I dunno, but it seems to me that this thread ran off the rails right at the start.
It would be the end of the App Store if it were possible to strip the code signature out of a downloaded app and then just run it. However, what happens after the code signature is tampered with is going to depend on what happens to the MAS receipt when the code signature is tampered with. (I have to assume that the receipt won’t be usable any more, otherwise that seems to open up a too easy security hole in itself.) Anyway, I think the only viable way to let the purchaser substitute a rebuilt framework is to package the LGPL framework separately, and have it placed in /Library/Frameworks rather than inside the app bundle. Presumably that would satisfy the LGPL. (It’ll also require an installer.) Unfortunately, that isn’t terribly viable either. In order to prevent conflicts between apps doing this with different versions or derivations of the LGPL code, the LGPL framework would have to have a unique name, which means it’s going to take a custom make file (at least) to build it, which means it’s always a derivative build, and you’re going to have to post instructions somewhere about how to build it. But it’s worse than that. Open source libraries are *frequently* ABI-incompatible between versions. When you choose a particular version to use with your app, you have no particular guarantee that the source code of your version is going to continue to be available at the repository where you found it, or anywhere else. For that reason, to satisfy the LGPL you’ll have to maintain a public site with the source code so that *your* version can be rebuilt. Lastly, I seem to recall that it was a bit doubtful whether the MAS’s intellectual property rules allowed even LGPL software to be part of MAS apps. Perhaps that’s long been resolved, but you’ve gotta be worried that the MAS rules are yet another legal cloud threaten to rain on the open source parade. I’d be very happy to be proved wrong on any of this. _______________________________________________ Cocoa-dev mailing list (Cocoa-dev@lists.apple.com) Please do not post admin requests or moderator comments to the list. Contact the moderators at cocoa-dev-admins(at)lists.apple.com Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/cocoa-dev/archive%40mail-archive.com This email sent to arch...@mail-archive.com
