> The phrase "derivative work" comes from copyright law, so it isn't up to any one software author or license author to decide what "derivative work" means, that is for the law and the courts to decide.
Yes, I've seen that same statement rolled out on LWN. Who knows, it in principle it might even be correct.
In practice at best it's plain misleading. Neither the Law nor the courts get to have any input if the copyright holder doesn't bring the matter to their attention by suing. The choice about whether to enforce it or not is entirely up to the copyright holder.
Further, the GPL isn't claiming additional rights that might be dubious under copyright law. If the copyriht holder chose to enforce those right in a court of law they almost certainly be challenged. Instead, it's giving away rights. You have _always_ been allowed to give away rights. That's what you do when you sell something - you allow someone to take a copy in exchange for money.
The GPL is actually an agreement to not enforce copyright under some circumstances. In fact it's not too different to the backup clause in Microsoft's standard agreement. The standard agreement explicitly you may not take copies of Microsoft's software - but backups are an exception.
Now I'm not lawyer, so I'm merely guessing that if Microsoft decided to sue you anyway for taking backups they would lose.
Part of the problem arises in my use of the "derivative work". I'm copying the wording in the GPL, but really I assuming whatever the GPL is claiming is a derivative work really is a derivative work under copyright law. What I'm really saying, is that I won't sue you for copyright if you only use the derivative work in way I specify, such as only using it via a well documented API.
There is nothing new about this. Arguably the GPL, AGPL, and LGPL only differ in how they say you can use the software in question. All I am saying is that's turned out to be too ambiguous. I'd much prefer the licence define allowed usage in a way a machine check. For example, if you only call symbols defined in this .h file, you don't have to make copies available. Or (and the GNU compilers do this), you can use the compiled output of the compiler even though they are derivative works (because they contain statically linked parts of crt.o).
This argument about you can't do that because copyright law defines what a derivative work is, is a complete red hearing.
> A GPLv4 without the installation requirement would not be a license that advances the goals of the FSF and the wider Free Software movement, which is to empower software users and users who can't install software are not empowered.
The entire thing was about TvIO. It was never about preventing you from installing software in general. It could not be - the software was open source. The whole point of open source is I can modify it and install it on any device that let me do so. It was a particular _device_ that was locked down - not the software. You may be right is saying the FSF wanted to leverage their control of software licences into controlling the devices as well, which they did by demanding you provide private keys. I'm not the FSF - I can't say. What I am saying is that IMO, it was an overreach that hurt GPLv3 adoption. Without that clause I suspect the GPLv3 would have been adopted far more widely, and I think that would have been a good thing.
> Its definitely possible to use signing with GPLv3, just do it like UEFI Secure Boot devices do and allow users to enroll new signing keys.
We get back to the point above - what the copyright holder allows is not determined by a court of law. They can allow whatever they please, because if they don't bring it before a court the courts, the lawyers and the law don't get to have a say. The courts do determine what they can enforce - but that's not what's going on here. What is going on is no one has brought a law suit against Microsoft for signing Debian's secure boot loader with a key they won't reveal. And it seems very unlikely that will ever happen. But if someone did bring such a suite - well whether it was enforceable would be determined by a court of law.
My guess from how the GPLv3 is written is it would be enforceable. My opinion irrelevant of course - but the big app stores also apparently believe it would be enforceable, so they ban the GPLv3 from their stores. And if I were them, I would too - the risk is far too great.