Tivoization certainly violates the spirit of GPL2, as well as the letter. From GPL2:
> The source code for a work means the preferred form of the work for making modifications to it. For an executable work, complete source code means all the source code for all modules it contains, plus any associated interface definition files, plus the scripts used to control compilation and installation of the executable.
1. the signature is a derivative work of the GPLed work.
2. modification is the reason for distributing source code. source code without a signing key is not the "preferred form of the work for making modifications to it", as modifications cannot be made.
3. the signing key is an integral part of the "scripts used to control compilation and installation".
4. the signature is part of the "executable"; without it, the resulting object code is not executable.
IANAL, but I think every argument here would fail in court:
1. Probably not. While it's created from the original work, it does not contain the original work in any meaningful way. If it is, in any sense a derivative work, it probably qualifies as fair use.
2. Modifications to the Linux source code can be made without the key; they just can't be run on the device in question. Nothing in GPL2 says modified code has to run on the device the original code shipped with.
3. A Linux kernel compiled from the same sources can be installed on another device without the key.
4. The fact that a specific machine refuses to execute it without the key does not make the key part of the executable; other machines will execute it without the key.
1. Fair use of the signature doesn't apply. The license to distribute the compiled kernel is contingent upon anything derived from it being GPL as well (section 2b/3). Might be able to hack around this with a different entity doing the signing, but hopefully a court would see through that sham.
2. But modifications to the executable program itself (in flash) have to be facilitated. The preferred (HTC engineering) way of making these modifications is through the bootloader. There might be a loophole here in that the bootloader could be changed to allow flashing any kernel (but still not execute without a key), but being sold the device while it was on (with derivative works all over the place in RAM) would negate said loophole.
3. The specific script that has to be included is the one which generated and installed the resulting executable which was distributed to me on my specific device.
4. Good point, although the executable and signature are always distributed together and meant specifically for one particular machine, so it might not be as clearcut as you think
FWIW I've heard that Stallman has made similar arguments.
(I'm not a member of the lawyer guild either, so I'm not compelled to prefix my opinions with disclaimers)
Comments
Unfortunately not, since the Kernel is GPL2.0, not GPL3. GPL2.0 doesn't have anti-tivorization features.
Explicit ones, no.
Tivoization certainly violates the spirit of GPL2, as well as the letter. From GPL2:
> The source code for a work means the preferred form of the work for making modifications to it. For an executable work, complete source code means all the source code for all modules it contains, plus any associated interface definition files, plus the scripts used to control compilation and installation of the executable.
1. the signature is a derivative work of the GPLed work.
2. modification is the reason for distributing source code. source code without a signing key is not the "preferred form of the work for making modifications to it", as modifications cannot be made.
3. the signing key is an integral part of the "scripts used to control compilation and installation".
4. the signature is part of the "executable"; without it, the resulting object code is not executable.
IANAL, but I think every argument here would fail in court:
1. Probably not. While it's created from the original work, it does not contain the original work in any meaningful way. If it is, in any sense a derivative work, it probably qualifies as fair use.
2. Modifications to the Linux source code can be made without the key; they just can't be run on the device in question. Nothing in GPL2 says modified code has to run on the device the original code shipped with.
3. A Linux kernel compiled from the same sources can be installed on another device without the key.
4. The fact that a specific machine refuses to execute it without the key does not make the key part of the executable; other machines will execute it without the key.
1. Fair use of the signature doesn't apply. The license to distribute the compiled kernel is contingent upon anything derived from it being GPL as well (section 2b/3). Might be able to hack around this with a different entity doing the signing, but hopefully a court would see through that sham.
2. But modifications to the executable program itself (in flash) have to be facilitated. The preferred (HTC engineering) way of making these modifications is through the bootloader. There might be a loophole here in that the bootloader could be changed to allow flashing any kernel (but still not execute without a key), but being sold the device while it was on (with derivative works all over the place in RAM) would negate said loophole.
3. The specific script that has to be included is the one which generated and installed the resulting executable which was distributed to me on my specific device.
4. Good point, although the executable and signature are always distributed together and meant specifically for one particular machine, so it might not be as clearcut as you think
FWIW I've heard that Stallman has made similar arguments.
(I'm not a member of the lawyer guild either, so I'm not compelled to prefix my opinions with disclaimers)