Re: [Ksummit-discuss] [TECH TOPIC] Firmware signing

[James Bottomley <James.Bottomley@HansenPartnership.com>]

[-- Attachment #1: Type: text/plain, Size: 4826 bytes --]

On Thu, 2015-07-30 at 16:01 +0100, David Woodhouse wrote:
> On Thu, 2015-07-30 at 06:48 -0700, James Bottomley wrote:
> > 
> > OK, let us suppose for the sake of argument that this is correct and the
> > GPL does manage to get extended to non derived included projects.
> 
> Let's not say "non derived included projects". Let's say "independent
> and separate works". Since that's the wording the GPL uses when it lays
> out the circumstances under which it extends "to the entire whole, and
> thus to each and every part regardless of who wrote it".
> 
> I know, we disagree on precisely *what* those circumstances are, But
> there have to be *some* circumstances, otherwise that whole paragraph
> or three of the GPL are just self-contradictory nonsense, right? Which
> is surely not a reasonable interpretation of its meaning.

Well as you know, we disagree.  To me it reads like a confirmation of
the fact that the license won't get into questions of what constitutes
derivation.  It will merely take whatever the jurisdiction says and make
the reach of the license follow that.  It's actually a very clever ploy
because it means the license can never be attacked for having a
provision contrary to copyright law.

> > Even in that case, we're not causing any corporate legal jeopardy 
> > because of the principle of estoppel.  Estoppel says we cannot accuse 
> > someone of breaching our licence for something we also did. 
> 
> Well, Linus deliberately hasn't obtained copyright assignments, so
> blithely talking about "we" in that sense is making certain assumptions
> and opening up an interesting can of worms. But if you consider it a
> joint work it makes some sense to argue that way.
> 
> The thing is, it could be argued that in that case "we" don't need a
> licence for using "our" own code. So we wouldn't *be* violating the
> licence per se, because we don't need one :)

I'm afraid that's sophistry.  You're arguing law.  Estoppel is based on
fact.  The two facts to be decided for this would be

     1. What is the original source for the work
     2. Does that original source commit or contemplate the breach at
        issue.

There's no ambiguity about the answers:

     1. Linus' git tree
     2. yes, because that was the original premise of the question.

What any of the individual authors opinions are (or even what a court
construes the licence to mean) is irrelevant the facts govern the
finding.

> You could reasonably apply estoppel to the case of old kernels where we
> *did* actually ship certain firmware as part of the kernel, and someone
> is being sued for just building that kernel as-is.

The question of how long after the breach at issue is cured in the
original source does the action remain estopped is a law one which I
won't answer.  The original question wasn't about that, it was whether
shipping firmware as part of the kernel source tree would cause
potential legal jeopardy for onward distributors.  The answer is no, as
you agree above.

> It's much less clear that you could argue that way in court when you
> added your *own* firmware to an image, especially of a modern kernel
> after we've *removed* the bits we had before. You'd basically be making
> the argument "hey, *they* did it in their own code base so they need to
> permit *me* to do it... with their code base."
> 
> Which is not entirely guaranteed to pass muster. But sure, you can try
> it on :)

The original question wasn't "can anyone ship arbitrary firmware with
the kernel" it was "if the kernel ships firmware would this be a license
violation for an onward distributor".  I can hazard an answer to the new
question, but I won't because it's just expanding the basis for
argument.

James

> >  So if we ship the firmware with the kernel, anyone else also 
> > shipping firmware with the kernel is automatically innoculated 
> > against accusations of license breach for that action.
> 
> Although when we pull in GPL'd code from elsewhere which *wasn't*
> originally submitted to our 'joint work', that would mean *we* violated
> the GPL on that original external code.
> 
> If we get our act together and evict the problematic non-GPL parts (as
> we did), that puts us back in compliance again... and certainly doesn't
> give third parties carte blanche to also violate the licence, just
> because *we* made that mistake.
> 
> But sure, if a party were very keen to encourage and condone such
> behaviour, they could certainly try making the estoppel-based
> arguments. They might get lucky.
> 
> _______________________________________________
> Ksummit-discuss mailing list
> Ksummit-discuss@lists.linuxfoundation.org
> https://lists.linuxfoundation.org/mailman/listinfo/ksummit-discuss



[-- Attachment #2: smime.p7s --]
[-- Type: application/x-pkcs7-signature, Size: 5819 bytes --]