<story><title>D-Link publishes code-signing private keys by mistake</title><url>https://translate.google.com/translate?sl=nl&amp;tl=en&amp;js=y&amp;prev=_t&amp;hl=nl&amp;ie=UTF-8&amp;u=http%3A%2F%2Ftweakers.net%2Fnieuws%2F105137%2Fd-link-blundert-met-vrijgeven-privesleutels-van-certificaten.html&amp;edit-text=&amp;act=url</url></story><parent_chain><item><author>mindslight</author><text>&amp;gt; &lt;i&gt;The whole point of requiring the firmware to be signed with a specific private key is to prevent third parties from installing their own custom firmware&lt;/i&gt;&lt;p&gt;Yes, which is blatantly anti-GPL2. I really wish any Linux copyright holder would step up to the plate and force the argument that since code+signature is the functional unit, adding the signature makes a derivative work and its source must be released in the preferred form for modification. The entire point of the GPL2 is that a developer who creates code and receives a modified version back should be able to modify that instance of code - tivoization is entering into the license in bad faith.&lt;p&gt;Of course going GPL3 would make for a more solid foundation for doing so, but clarifying this subject directly conflicts with the desires of the proprietary sponsors - Google etc.</text></item><item><author>eridius</author><text>This is absolutely a mistake. The whole point of requiring the firmware to be signed with a specific private key is to prevent third parties from installing their own custom firmware (e.g. to prevent malicious actors from installing malware onto the device). If you want to let everyone install their own build, then just don&amp;#x27;t require the code signature (or, alternatively, create a program where third parties can request a certificate signed with your master, so they can then sign their own binaries, similar to how iOS development works).&lt;p&gt;&amp;gt; &lt;i&gt;For every device requiring images to be signed with a specific key, this is exactly what the manufacturer should be forced to release!&lt;/i&gt;&lt;p&gt;What do you mean by &amp;quot;should&amp;quot; here? If the source is covered by GPLv3, then yeah, if they use code-signing they need to have some way to let you get around it. That&amp;#x27;s the point of the anti-tivoization clause. But if the software is distributed under GPLv2, or any other license, then there&amp;#x27;s no anti-tivoization restriction, and therefore no &amp;quot;should&amp;quot; about it.</text></item><item><author>mindslight</author><text>&amp;gt; &lt;i&gt;&amp;quot;It turned out what to look through the files that were in private keys to sign with code&amp;quot;, reports bartvbl, &amp;quot;In fact, in some batch files were the commands and pass phrases that were needed.&amp;quot;&lt;/i&gt;&lt;p&gt;A company &lt;i&gt;finally&lt;/i&gt; holds up their end of the GPL by including all source needed to create a working build, and it&amp;#x27;s called a mistake!?&lt;p&gt;For every device requiring images to be signed with a specific key, this is exactly what the manufacturer should be forced to release!</text></item></parent_chain><comment><author>DannyBee</author><text>The GPL is rarely litigated.
What you are talking about is not blatantly anti-gplv2&lt;p&gt;IAAL (and an open source licensing lawyer at that, for many years). I&amp;#x27;m also a contributor to FSF projects :)&lt;p&gt;Even I would tell you the GPLv2 almost certainly does not cover code signing.&lt;p&gt;It&amp;#x27;s actually very epxlicit about what needs to be there:
That&amp;#x27;s the whole problem with gplv2:
&amp;quot; For an executable work, complete source code means all the source code for all modules it contains, plus any associated interface definition files, plus the scripts used to control compilation and installation of the executable.&amp;quot;&lt;p&gt;That&amp;#x27;s it.
