> On 03/12/2014 05:15 PM, Ralph Corderoy wrote: >> I'd take that to mean the scripts must include any code-signing stage, >> etc.
Bruce Perens wrote at 20:22 (EDT) on Wednesday: > FSF's read on this, when last I checked, was that it was true for GPL3 > but not for GPL2. Be careful there, Bruce. AFAICT, your statements above is much more expansive than FSF's position on this, to my knowledge and belief. Specifically, GPLv2 requires *all* "scripts used to control compilation and installation of the executable". I believe that includes any scripts that do code-signing, too! I wrote a blog post about this nearly four years ago: http://ebb.org/bkuhn/blog/2010/07/15/motorola-admits.html The portion of that post most relevant to this conversation is: [M]erely because GPLv3 expanded installation information requirements does not lessen GPLv2's requirement of such. In fact, in my reading of GPLv2 in comparison to GPLv3, the only effective difference between the two on this point relates to cryptographic device lock-down. I do admit that under GPLv2, if you give all the required installation scripts, you could still use cryptography to prevent those scripts from functioning without an authorization key. Some vendors do this, and that's precisely why GPLv3 is written the way that it is: we'd observed such lock-down occurring in the field, and identified that behavior as a bug in GPLv2 that is now closed with GPLv3. However, because of all that hype about GPLv3's new "Installation Information" definition, many simply forgot that the GPLv2 isn't silent on the issue. In other words, GPLv3's verbosity on the subject led people to minimize the important existing requirements of GPLv2 regarding installation information. -- -- bkuhn
