Hacker News Reader

Comment by nrclark | Hacker News Reader

It actually is correct, I think. If you're selling hardware that ships with any GPLv3 software of any kind, the license requires that you don't restrict users from installing their own OS if they want. This was intended as a workaround for so-called "tivoizaion", where TiVo boxes were open source but would only boot signed firmware (and the keys were confidential).

Apple didn't want this, so they blacklisted all GPLv3 software. So did most companies that ship embedded Linux products like smart TVs.

View on HN

No, I don't think completely different software "infect" each other this way.

Consider this: Canonical ships Ubuntu which is based on the GPLv3 licensed Linux kernel. Yet their distribution contains all kind of software including gplv2, Apache, BSD and even proprietary. Some are from canonical themselves, and they are in no ways "infected" by the gplv3 license.

Also, tivo-ization was about TiVo publishing a Linux code that could not be used by anyone since the hardware would reject it (due to missing signing keys). These days these issues are solved by having keys and such in the bootloader which is BSD licensed (see for example Android).

The Tivoization clause applies to hardware vendors, with hardware covered by GPLv3's definition of a "User Product".

Ubuntu itself isn't a valid comparison, because it's not a physical product. And computers that ship with Ubuntu don't violate GPLv3, because you can install anything you want on them without restriction.

The license incompatibility isn't intrinsic to MacOS, it's intrinsic to Apple's computers. Which ship with MacOS.

If MacOS included GPLv3 software, Apple wouldn't be able to pre-install it unless they provided all users with signing keys to install their own modified versions of the GPLv3 software on-target. Check out the GPLv3's "User Product" and "Installation Information" sections for more details - they're written in plain English, and are pretty clear.

Basically - if you want to sell hardware that comes with any GPLv3 software installed, then you need to empower your customers to replace or modify that software on their devices. Not the entire OS, mind. Just the pieces that are GPLv3. But that requirement prevents a hardware vendor from doing something like saying "I'll only boot a signed/verified root filesystem" or "The rootfs (or even just /usr) is read-only to everything except for signed OS updates".

So it's not that shipping GPLv3 Make/Coreutils would infect MacOS and require Apple to release the MacOS source. Instead, it's that shipping GPLv3 Make/Coreutils would prevent Apple from locking down their computers and code-signing MacOS (unless they provided the OS-level signing keys on request).

> But that requirement prevents a hardware vendor from doing something like saying "I'll only boot a signed/verified root filesystem" or "The rootfs is read-only to everything except signed OS updates".

Only if you don't allow the user to decide which signing keys to trust. So GPLv3 doesn't prevent you from improving security, only from bossing around your users.

Good point!

There are other companies selling Linux systems + hardware. Google, System 67, Asus, Dell, HP, Samsung, ...

Note also that you can't install custom software on a Samsung smartwatch, but you can install Windows on a Mac.

System76, Asus, etc. don't run afoul of GPLv3 because they don't restrict what you can install.

Most Android devices also don't violate any GPLv3 licenses, because they don't include any GPLv3 software. GPLv2 software like the kernel doesn't have this same restriction.

Apple decided to take the approach of "don't include GPLv3 software" so that they wouldn't have to worry about it once they fully lock down their computers. If Apple included a modern Bash with MacOS, they would need to give all owners access to any compilers or signing keys necessary to modify Bash and replace the binary that Apple shipped. Today, it's possible to do that. Tomorrow, it might not be.

But the kernel itself is GPLv3.

Nevermind, let's agree to disagree

The kernel itself is specifically under GPLv2 only. That's not a point you can disagree on.

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/lin...

The companies selling Linux systems including GPLv3 code plus hardware are happy to include Installation Information.

Installing Windows on a Mac is not relevant here, because Installation Information is "information required to install and execute modified versions of a covered work in that User Product from a modified version of its Corresponding Source." Windows is not a modified version of a covered work, and so the ability to install Windows doesn't imply the ability to install a modified version of a covered work.

I would be surprised if a Samsung smartwatch had any GPLv3 code. Android rewrote a bunch of userspace specifically to avoid GPL (any version).

> unless they provided the OS-level signing keys on request

All they need is to provide a bypass which permits executing a modified binary, which they already do otherwise projects like Homebrew and MacPorts wouldn't be possible, not to mention the fact that development on macOS would become a nightmare.

From a technical and legal perspective there's no reason to avoid the GPLv3 for a program like GNU Make. Apple's lawyers are just lazy and instituted a blanket, company-wide prohibition against GPLv3. A GPLv3'd Bash might plausibly create some headaches given the system integration, but they could have always used ksh like every other BSD, or zsh as they're now doing, as the default system shell and shipped a modern, updated Bash as a convenience for user scripts. iOS also poses additional headaches, but that's a separate issue--Apple already deprecated system(3) and in general you can't (and don't) rely on shell programs in iOS.

TL;DR: Apple's lawyers are lazy and needlessly hostile, even given an expansive, unrealistic interpretation of the GPLv3 anti-circumvention clause.

Agreed with this. There's one extra dimension though - the toolchain.

The catch with MacPorts and Homebrew is that both of them use the XCode toolchain for compilation and linking. And Apple encumbers the heck out of XCode with EULAs, App-store accounts, etc. My interpretation of GPLv3's "Installation Information" section is that Apple wouldn't be able to force you to do any of that junk if they were shipping GPLv3 components.

I hate that Apple does all of that bullshit. But somebody at Apple seems to think there's value in all that EULA protection and control, which is probably why GPLv3 software got the boot.

This isn't about software infecting each other, this is about a hardware vendor distributing software with the hardware. Here's the relevant text of the clause:

> A “User Product” is either (1) a “consumer product”, which means any tangible personal property which is normally used for personal, family, or household purposes, or (2) anything designed or sold for incorporation into a dwelling. ... If you convey an object code work under this section in, or with, or specifically for use in, a User Product, and the conveying occurs as part of a transaction in which the right of possession and use of the User Product is transferred to the recipient in perpetuity or for a fixed term (regardless of how the transaction is characterized), the Corresponding Source conveyed under this section must be accompanied by the Installation Information.

Ubuntu is neither tangible personal property normally used for personal/family/household purposes, nor something designed or sold for incorporation into a dwelling.

A Macbook is tangible physical property normally used for personal/family/household purposes.

Reply on news.ycombinator.com