In the FAQ section of the GPLv3, the Free Software Foundation presents the following entry:
Question: Suppose that two companies try to circumvent the requirement to provide Installation Information by having one company release signed software, and the other release a User Product that only runs signed software from the first company. Is this a violation of GPLv3?
Answer: Yes. If two parties try to work together to get around the requirements of the GPL, they can both be pursued for copyright infringement. This is especially true since the definition of convey explicitly includes activities that would make someone responsible for secondary infringement.
However, it is not immediately apparent to me how the GPLv3 goes about achieving this. Reading the definition of convey:
To “convey” a work means any kind of propagation that enables other parties to make or receive copies.
and then the relevant excerpts in section 6:
“Installation Information” for a User Product means any methods, procedures, authorization keys, or other information required to install and execute modified versions of a covered work in that User Product from a modified version of its Corresponding Source. The information must suffice to ensure that the continued functioning of the modified object code is in no case prevented or interfered with solely because modification has been made.
If you convey an object code work under this section in, or with, or specifically for use in, a User Product, and the conveying occurs as part of a transaction in which the right of possession and use of the User Product is transferred to the recipient in perpetuity or for a fixed term (regardless of how the transaction is characterized), the Corresponding Source conveyed under this section must be accompanied by the Installation Information. But this requirement does not apply if neither you nor any third party retains the ability to install modified object code on the User Product (for example, the work has been installed in ROM).
Since "installation information" is only required when the GPL software is conveyed as part of the transaction that involves the ownership of the device itself, wouldn't a company still be able to circumvent the anti-tivoization provisions of GPL by conveying the software separately after the device has been sold?
The company first sells a device with a small proprietary program that only loads software if it was signed with the company's private cryptographic key. Think gaming consoles or a Juicero where the device is bought with the expectation that you need to by something else to actually use it.
Then sell or deliver the GPLed software in another separate transaction with the company or a third party. The user would be free to not buy signed software of course, but they won't get to "use" their device to run anything else.
I couldn't manage to find anything in the GPLv3 that would thwart this. Am I missing something?