LGPL licenses on libraries about tkey-ssh-agent HOT 2 CLOSED

Very good comment. Thank you.

This has been discussed internally and we decided to keep things GPLv2-only.

from tkey-ssh-agent.

Tough call. The first question I would ask, is what are the expected consequences of strong copyleft? From the outside, my first guess would be "pretty tame":

• From what I could see your programs and libraries are nice and small. This should make them easy to rewrite. Actual crypto primitives may be hard, but upstream Monocypher is already permissively licenced.
• From what I can guess your protocols (from Key to host) are simple and easy to re-implement. Not being able to use a Go package likely means a couple days of work at worst.
• Build systems and tool chains’ licences don’t restrict the choice of licence for their users.

Potentially more problematic is the firmware. What if device programs are derived works of the firmware? Personally I have my doubts: locked down firmware is technically closer to immutable microcode than a library. But I’m not a lawyer, so maybe you want a special exception just in case. Avoid the LGPL one however, since it’s not clear what "dynamic linking" even means in this context. You don’t want a surprise along the lines of _"achktualllyy , TKey firmware is not dynamically linked to device programs, all your secret sauce are belong to the community now."

Another potential problem is the (almost) Tivoization of locked down TKeys, but you already solved that one by using GPLv2 instead of v3.

Tentative advice: first, try to verify whether you’re losing sales to copyleft to begin with.

from tkey-ssh-agent.