Comment by Vaushite
4 days ago
If it's impossible build the binary from the source you've been given, then you haven't been given the source. The binary in question is one that passes attestation and secure boot. If I don't have the key, I don't have the source.
MIT allows this (you not giving me the source). GPL2 allows this in some jurisdictions - notably, not in Germany. GPL3 absolutely doesn't, which is the reason Google refuses GPL3 upstreams.
Permissively licensed open source code is open source code. Firmware on a secure element can be open source without it being possible to replace it without the signing key on a production device.
German courts are not bound by precedent in the same way as US courts and you're referring to a specific case in Germany which cannot be broadly applied.
AOSP ships a lot of GPLv2 code (Linux kernel and OpenJDK libraries among other components) but doesn't use GPLv3 for multiple reasons.
AOSP used to use a lot of GPLv3 code as part of the toolchain for building AOSP but that was replaced with LLVM, ToyBox and other permissively licensed projects.
What part of GPL3 forbids this?
"You may convey a covered work in object code form under the terms of sections 4 and 5, provided that you also convey the machine-readable Corresponding Source under the terms of this License"
I don't know why some of my comments are being shadowbanned. It might be an AI filter gone awry.
I emailed the moderators about your comment being dead, after vouching failed to bring it back. They said it looks like it was a false positive hit in a spam filter and they have taken steps so it should not hit you with any more false positives.
As far as secure boot and attestation goes, my understanding is that these are based on signatures.
Things like signing keys have generally not been considered to be source code under GPL. Such things before GPLv3 were completely out of scope.
In GPLv3 they were brought into scope, but not by changing the way they define source code. Instead they added a new category, "Installation Information", for "any methods, procedures, authorization keys, or other information required to install and execute modified versions of a covered work [...]".
Section 6 of GPLv3, which is where the part your quote comes from, under some circumstances requires that you must accompany the conveyed Corresponding Source must be accompanied by the Installation Information.
The circumstances where this is required are pretty narrow. Before we get to that we need one more term that was added for GPLv3: "User Product".
>> A “User Product” is either (1) a “consumer product”, which means any tangible personal property which is normally used for personal, family, or household purposes, or (2) anything designed or sold for incorporation into a dwelling.
Installation Information must be included when two things are true:
1. The object code conveyance is in, with, or specifically for use in, a User Product, and
2. The conveying is part of a transaction in which the right of possession and use of the User Product is transferred to the recipient.
In short, under GPLv3, if you want use GPLv3 code in the software or firmware you include out of the box on hardware you are distributing you need to include Installation Information.
As far as I know GrapheneOS is only distributed as a third party download you can install on a device you already own, so does not trigger the GPLv3 Installation Information requirement.