It very clearly and explicitly says what you must include, and installation keys in not there.&lt;p&gt;It even says &amp;#x27;scripts used &lt;i&gt;to control&lt;/i&gt; installation&amp;quot;, not &amp;quot;scripts involved in installation&amp;quot; or anything like that.</text></comment>
<story><title>D-Link publishes code-signing private keys by mistake</title><url>https://translate.google.com/translate?sl=nl&amp;tl=en&amp;js=y&amp;prev=_t&amp;hl=nl&amp;ie=UTF-8&amp;u=http%3A%2F%2Ftweakers.net%2Fnieuws%2F105137%2Fd-link-blundert-met-vrijgeven-privesleutels-van-certificaten.html&amp;edit-text=&amp;act=url</url></story><parent_chain><item><author>mindslight</author><text>&amp;gt; &lt;i&gt;The whole point of requiring the firmware to be signed with a specific private key is to prevent third parties from installing their own custom firmware&lt;/i&gt;&lt;p&gt;Yes, which is blatantly anti-GPL2. I really wish any Linux copyright holder would step up to the plate and force the argument that since code+signature is the functional unit, adding the signature makes a derivative work and its source must be released in the preferred form for modification. The entire point of the GPL2 is that a developer who creates code and receives a modified version back should be able to modify that instance of code - tivoization is entering into the license in bad faith.&lt;p&gt;Of course going GPL3 would make for a more solid foundation for doing so, but clarifying this subject directly conflicts with the desires of the proprietary sponsors - Google etc.</text></item><item><author>eridius</author><text>This is absolutely a mistake. The whole point of requiring the firmware to be signed with a specific private key is to prevent third parties from installing their own custom firmware (e.g. to prevent malicious actors from installing malware onto the device). If you want to let everyone install their own build, then just don&amp;#x27;t require the code signature (or, alternatively, create a program where third parties can request a certificate signed with your master, so they can then sign their own binaries, similar to how iOS development works).&lt;p&gt;&amp;gt; &lt;i&gt;For every device requiring images to be signed with a specific key, this is exactly what the manufacturer should be forced to release!&lt;/i&gt;&lt;p&gt;What do you mean by &amp;quot;should&amp;quot; here? If the source is covered by GPLv3, then yeah, if they use code-signing they need to have some way to let you get around it. That&amp;#x27;s the point of the anti-tivoization clause. But if the software is distributed under GPLv2, or any other license, then there&amp;#x27;s no anti-tivoization restriction, and therefore no &amp;quot;should&amp;quot; about it.</text></item><item><author>mindslight</author><text>&amp;gt; &lt;i&gt;&amp;quot;It turned out what to look through the files that were in private keys to sign with code&amp;quot;, reports bartvbl, &amp;quot;In fact, in some batch files were the commands and pass phrases that were needed.&amp;quot;&lt;/i&gt;&lt;p&gt;A company &lt;i&gt;finally&lt;/i&gt; holds up their end of the GPL by including all source needed to create a working build, and it&amp;#x27;s called a mistake!?&lt;p&gt;For every device requiring images to be signed with a specific key, this is exactly what the manufacturer should be forced to release!</text></item></parent_chain><comment><author>eridius</author><text>&amp;gt; &lt;i&gt;Yes, which is blatantly anti-GPL2.&lt;/i&gt;&lt;p&gt;No it&amp;#x27;s not. It&amp;#x27;s anti-GPLv3. GPLv2 absolutely allows tivoization. Stallman thinks this is bad, but not everybody else agrees (I know Linus Torvalds thinks tivoization is fine in the context of GPLv2, and I believe the FSF agrees).&lt;p&gt;&amp;gt; &lt;i&gt;I really wish any Linux copyright holder […]&lt;/i&gt;&lt;p&gt;Your argument here is not a legal one. Any Linux copyright holder that did this would lose horribly. And in particular, Linus Torvalds explicitly stated that he does not support relicensing the Linux kernel under GPLv3 because of this (even if it were possible, which it isn&amp;#x27;t because of the very large number of copyright holders). Source: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;en.wikipedia.org&amp;#x2F;wiki&amp;#x2F;Tivoization#GPLv3&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;en.wikipedia.org&amp;#x2F;wiki&amp;#x2F;Tivoization#GPLv3&lt;/a&gt;&lt;p&gt;&amp;gt; &lt;i&gt;The entire point of the GPL2 is that a developer who creates code and receives a modified version back should be able to modify that instance of code&lt;/i&gt;&lt;p&gt;And they can! But the GPLv2 does not require that the modified code must be able to be installed back on the original hardware by the person doing the modification.&lt;p&gt;&amp;gt; &lt;i&gt;tivoization is entering into the license in bad faith&lt;/i&gt;&lt;p&gt;Not by any legal definition of &amp;quot;bad faith&amp;quot;, and even with the informal definition, a lot of people would disagree with you.</text></comment>