12 ms·

For those wondering why Apple is allergic to GPLv3 code: there is a clause in the license requiring you provide a way to run modified version of the software wh

For those wondering why Apple is allergic to GPLv3 code: there is a clause in the license requiring you provide a way to run modified version of the software which would require Apple to let users self sign executables.

ajross 7y ago
> let users self sign executables Which is to say, "let users run their own software". There's value in formal authentication of third party software as a default configuration, but let's not pretend that's what lockdown is about.
- TylerE 7y ago
  Not at all. You've always been able to run your own software. At worst, it's toggling one option off in preferences that stays off forever thereafter.
  - 1over137 7y ago
    Not anymore. Since 10.12 Sierra the GUI option to turn off Gatekeeper is gone, you have to use command line to turn it off. And now App Notarization is making it harder still to run your own software.
    - sitharus 7y ago
      How so? I can run anything I like via the command line, and right-click -> Open still launches unsigned executables. Sure there are warnings, but that's not hard to get past.
      - ajross 7y ago
        > I can run anything I like via the command line The discussion is literally about replacing the default shell...
        darkpuma 7y ago
        I don't see how that's relevant to this subdiscussion, since the switch from bash to zsh won't effect what he's talking about.
      - 0x0 7y ago
        Only for local administrator user accounts I believe
    - saagarjha 7y ago
      GateKeeper only applies to software you download from the internet, and only then in a couple of very specific cases.
icedchai 7y ago
Sorry, how is that a problem? Users can build and execute code on their own Mac with XCode.
- Cyberdog 7y ago
  I don't really understand the licensing issues that well, but if what the poster above you said is true, I wouldn't really want to have to sign software that ships with my computer when it should just run out of the box.
  - musicale 7y ago
    I don't understand why GPLv3 would be a problem on macOS. On macOS, you can run anything out of the box (depending on security/gatekeeper settings) and you can replace or modify system executables (such as /bin/bash) if you turn off SIP (which is slightly tricky to do but can be done from recovery mode.) Running your own customized /usr/local/bin/bash is easy of course, and package managers like MacPorts or Brew make it simple to install various shells including the latest bash. On iOS, however, there might be an issue, as you have to sign executables with XCode, but unfortunately Apple reduced free developer provisioning profiles from one year down to two weeks in order to block third-party app stores and malware, and to get more people to sign up for the paid developer program. Moreover, there is also no Apple-sanctioned way to modify system executables that I am aware of.
    - 1over137 7y ago
      Did you notice how many qualifiers you had there? The trend on macOS is clear: harder and harder to run/do anything that isn't blessed by Apple.
      - Wowfunhappy 7y ago
        SIP and Gatekeeper and one-time commands. I find disabling SIP to be much less painful than enabling unsigned drivers in Windows. I wouldn't even classify turning off SIP as "slightly tricky". You boot into recovery mode, open the terminal, type in two words, and press enter. Besides, this is separate from the GPLv3 question. You can absolutely recompile bash and replace macOS's version with your own, so I don't understand why this is a problem for Apple.
AaronFriel 7y ago
So, Homebrew? You can't tell me that Microsoft is able to ship entire distribution's userlands (Debian, Ubuntu, SUSE, and more) through the Windows Store, including all their GPL3 components, and Apple can't figure out how to ship an updated version of base64. If I'm grumbling, it's just because making devops/CI scripts work on Windows and Linux is easier than MacOS and Linux these days because my colleagues run into issues like "base64" or "uuidgen" having different arguments in the extremely dated MacOS userland, and they then have to brew install a bunch of isolated components.
- asdfv09s9d80fu9 7y ago
  How's using homebrew any of this different than being able to run "base64" and "uuidgen" on Windows? It's not like either of those applications are part of a Windows installation anyway.
  - AaronFriel 7y ago
    That's my point. Why can't Apple ship an updated userland built in, through the Store, or as a download triggered by a command line (like XCode is).
    - oneplane 7y ago
      Because GPL v3 says you have to run modified binaries and that means Apple has to give its private keys.
      - saagarjha 7y ago
        No? You just resign the binary with your key.
        patates 7y ago
        I'm sorry, this is totally off-topic but I had to re-read your comment 5 times until it became apparent that you meant re-sign, not surrender. English is funny sometimes (especially when you're not a native speaker like me:) ).
aasasd 7y ago
I've been building software with Homebrew for ages, where does signing come in?
- danieldk 7y ago
  The default bash on macOS is protected using SIP. Files covered by SIP can only be replaced by Apple-signed updates. (Of course, one could disable SIP altogether.)
  - aasasd 7y ago
    Somehow I don't think GPLv3 presumes that you'll replace system files. And I'm using Homebrew versions of system-bundled utils just fine without overwriting them.
  - tobylane 7y ago
    The bash4 from homebrew is installed to a different place to the system bash, and even when you switch to it as your login shell the system bash is still accessible. The homebrew design is never to overwrite system programs but to have same named alternatives higher in $path.
mwfunk 7y ago
I don't believe this to be true, and I don't know where this comes from. Their documented GPLv3 reluctance predated code signing on their platforms by many years. FWIW, GPLv3 was controversial even amongst GPLv2 advocates for all sorts of reasons, never mind amongst actual lawyers. No conspiracy theories required, even if you disagree with their position. The Linux kernel and many other non-GNU projects never updated to GPLv3 and it had nothing to do with enforcing anyone's walled gardens.
- deleted 7y ago
  [deleted]
- mrpippy 7y ago
  Agreed. I think the GPLv3 patent clauses were and are a much bigger problem with Apple legal
  - lloeki 7y ago
    Indeed, and there is already a facility to replace code/binaries without signing: disable SIP.
  - maheart 7y ago
    I'd disagree (I agree with the original post). Apache 2 requires a patent grant and I've heard very few instances of this license being avoided (besides the OpenBSD folk). I really do think the fear of GPLv3 comes from the anti-Tivovization requirement -- which would essentially require that 3rd parties (e.g. me) be allowed to install modifications (e.g. modified libs/binaries) of a GPLv3 application onto the controlled iPhone.
saagarjha 7y ago
This reason doesn't make sense, though: I can modify, replace, and overwrite the bash that comes with the system, and self sign it with a certificate of my choosing.
- e40 7y ago
  How do you make a certificate to self sign without going through Apple?
  - saagarjha 7y ago
    Keychain Access should let you do this.
  - plorkyeran 7y ago
    You only need Apple's help if you want to be able to run the binary on another machine without installing your cert on that machine.
chrisfinazzo 7y ago
Why is self signing a problem? Keychain Access (macOS's password utility) has allowed this capability for years. It's possible someone could self sign malicious things, but I'd consider that a separate - if related - problem. I suspect they also recognize that applying the GPL would force them to release things they otherwise consider private.

