Let's say that an open-source project, such as a GNU GPL one, uses git-crypt and has added private, encrypted files, such as ssh private keys to the committed git repository.

Wouldn't John Doe be in his right to ask for the unciphered, plain-text, private key?

In other words, isn't adding encrypted files to GPL project a liability that one would not have with an MIT license?

  • 1
    It looks to me that an encrypted ssh private key is not a copyrightable work as defined in the GPL, so the GPL does not apply to that file, so John Doe has no rights to ask for anything based on the GPL. – wimh Dec 14 '19 at 11:54
  • 1
    The question you really need to be asking is “for a given project under the GPL, what is covered by the license?” because the answer isn’t clear - most GPL advocates will insist that the license covers everything someone needs to make an installable, runnable identical copy of a distributed binary, whether that is within the repository or not (so, build files or pipelines for example, if they are critical to the process), which may preclude anything that doesn’t apply directly to recreating a distributed binary file. – Moo Dec 14 '19 at 20:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.