Re: [Ksummit-discuss] [TECH TOPIC] Firmware signing

[David Woodhouse <dwmw2@infradead.org>]

[-- Attachment #1: Type: text/plain, Size: 2843 bytes --]

On Thu, 2015-07-30 at 06:48 -0700, James Bottomley wrote:
> 
> OK, let us suppose for the sake of argument that this is correct and the
> GPL does manage to get extended to non derived included projects.

Let's not say "non derived included projects". Let's say "independent
and separate works". Since that's the wording the GPL uses when it lays
out the circumstances under which it extends "to the entire whole, and
thus to each and every part regardless of who wrote it".

I know, we disagree on precisely *what* those circumstances are, But
there have to be *some* circumstances, otherwise that whole paragraph
or three of the GPL are just self-contradictory nonsense, right? Which
is surely not a reasonable interpretation of its meaning.

> Even in that case, we're not causing any corporate legal jeopardy 
> because of the principle of estoppel.  Estoppel says we cannot accuse 
> someone of breaching our licence for something we also did. 

Well, Linus deliberately hasn't obtained copyright assignments, so
blithely talking about "we" in that sense is making certain assumptions
and opening up an interesting can of worms. But if you consider it a
joint work it makes some sense to argue that way.

The thing is, it could be argued that in that case "we" don't need a
licence for using "our" own code. So we wouldn't *be* violating the
licence per se, because we don't need one :)

You could reasonably apply estoppel to the case of old kernels where we
*did* actually ship certain firmware as part of the kernel, and someone
is being sued for just building that kernel as-is.

It's much less clear that you could argue that way in court when you
added your *own* firmware to an image, especially of a modern kernel
after we've *removed* the bits we had before. You'd basically be making
the argument "hey, *they* did it in their own code base so they need to
permit *me* to do it... with their code base."

Which is not entirely guaranteed to pass muster. But sure, you can try
it on :)

>  So if we ship the firmware with the kernel, anyone else also 
> shipping firmware with the kernel is automatically innoculated 
> against accusations of license breach for that action.

Although when we pull in GPL'd code from elsewhere which *wasn't*
originally submitted to our 'joint work', that would mean *we* violated
the GPL on that original external code.

If we get our act together and evict the problematic non-GPL parts (as
we did), that puts us back in compliance again... and certainly doesn't
give third parties carte blanche to also violate the licence, just
because *we* made that mistake.

But sure, if a party were very keen to encourage and condone such
behaviour, they could certainly try making the estoppel-based
arguments. They might get lucky.

-- 
dwmw2

[-- Attachment #2: smime.p7s --]
[-- Type: application/x-pkcs7-signature, Size: 5691 bytes --]