ajross 7y ago

> let users self sign executables Which is to say, "let users run their own software". There's value in formal authentication of third party software as a default configuration, but let's not pretend that's what lockdown is about.

TylerE 7y ago
Not at all. You've always been able to run your own software. At worst, it's toggling one option off in preferences that stays off forever thereafter.
- 1over137 7y ago
  Not anymore. Since 10.12 Sierra the GUI option to turn off Gatekeeper is gone, you have to use command line to turn it off. And now App Notarization is making it harder still to run your own software.
  - sitharus 7y ago
    How so? I can run anything I like via the command line, and right-click -> Open still launches unsigned executables. Sure there are warnings, but that's not hard to get past.
    - ajross 7y ago
      > I can run anything I like via the command line The discussion is literally about replacing the default shell...
      - darkpuma 7y ago
        I don't see how that's relevant to this subdiscussion, since the switch from bash to zsh won't effect what he's talking about.
    - 0x0 7y ago
      Only for local administrator user accounts I believe
  - saagarjha 7y ago
    GateKeeper only applies to software you download from the internet, and only then in a couple of very specific cases.

icedchai 7y ago

Sorry, how is that a problem? Users can build and execute code on their own Mac with XCode.

Cyberdog 7y ago
I don't really understand the licensing issues that well, but if what the poster above you said is true, I wouldn't really want to have to sign software that ships with my computer when it should just run out of the box.
- musicale 7y ago
  I don't understand why GPLv3 would be a problem on macOS. On macOS, you can run anything out of the box (depending on security/gatekeeper settings) and you can replace or modify system executables (such as /bin/bash) if you turn off SIP (which is slightly tricky to do but can be done from recovery mode.) Running your own customized /usr/local/bin/bash is easy of course, and package managers like MacPorts or Brew make it simple to install various shells including the latest bash. On iOS, however, there might be an issue, as you have to sign executables with XCode, but unfortunately Apple reduced free developer provisioning profiles from one year down to two weeks in order to block third-party app stores and malware, and to get more people to sign up for the paid developer program. Moreover, there is also no Apple-sanctioned way to modify system executables that I am aware of.
  - 1over137 7y ago
    Did you notice how many qualifiers you had there? The trend on macOS is clear: harder and harder to run/do anything that isn't blessed by Apple.
    - Wowfunhappy 7y ago
      SIP and Gatekeeper and one-time commands. I find disabling SIP to be much less painful than enabling unsigned drivers in Windows. I wouldn't even classify turning off SIP as "slightly tricky". You boot into recovery mode, open the terminal, type in two words, and press enter. Besides, this is separate from the GPLv3 question. You can absolutely recompile bash and replace macOS's version with your own, so I don't understand why this is a problem for Apple.

