4 ms·

That article mentions nothing about code signing, and it's well known that the GPL 2 doesn't have anything that would prevent Tivoization.

pabs3 5y ago
> That article mentions nothing about code signing From the article: "... it appears that a full trusted boot chain (TF-A) is implemented from the early stage ROM bootloader all the way down to the Linux operating system." > the GPL 2 doesn't have anything that would prevent Tivoization. From the GPLv2: "... plus the scripts used to control compilation and installation of the executable." https://www.gnu.org/licenses/old-licenses/gpl-2.0.html https://www.gnu.org/licenses/old-licenses/gpl-2.0.html From the Software Freedom Conservancy blog post about the GPLv2 installation requirements: "GPLv2 assures, to the purchaser of an embedded product, their absolute right to receive the information necessary to install a modified version of the GPLv2'd works." https://sfconservancy.org/blog/2021/mar/25/install-gplv2/From https://sfconservancy.org/blog/2021/mar/25/install-gplv2/Fro... Of course, that doesn't mean that the proprietary software must continue to function after modifying the GPL software, apparently even the GPLv3 allows what Tivo did. From a presentation about GPLv3 on cars: "Ironically, even if Linux were GPLv3, Tivo’s method of crypto- lock-down would likely comply with GPLv3." https://events19.linuxfoundation.org/wp-content/uploads/2017/11/Safely-Copylefted-Cars-Reexamining-GPLv3-Installation-Information-Requirements-ALS-Bradley-Kuhn-Behan-Webster-1.pdf https://events19.linuxfoundation.org/wp-content/uploads/2017...
- outsomnia 5y ago
  "Tivoization" is a word because GPL2 does not say you must be given signing keys that allow your modified image to be accepted and executed by the device, these are not covered by "scripts used to control compilation and installation of the executable".
  - pabs3 5y ago
    GPLv2 requires the practical ability to modify GPL software on the device, whether or not signing keys are mentioned explicitly is irrelevant. I suggest you re-read the Conservancy blog post I linked above and scan through the GPLv3 in cars presentation.
- kmeisthax 5y ago
  I knew the GPLv3 Installation Instructions requirements were narrow (enough that I don't think it's actually a barrier to, say, bundling GPL code with an iOS app), but "anti-TiVo so weak it wouldn't stop TiVo" is a TIL.
  - pabs3 5y ago
    TBH despite being a GPL zealot I think it is a fairly reasonable compromise to allow proprietary software to delete itself or stop itself from working if a user updates the GPL software. OTOH, the LGPL does not allow that, you have to allow re-linking with the proprietary code, so there is precedent the other way too. IIRC the issue with GPL and iOS was that the GPL was/is incompatible with the App Store ToS.

pabs3 5y ago

> That article mentions nothing about code signing From the article: "... it appears that a full trusted boot chain (TF-A) is implemented from the early stage ROM bootloader all the way down to the Linux operating system." > the GPL 2 doesn't have anything that would prevent Tivoization. From the GPLv2: "... plus the scripts used to control compilation and installation of the executable." https://www.gnu.org/licenses/old-licenses/gpl-2.0.html https://www.gnu.org/licenses/old-licenses/gpl-2.0.html From the Software Freedom Conservancy blog post about the GPLv2 installation requirements: "GPLv2 assures, to the purchaser of an embedded product, their absolute right to receive the information necessary to install a modified version of the GPLv2'd works." https://sfconservancy.org/blog/2021/mar/25/install-gplv2/From https://sfconservancy.org/blog/2021/mar/25/install-gplv2/Fro... Of course, that doesn't mean that the proprietary software must continue to function after modifying the GPL software, apparently even the GPLv3 allows what Tivo did. From a presentation about GPLv3 on cars: "Ironically, even if Linux were GPLv3, Tivo’s method of crypto- lock-down would likely comply with GPLv3." https://events19.linuxfoundation.org/wp-content/uploads/2017/11/Safely-Copylefted-Cars-Reexamining-GPLv3-Installation-Information-Requirements-ALS-Bradley-Kuhn-Behan-Webster-1.pdf https://events19.linuxfoundation.org/wp-content/uploads/2017...

outsomnia 5y ago
"Tivoization" is a word because GPL2 does not say you must be given signing keys that allow your modified image to be accepted and executed by the device, these are not covered by "scripts used to control compilation and installation of the executable".
- pabs3 5y ago
  GPLv2 requires the practical ability to modify GPL software on the device, whether or not signing keys are mentioned explicitly is irrelevant. I suggest you re-read the Conservancy blog post I linked above and scan through the GPLv3 in cars presentation.
kmeisthax 5y ago
I knew the GPLv3 Installation Instructions requirements were narrow (enough that I don't think it's actually a barrier to, say, bundling GPL code with an iOS app), but "anti-TiVo so weak it wouldn't stop TiVo" is a TIL.
- pabs3 5y ago
  TBH despite being a GPL zealot I think it is a fairly reasonable compromise to allow proprietary software to delete itself or stop itself from working if a user updates the GPL software. OTOH, the LGPL does not allow that, you have to allow re-linking with the proprietary code, so there is precedent the other way too. IIRC the issue with GPL and iOS was that the GPL was/is incompatible with the App Store ToS.