Re: [Ksummit-discuss] [TECH TOPIC] Firmware signing

[David Woodhouse <dwmw2@infradead.org>]

[-- Attachment #1: Type: text/plain, Size: 2388 bytes --]

On Tue, 2015-07-28 at 14:38 -0700, Greg KH wrote:
> On Tue, Jul 28, 2015 at 11:54:28AM -0700, josh@joshtriplett.org wrote:
> > > So in that case, what's the advantage of separating the firmware from
> > > the driver?  If we can't update it without updating the driver, we could
> > > just build it in and save a huge amount of hassle.
> > 
> > Licensing, which is a large part of why we have request_firmware to
> > begin with.  Let's not make distribution kernel maintainers' lives more
> > difficult than they already are.
> 
> Not true at all, please talk with some lawyers about this.
> 
> Or, to be clear, the lawyers I have discussed this with have no issues
> at all with it.  Yours might differ. 

Lawyers will mostly argue anything their client wants them to.

So that isn't data; it's barely even a relevant anecdote. It certainly
doesn't merit a blanket statement like 'not true at all'.

If anything, your anecdote tells us more about the desires of those who
were *paying* the lawyers in question, than it does about the matter at
hand.

Hell, *I* can find a doctor who will assert that vaccines cause autism,
if you want one¹. 

Something like this is not *truly* settled until/unless there is a
court ruling — and then only in that jurisdiction, and until/unless
it's appealed/overruled.

So yes, I'm sure there are lawyers who will turn up in court and argue
whatever it is that they need to argue to make that case — that a
kernel bzImage *isn't* a "work based on the [Linux kernel]", or that a
binary-only firmware image therein, which cannot be automatically
extracted or separated because it is static data within one of the C
files of a GPL'd driver, somehow *is* nevertheless "being distributed
as a separate work".

But there are other lawyers and expert witnesses who will respond to
those arguments with a resounding WTF.

Nobody gets to say "not true at all" before it's actually come to
court.

In the meantime, there are genuine licensing reasons why a risk-averse
company might elect *not* to build non-GPL firmware *into* a Linux
kernel image. Because they might not want to end up being summoned to
that court room, and might not want to have to pay that lawyer to make
that argument.

So Josh was entirely correct.

-- 
dwmw2

¹ He's in the basement. Just $20 and you can kick him in the balls.

[-- Attachment #2: smime.p7s --]
[-- Type: application/x-pkcs7-signature, Size: 5691 bytes --]