Re: [Ksummit-discuss] [TECH TOPIC] Firmware signing

[David Woodhouse <dwmw2@infradead.org>]

[-- Attachment #1: Type: text/plain, Size: 3852 bytes --]

On Wed, 2015-07-29 at 08:00 -0700, James Bottomley wrote:
> 
> 
> Really, no, there aren't.  Firmware is an operating system independent
> blob which runs on a separate processor without modification for
> Windows, Linux, Solaris or any other OS.  As such, there's no way it can
> be considered a derived work of (or even based on) the Linux Kernel.
> This...

I don't ever think anyone would claim that the firmware is a derived
work of the Linux kernel. Or that it is based on the Linux kernel.

That's a straw man. But it's also not really necessary for the point
you were making, which might as well start here:

> ...it falls under the aggregation terms of clause 2 of the GPL:
>         
>         In addition, mere aggregation of another work not based on the
>         Program with the Program (or with a work based on the Program)
>         on a volume of a storage or distribution medium does not bring
>         the other work under the scope of this License.
> 
> So it definitely doesn't have to be distributed under GPL and can be
> aggregated with GPL components like Linux.

I understand that opinion. But the whole 'mere aggregation on a volume
of a storage or distribution medium' thing is fairly ambiguous, and
there is plenty of scope for interpretation.

Certainly it seems intended to cover at *least* the case of things like
the old "shareware CDs", allowing GPL'd software to be included on
those as well as non-GPL'd software. Those are collective works, and
without the exception *would* have been prohibited by the GPL. (Again,
just in terms of what you are permitted to do with the GPL'd thing,
without ever making the bizarre claim that the non-GPL'd parts are in
any way derivative of or based on the GPL'd parts.)


It's possible to interpret that same clause as negating the *entirety*
of the paragraphs that precede it — permitting *any* combination of GPL
and non-GPL works as long as you call it 'aggregation' — and ignoring
the ill-defined word 'mere' that precedes it, and the context 'on a
volume of a storage or distribution medium' that follows.

One could then argue that even linking a proprietary piece of native
code into a GPL'd work and calling it directly is permitted — it's
still merely aggregation. Obviously, that doesn't seem like a
*reasonable* interpretation, as it would clearly make the licence
inconsistent with itself. So I wouldn't bet on a court backing that
interpretation — but then again, courts have done stupider things.

Then there's a whole spectrum of other possibilities, between the
minimal 'allow GPL'd stuff to appear on shareware CDs' to the excessive
'allow anything as long as you call it aggregation' interpretations
that I have outlined.

Your viewpoint, while a valid opinion, falls closer to the latter end
of that spectrum than mine does.

The fact remains that there is scope for reasonable people to disagree,
that *none* of us are right until it's tested, and there *is* a reason
for cautious people to err on the side of caution.


You make a point about Linux-specific firmware being a 'greyer area',
which is true precisely *because* of the ambiguity here. That, along
with many other factors, would affect a court's perception of whether
the the two parts are indeed 'merely aggregated on a volume of a
storage or distribution medium', or whether they are tied together as a
coherent 'whole which is based in part on the [kernel]'. 


I'm not going to tell you that your opinion on the 'mere aggregation on
a volume of a storage or distribution medium' thing is wrong, although
I happen to disagree with it.

But I *am* telling you that you are wrong to claim that there is *no*
risk. And that Greg is similarly wrong to make his absolute 'not true
at all' claim.

-- 
dwmw2

[-- Attachment #2: smime.p7s --]
[-- Type: application/x-pkcs7-signature, Size: 5691 bytes --]