Dear Christian, thanks for answering my questions. I'll implement the suggested unlock path.
Best regards, Yegor On Mon, Nov 2, 2026 at 3:35 PM Christian Grothoff via libmicrohttpd <[email protected]> wrote: > > Dear Yegor, > > I think you're the first to raise this issue specifically. My view is > pretty simple: we are a GNU package and thus we care about the four > freedoms for the users of our software, which must include the freedom > to upgrade or patch MHD (say to fix vulnerabilities, very important also > under CRA). > > That said, this is NOT impossible to combine with locked-down firmware > for security: you _can_ have a lock on your firmware, as long as you > allow the user to remove that lock. Now, if the user does that, you can > at the same point say that this ends warranties or legal assurances > (like that you're allowed to drive the car on the street, or that your > router complies with spectrum frequency requirements for broadcast). > That's not against LGPL, you don't have to extend legal warranties to > users that exercise their freedom to tinker. > > And yes, you do need to inform the users about their rights under LGPL. > > Happy hacking! > > Christian > > On 11/2/26 3:20 PM, Yegor Yefremov via libmicrohttpd wrote: > > Hi Evgeny and Christian, > > > > to comply with CRA, the manufacturers have to use HTTPS and also use > > signed firmware images so nobody can make unauthorized changes to > > them. > > > > Let's look at MHD licensing when it comes to a TLS backend: > > > > As I understand it, an MHD2 build linked against OpenSSL 3 > > (Apache-2.0) can only be distributed under LGPL-3.0-or-later, while > > the GnuTLS build remains LGPL-2.1-or-later. However, GnuTLS itself > > depends on Nettle, GMP and libunistring, which are offered under > > "LGPLv3+ or GPLv2+". For a proprietary application, the GPLv2 option > > is not usable, so in practice both MHD2 TLS variants bring LGPLv3 > > components onto the device. > > > > And this is where the dilemma appears: > > > > LGPLv3 inherits the "Installation Information" requirement of GPLv3 > > section 6 for User Products. At the same time, the EU Cyber Resilience > > Act pushes manufacturers towards secure boot, signed updates and > > integrity protection. For devices that may count as User Products, > > this creates a tension that is difficult to resolve, and some > > customers (e.g. in automotive) exclude LGPLv3 from firmware entirely. > > > > These issues lead to the following questions: > > > > - Have other users or companies raised this issue with you, and how do > > you see it? > > - What is your view on using MHD2 in commercial and industrial > > products with locked-down firmware? Is this a use case you want to > > support? > > - Would you consider an additional permission under LGPLv3 section 7 > > regarding the Installation Information requirement, or do you see > > another way to address this? > > > > Thanks. > > > > Best regards, > > Yegor > >
