Comment by tzs

I emailed the moderators about your comment being dead, after vouching failed to bring it back. They said it looks like it was a false positive hit in a spam filter and they have taken steps so it should not hit you with any more false positives.

As far as secure boot and attestation goes, my understanding is that these are based on signatures.

Things like signing keys have generally not been considered to be source code under GPL. Such things before GPLv3 were completely out of scope.

In GPLv3 they were brought into scope, but not by changing the way they define source code. Instead they added a new category, "Installation Information", for "any methods, procedures, authorization keys, or other information required to install and execute modified versions of a covered work [...]".

Section 6 of GPLv3, which is where the part your quote comes from, under some circumstances requires that you must accompany the conveyed Corresponding Source must be accompanied by the Installation Information.

The circumstances where this is required are pretty narrow. Before we get to that we need one more term that was added for GPLv3: "User Product".

>> A “User Product” is either (1) a “consumer product”, which means any tangible personal property which is normally used for personal, family, or household purposes, or (2) anything designed or sold for incorporation into a dwelling.

Installation Information must be included when two things are true:

1. The object code conveyance is in, with, or specifically for use in, a User Product, and

2. The conveying is part of a transaction in which the right of possession and use of the User Product is transferred to the recipient.

In short, under GPLv3, if you want use GPLv3 code in the software or firmware you include out of the box on hardware you are distributing you need to include Installation Information.

As far as I know GrapheneOS is only distributed as a third party download you can install on a device you already own, so does not trigger the GPLv3 Installation Information requirement.