4 ms·

They're probably referring to this part of the GPLv3 license: > “Installation Information” for a User Product means any methods, procedures, authorization keys

by rany_ 3y ago

They're probably referring to this part of the GPLv3 license: > “Installation Information” for a User Product means any methods, procedures, authorization keys, or other information required to install and execute modified versions of a covered work in that User Product from a modified version of its Corresponding Source. The information must suffice to ensure that the continued functioning of the modified object code is in no case prevented or interfered with solely because modification has been made. > If you convey an object code work under this section in, or with, or specifically for use in, a User Product, and the conveying occurs as part of a transaction in which the right of possession and use of the User Product is transferred to the recipient in perpetuity or for a fixed term (regardless of how the transaction is characterized), the Corresponding Source conveyed under this section must be accompanied by the Installation Information. But this requirement does not apply if neither you nor any third party retains the ability to install modified object code on the User Product (for example, the work has been installed in ROM). I believe the MSFT lawyers are right here, but obviously I'm not a lawyer.

nailer 3y ago
Thanks! I was looking for the word 'sign' and couldn't find it. I now think I was wrong earlier. Summarizing https://www.gnu.org/licenses/gpl-3.0.html https://www.gnu.org/licenses/gpl-3.0.html: > The information (ie 'methods, procedures, authorization keys, or other information required to install and execute modified versions of a covered work') must suffice to ensure that the continued functioning of the modified object code is in no case prevented or interfered with solely because modification has been made. The purpose of allowing signing is exactly to ensure modified code does not function in that environment. Yes MS (and you) would be right. GPLv2, BSD or MIT would be fine but GPLv3 would not. ----------------------------------- Edit reply to baobun (rate limit means I can't post) I did think about that, but: > continued functioning of the modified object code is vague. Does it mean a new firmware binary should continue working on the same device as the unmodified predecessor or using is a new device (that allows arbitrary entities to sign) considered to be "continued functioning"?
- baobun 3y ago
  Not exactly. AshamedCaptain gets it. If the device can be configured to trust a user-supplied key instead of or in addition to Microsoft's, there is no need to provide any keys. This is up to the hardware supplier. https://news.ycombinator.com/item?id=39134059 https://news.ycombinator.com/item?id=39134059 https://news.ycombinator.com/item?id=39133999 https://news.ycombinator.com/item?id=39133999
  - nailer 3y ago
    I did reply to this, but had to reply in my existing comment above due to the rate limit.

by rany_ 3y ago

nailer 3y ago

Thanks! I was looking for the word 'sign' and couldn't find it. I now think I was wrong earlier. Summarizing https://www.gnu.org/licenses/gpl-3.0.html https://www.gnu.org/licenses/gpl-3.0.html: > The information (ie 'methods, procedures, authorization keys, or other information required to install and execute modified versions of a covered work') must suffice to ensure that the continued functioning of the modified object code is in no case prevented or interfered with solely because modification has been made. The purpose of allowing signing is exactly to ensure modified code does not function in that environment. Yes MS (and you) would be right. GPLv2, BSD or MIT would be fine but GPLv3 would not. ----------------------------------- Edit reply to baobun (rate limit means I can't post) I did think about that, but: > continued functioning of the modified object code is vague. Does it mean a new firmware binary should continue working on the same device as the unmodified predecessor or using is a new device (that allows arbitrary entities to sign) considered to be "continued functioning"?

baobun 3y ago
Not exactly. AshamedCaptain gets it. If the device can be configured to trust a user-supplied key instead of or in addition to Microsoft's, there is no need to provide any keys. This is up to the hardware supplier. https://news.ycombinator.com/item?id=39134059 https://news.ycombinator.com/item?id=39134059 https://news.ycombinator.com/item?id=39133999 https://news.ycombinator.com/item?id=39133999
- nailer 3y ago
  I did reply to this, but had to reply in my existing comment above due to the rate limit.