Hacker News Reader

> can technically go replace the class files corresponding to the LGPLv2 library in your apk

APKs in the Android app store MUST be cryptographically signed. So, it is impossible.

The only practical solution that an LGPL license provides for Android apps is to fall back to the viral GPL license.

But you don't have to publish that modified apk to Play Store. You can just sign it with your own key and install the apk manually, no root needed.

I know there are some apps that do its own cryptographic signature verification on their own, but most apps don't do that, so replacing a LGPL library in an APK is actually feasible in most cases. It is not hard to do so either.

They must be signed to be on the store, but I don't think it's impossible to run unsigned apks on the device (maybe you need the developer mode, though).

But even then, wouldn't that count like tivoization? LGPLv3 says you need to provide instructions to replace the lib, but LGPLv2 does not. Couldn't I say "I honor the LGPLv2, because it would be technically possible to update the library, but unfortunately for you it is behind some tivoization that you would need to break first"?

Reply on news.ycombinator.com