1. A hardware device has closed-source firmware running inside it (not based on any open-source code).
  2. Computer software to update the hardware's firmware exists, with a GPLv3 license. It takes a binary firmware image file and writes it without any modification to the hardware.
  3. For the GPL software to recognize the hardware, the GPL software must be modified.

If a zip file is distributed with these things inside it:

  • Binary for customer to run, compiled from the modified GPL software
  • A nested zip file with source code for modified GPL software, to meet GPL requirements
  • Binary firmware image for the hardware, without any source code

Is that legal?

Does the GPL license "infect" the binary firmware image, so that the entire zip file is considered a derivative work, and therefore requires that the hardware's source code also be distributed under GPL?

Or is the binary firmware image considered a separate work and can be distributed alongside it without any licensing issues?

  • 'An “aggregate” consists of a number of separate programs, distributed together on the same CD-ROM or other media. The GPL permits you to create and distribute an aggregate, even when the licenses of the other software are nonfree or GPL-incompatible.' gnu.org/licenses/gpl-faq.en.html#MereAggregation
    – endolith
    Sep 25, 2019 at 15:14

1 Answer 1


Generally, the output of a piece of software is not covered by the piece of software's licence, because the output is not a derivative work of the piece of software. Using a GPL-covered program to upload a firmware blob no more forces the firmware blob to be GPL'ed than using a GPL-covered file transfer program to upload your photograph requires freely-licensing the image, or using a GPL-covered web server to serve your audio files to customers requires that your audio be free.

In short: yes, it's legal. No, the GPL doesn't "infect" like that. The blob is considered a separate work and be aggregated alongside the GPL program, for example in a zipfile, without issue.

And as an aside, words like "infect" should be avoided in this context - scare-quoted or otherwise - because they can be seen as legitimising some of the giant piles of FUD that commercially-interested parties have been dumping on the free-software landscape over the years.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.