GPLv3 has clause to ensure that device manufacturers are not circumventing "freedom to run modified software by users".
When you convey a covered work, you waive any legal power to forbid circumvention of technological measures to the extent such circumvention is effected by exercising rights under this License with respect to the covered work, and you disclaim any intention to limit operation or modification of the work as a means of enforcing, against the work's users, your or third parties' legal rights to forbid circumvention of technological measures.
Now in practical terms, this means, a device manufacturer must not block any user from updating a GPLv3 package in rootfs image with a modified version of own.
In case of many commercial products, OEMs protect the rootfs image by using features such as dm-verity or some other signing mechanism so that device is booting with a trusted rootfs, and hardware provides the root-of-trust.
What options do OEM(s) have to ensure both below mentioned goals met?
- Allow users to run their own modified versions of FOSS packages.
- Ensure that the trust model of the product is met.
Can OEM take the following approach of implementing two modes to meet the above 2 goals?
Normal mode, boot with a trusted rootfs image with root-of-trust established by the hardware.
Run trust based use-cases in this mode, e.g., face recognition in a security access control camera.
Special mode, Let's say mode is activated when user toggles a hardware switch on device. On next reboot:
- A warning is presented to user and confirmation is received from user for entering special mode
- All trust based data on device is wiped off
- rootfs verification is not done
- In this mode now user is free to install his own modified version of FOSS and run it
- This mode does not support use-cases tied to hardware root-of-trust
Is this separation of modes an acceptable mechanism to remain compliant with GPLv3?