AaronFriel 7y ago

So, Homebrew? You can't tell me that Microsoft is able to ship entire distribution's userlands (Debian, Ubuntu, SUSE, and more) through the Windows Store, including all their GPL3 components, and Apple can't figure out how to ship an updated version of base64. If I'm grumbling, it's just because making devops/CI scripts work on Windows and Linux is easier than MacOS and Linux these days because my colleagues run into issues like "base64" or "uuidgen" having different arguments in the extremely dated MacOS userland, and they then have to brew install a bunch of isolated components.

asdfv09s9d80fu9 7y ago
How's using homebrew any of this different than being able to run "base64" and "uuidgen" on Windows? It's not like either of those applications are part of a Windows installation anyway.
- AaronFriel 7y ago
  That's my point. Why can't Apple ship an updated userland built in, through the Store, or as a download triggered by a command line (like XCode is).
  - oneplane 7y ago
    Because GPL v3 says you have to run modified binaries and that means Apple has to give its private keys.
    - saagarjha 7y ago
      No? You just resign the binary with your key.
      - patates 7y ago
        I'm sorry, this is totally off-topic but I had to re-read your comment 5 times until it became apparent that you meant re-sign, not surrender. English is funny sometimes (especially when you're not a native speaker like me:) ).

aasasd 7y ago

I've been building software with Homebrew for ages, where does signing come in?

danieldk 7y ago
The default bash on macOS is protected using SIP. Files covered by SIP can only be replaced by Apple-signed updates. (Of course, one could disable SIP altogether.)
- aasasd 7y ago
  Somehow I don't think GPLv3 presumes that you'll replace system files. And I'm using Homebrew versions of system-bundled utils just fine without overwriting them.
- tobylane 7y ago
  The bash4 from homebrew is installed to a different place to the system bash, and even when you switch to it as your login shell the system bash is still accessible. The homebrew design is never to overwrite system programs but to have same named alternatives higher in $path.

mwfunk 7y ago

I don't believe this to be true, and I don't know where this comes from. Their documented GPLv3 reluctance predated code signing on their platforms by many years. FWIW, GPLv3 was controversial even amongst GPLv2 advocates for all sorts of reasons, never mind amongst actual lawyers. No conspiracy theories required, even if you disagree with their position. The Linux kernel and many other non-GNU projects never updated to GPLv3 and it had nothing to do with enforcing anyone's walled gardens.

deleted 7y ago
[deleted]
mrpippy 7y ago
Agreed. I think the GPLv3 patent clauses were and are a much bigger problem with Apple legal
- lloeki 7y ago
  Indeed, and there is already a facility to replace code/binaries without signing: disable SIP.
- maheart 7y ago
  I'd disagree (I agree with the original post). Apache 2 requires a patent grant and I've heard very few instances of this license being avoided (besides the OpenBSD folk). I really do think the fear of GPLv3 comes from the anti-Tivovization requirement -- which would essentially require that 3rd parties (e.g. me) be allowed to install modifications (e.g. modified libs/binaries) of a GPLv3 application onto the controlled iPhone.

saagarjha 7y ago

This reason doesn't make sense, though: I can modify, replace, and overwrite the bash that comes with the system, and self sign it with a certificate of my choosing.

e40 7y ago
How do you make a certificate to self sign without going through Apple?
- saagarjha 7y ago
  Keychain Access should let you do this.
- plorkyeran 7y ago
  You only need Apple's help if you want to be able to run the binary on another machine without installing your cert on that machine.

chrisfinazzo 7y ago

Why is self signing a problem? Keychain Access (macOS's password utility) has allowed this capability for years. It's possible someone could self sign malicious things, but I'd consider that a separate - if related - problem. I suspect they also recognize that applying the GPL would force them to release things they otherwise consider private.