charging some nominal fee for the code signed version was compatible with the GPL or not. So users would have an option on a signed version for less than £5, or an unsigned version free, which will include the full source code. Am I allowed to charge for GPL software in this way, where the charge is to cover the packaging of the application into a signed form?"
You can charge money for GPL software. You just have to make the source easily available. I think that would be covered by a URL in the about-box.
In fact, the signing works nicely in your favor, since nobody can undercut you on price. Or they can, but they too have to pay the L500, in which case they'd have to either 1) charge as much as you or 2) hate you enough to take an intentional loss. Both are a lot of hassel. Seems to me like you just win.
It's the Source Code you are only allowed to charge the reasonable 'media charge' for. The application itself you can charge anything you want. The idea of this is to prevent you from charging $5 for the Application, and $50,000 for the source... you know, open source and all.
However, I would wonder if the GNU folks would really be so thrilled that about it. After all, you're writing code for a platform that supports code-signing technology, which many people fear could greatly hamper the free software movement. So why support the platform? Perhaps you should consider writing games for more open-source-friendly platforms, like the Linux PDA's for example? Just a suggestion though.
Learn to Play Go
Besides showing MS your middle finger (which I think you should do) or charging everyone money. Why not just ask interested people to donate money until you have enough to pay the fee? You are only interested in not having to pay the fee yourself, I believe this is a fair plan.
If you want to make money of the deal, the Street Performer Protocol may work for you. This will be less risky because you don't have to front the £500 yourself. Another guy has one called The Rational Street Performer Protocol if it suits your tastes better.
"For an executable work, complete source code means all the source code for all modules it contains, plus any associated interface definition files, plus the scripts used to control compilation and installation of the executable."
Would the signing script be considered a script used to control compilation?
Hey, why won't it let me post this anonymously?
The GPL defines the source as "the preferred form of the work for making modifications to it." If the work includes the signature and you don't plan on distributing the private key (or can't, because the signing authority won't give it to you) then you are probably in violation. This makes sense--if the platform *only* accepted signed binaries, then users would be unable to make modifications to the program, which is an important freedom that the GPL is intended to protect. You might be okay if the signature can somehow be separated from the GPL'd work, but that's probably not likely for these phone apps.
Aside from that, if you're looking to recoup your 500 pounds for the signing fee, you might also be in for trouble since once someone buys a single copy, he can legally put up his own web site giving it out for free.
My "gut feeling" is that the signed version cannot be distributed under the terms of the GPL unless the recipient can generate it herself from the source code, including a signature.
Then again, if the unsigned version is functionally equivalent to the signed version, then someone savvy enough to compile it would also probably not need the signed version to begin with, they would turn off the signature checking (or whatever... I'm not familiar with the platform).
Probably the easiest thing to do is to contact the copyright holder(s), since it's their work, they will let you know if distributing code-signed versions is okay with them, regardless of the GPL. Basically they could give you a separate license, or include an exception in their license that allows code-signed versions if an identical non-signed version is available.
As for charging money, you can charge whatever you like. You could offer three versions: the signed one for $X, the unsigned for $Y, and the unsigned for $0. The last two would be identical and 100% GPL. The first one could just be a simple "no warranty, don't copy" non-free license to save yourself headaches.. if you get permission to do this from the gnuboy folks of course.
The "hard-line Free Software" approach would be to not distribute any kind of signed version at all, since it would interfere with people's rights to modify and re-distribute.
Sounds like a perfect job for the Ransom license: http://www.theoretic.com/Ransom
"You know, Hobbes, some days even my lucky rocketship underpants don't help" -- Calvin
Because you'd have to give the key out as well. (It's part of the source code, after all... You need it to compile the binary you give out.) Not only this, but anyone who receives it could go in turn redistribute his copy.
Why not try to get the authors to license it to you by a modified GPL? All you would have to add is an exception for redistributing the private key.
The better option sounds like getting others to front the 500 and get the authors to license it to you under a modified gpl for this case that allows binary redistribution with the sources for the unlocked code, and free binary redistribution under the same circumstances.
It doesn't matter if you can release it under the GPL signed. Release it under two sets of licensing terms, like MySQL. The licences:
unsigned version license: free, straight GPL; anyone can get the source and use it for anything they want, free as in speech and beer.
signed version licence: 5 pound charge, binary only, no redistribution allowed.
This might really fit the "spirit" of the GPL better than releasing a signed binary with GPLed source (but no key) where the user can't reproduce the exact executable from the source.
It's a port, he doesn't own it.
Bleah, I'm an idiot too.
Ask the Free Software Foundation, or ask a lawyer.
If all this should have a reason, we would be the last to know.
From the GPL:
Just wondering if the signing tool could fall in the highlighted category.
...at least not legally. Go read the EULA on the keys. Distributing the binary under the GPL requires shipping source, fine, but "mere aggregation" of the key does not force it under the GPL or grant Joe the right to redistribute the key.
...or get a request for your serial number, can you remember all 20 digits?), there is no GPL requirement that Bob distribute the key. If the key was necessary, Bob could not distribute his signed app under the GPL (he would have to sual-licence it), since the key would otherwise form part of the source.
This gets interesting for the GPL, since the key is not required to run the software on Microsoft-based phones (dial the emergency number, get a blue screen?
The bottom line is that Joe has to sign his own copy of app.
Sadly, this world contains enough dickheads that sooner or later, a Joe will appear on the scene. However, if we shut down the universe for fear of dickheads misusing their rights, the dickheads win (a pyrric victory, it's true, but probably a win in their eyes anyway).
Got time? Spend some of it coding or testing
Instead put up a site, manage to get slashdotted twice. Put up your non-signed version of the program and a donation link with your paypal email, allow donations of any amount and suggest $20. You keep a log of what accounts donated what (this is your payment history in paypal, not work). If the donations add up to $500 (or close enough your happy) then not only is your problem solved but you also know there is enough interest for the port. Keep the donation link of course, nobody expects you to turn it down if someone wants to say thankyou. If it doesn't add up to enough simply refund the money minus paypal fees.
Look, I know this -2 (Offtopic, Troll) but why in god's name are you developing applications for Windows phones? You should be building apps for J2ME. *All* of the major phone manufacturers (Nokia, Sony-Ericsson, Motorola, Siemens, etc) are already supporting J2ME - I can't count the number of models of phones that support J2ME on both hands, but I can count the number of Windows phones with no hands.
Switching to J2ME also solves your code-signing issue; you don't have to sign your programs at all.
/mike
-- "So, what's the deal with Auntie Gerschwitz et all?"
In the UK, Orange decided to go with code signing because of the concerns about virus' and the fact they could get some money from each application produced for it.
Microsoft merely provides the ability to enforce it, if the operator so desires.
Avantslash - View Slashdot cleanly on your mobile phone.