code signing with foreign function interface?

[joakim@verona.se]

The GPL cannot prevent free and non-free code being distributed
together. Therefore a distributor can push GPL non-compliance to an
unknowing user.

If code signing of dynamic libraries is employed, the end-user can be
made aware he is breaking the intentions of the GPL. Would this be
enough to satisfy the requirements for an Emacs FFI?

Recently I was involved in a project which made me understand better why
dynamic linking might be problematic for a free project. Also I didn't
find a mention of this particular approach to an Emacs FFI, so that's why
I (probably mistakenly) bring up this subject again.

Here are some statements the list might want to refute or confirm:

- While DRM is evil, code signing is not in itself.

- Supporting code signing in Emacs should be simple on some platforms,
but maybe not all interesting ones.

- Removing the code-signing check is of course trivial, but no more
trivial than adding a FFI to Emacs withouth checks today.

- We don't necessarily need a complete secure infrastructure for this. A
  simple solution might be to check for the presence of a form of GNU
  license in binary form in the dll. This particular GNU license is
  itself protected by copyright and cannot be combined with other works
  without creating a derived work. This signature might be added
  to an existing dll by code signing. While this is of course
  circumventable, I dont see that it opens any new holes.


-- 
Joakim Verona