Dear Yegor,I think you're the first to raise this issue specifically. My view is pretty simple: we are a GNU package and thus we care about the four freedoms for the users of our software, which must include the freedom to upgrade or patch MHD (say to fix vulnerabilities, very important also under CRA).
That said, this is NOT impossible to combine with locked-down firmware for security: you _can_ have a lock on your firmware, as long as you allow the user to remove that lock. Now, if the user does that, you can at the same point say that this ends warranties or legal assurances (like that you're allowed to drive the car on the street, or that your router complies with spectrum frequency requirements for broadcast). That's not against LGPL, you don't have to extend legal warranties to users that exercise their freedom to tinker.
And yes, you do need to inform the users about their rights under LGPL. Happy hacking! Christian On 11/2/26 3:20 PM, Yegor Yefremov via libmicrohttpd wrote:
Hi Evgeny and Christian, to comply with CRA, the manufacturers have to use HTTPS and also use signed firmware images so nobody can make unauthorized changes to them. Let's look at MHD licensing when it comes to a TLS backend: As I understand it, an MHD2 build linked against OpenSSL 3 (Apache-2.0) can only be distributed under LGPL-3.0-or-later, while the GnuTLS build remains LGPL-2.1-or-later. However, GnuTLS itself depends on Nettle, GMP and libunistring, which are offered under "LGPLv3+ or GPLv2+". For a proprietary application, the GPLv2 option is not usable, so in practice both MHD2 TLS variants bring LGPLv3 components onto the device. And this is where the dilemma appears: LGPLv3 inherits the "Installation Information" requirement of GPLv3 section 6 for User Products. At the same time, the EU Cyber Resilience Act pushes manufacturers towards secure boot, signed updates and integrity protection. For devices that may count as User Products, this creates a tension that is difficult to resolve, and some customers (e.g. in automotive) exclude LGPLv3 from firmware entirely. These issues lead to the following questions: - Have other users or companies raised this issue with you, and how do you see it? - What is your view on using MHD2 in commercial and industrial products with locked-down firmware? Is this a use case you want to support? - Would you consider an additional permission under LGPLv3 section 7 regarding the Installation Information requirement, or do you see another way to address this? Thanks. Best regards, Yegor
OpenPGP_0xF757745E6F890E90.asc
Description: OpenPGP public key
