5

In the FAQ section of the GPLv3, the Free Software Foundation presents the following entry:

Question: Suppose that two companies try to circumvent the requirement to provide Installation Information by having one company release signed software, and the other release a User Product that only runs signed software from the first company. Is this a violation of GPLv3?

Answer: Yes. If two parties try to work together to get around the requirements of the GPL, they can both be pursued for copyright infringement. This is especially true since the definition of convey explicitly includes activities that would make someone responsible for secondary infringement.

However, it is not immediately apparent to me how the GPLv3 goes about achieving this. Reading the definition of convey:

To “convey” a work means any kind of propagation that enables other parties to make or receive copies.

and then the relevant excerpts in section 6:

“Installation Information” for a User Product means any methods, procedures, authorization keys, or other information required to install and execute modified versions of a covered work in that User Product from a modified version of its Corresponding Source. The information must suffice to ensure that the continued functioning of the modified object code is in no case prevented or interfered with solely because modification has been made.

If you convey an object code work under this section in, or with, or specifically for use in, a User Product, and the conveying occurs as part of a transaction in which the right of possession and use of the User Product is transferred to the recipient in perpetuity or for a fixed term (regardless of how the transaction is characterized), the Corresponding Source conveyed under this section must be accompanied by the Installation Information. But this requirement does not apply if neither you nor any third party retains the ability to install modified object code on the User Product (for example, the work has been installed in ROM).

Since "installation information" is only required when the GPL software is conveyed as part of the transaction that involves the ownership of the device itself, wouldn't a company still be able to circumvent the anti-tivoization provisions of GPL by conveying the software separately after the device has been sold?

That is,

  1. The company first sells a device with a small proprietary program that only loads software if it was signed with the company's private cryptographic key. Think gaming consoles or a Juicero where the device is bought with the expectation that you need to by something else to actually use it.

  2. Then sell or deliver the GPLed software in another separate transaction with the company or a third party. The user would be free to not buy signed software of course, but they won't get to "use" their device to run anything else.

I couldn't manage to find anything in the GPLv3 that would thwart this. Am I missing something?

  • 1
    For your step 2, the GPL v3 license clearly says "If you convey an object code work under this section in, or with, or specifically for use in, a User Product, ..." -- so for that you would appear to be in violation. – Brandin Mar 27 at 9:23
  • @brandin but that condition is predicated on the transfer of ownership of the User Product: "for use in, a User Product, and the conveying occurs as part of a transaction" – Tenders McChiken Mar 28 at 4:59
4

Let's look at this in more detail. We have a platform vendor PV which will only allow signed software to run on the platform. The platform is a User Product in the sense of the GPLv3. And we have a software vendor SV which wants to supply software that runs on the platform. However, SV's software is subject to GPLv3.

If SV gives the software to PV which loads it into the User Product and then gives it to end users, PV is conveying the GPL-covered software and has to supply Installation Information, including the signing keys. PV can avoid this if SV's software cannot be updated in the User Product, e.g. because it was burned into ROM.

The result is quite similar if SV gets the software signed by PV and gives it to end users directly, but in a transaction that is somehow connected to sale/lease/lending of the User Product. E.g. if PV gives end users a voucher for SV's software, I would think that SV's conveying to the end user could be part of the User Product transaction. The same if the User Product cannot be used without SV's software. Thus, the vendors cannot circumvent the GPLv3 requirements just by involving a third party.

The scenario you are actually asking about occurs when the conveying of GPLv3-covered software is truly separate from the transaction involving the User Product. The GPLv3 requires for that section to apply, that:

  • object code is conveyed ”in, or with, or specifically for use in, a User Product“
  • and “the conveying occurs as part of a transaction [involving ownership rights to the User Product]”
  • and that the object code in the User Product can be modified by anyone

While the object code is “for use in” a User Product, the second condition would not apply. Then, the anti-Tivoization clause does not apply.

As a practical example, I would argue that signing GPLv3 software so that it can run without warnings on a Windows PC made by Dell or on a MacBook made by Apple would not entitle recipients of the software to receiving those keys, whether from the software vendor, Microsoft, Dell, or Apple.

The situation is much much more nuanced in an App Store scenario where all installation of third party software goes through the platform vendor. While the conveying must occur as part of a transaction involving the User Product, the anti-Tivoization clause can apply “regardless of how the transaction is characterized”. The scope of this clause is intended to be broad, but it is entirely unclear how broad it is – a matter that a court will have to eventually decide.

I think that if full access to an app store is only possible when you have a User Product, then the transaction of the User Product would also be a master agreement permitting use of the app store, and all further contracts or transactions via the app store could therefore be part of the transaction of the User Product. GPLv3 software conveyed via the store would then be required to provide Installation Information, which could make it impossible to distribute via the store. But if the software can be downloaded from the store without having the User Product, that would be a strong indication that store transactions are completely separate from the User Product transaction.

The GPLv3 Third Discussion Draft Rationale makes it clear that the authors did not intend such subtleties. The need to provide signing keys was originally part of the Corresponding Source definition, but this was too complex and had some unwanted consequences in an enterprise context. Therefore, the requirement to provide Installation Information was restricted to the context of User Products, the definition of which was lifted almost verbatim from US law. This suggests that the circumstances where Installation Information has to be provided should be interpreted rather broadly, in line with the goal stated in the license preamble to “guarantee your freedom to share and change all versions of a program”.

Note that the Installation Information only involves information that is specific to the User Product, whereas other installation reqirements are still part of the Corresponding Source definition.

| improve this answer | |
  • Very good points. it ultimately boils down to what constitutes a transaction as you said. I'll hold off on accepting your answer for now to give a chance for others to present their answers and views. – Tenders McChiken Mar 28 at 5:07
  • @TendersMcChiken it's been four months. Do you think you might review the answers to this - and maybe your other - questions, with a view to accepting an answer to each? Accepting an answer helps the lifecycle of the question, and is the courteous thing to do, provided you're happy with it. – MadHatter Jul 20 at 7:23
  • Your answer is well balanced and argued. I'd be happy to. – Tenders McChiken Jul 20 at 9:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.