On Thu, Mar 13, 2014 at 5:41 PM, Bradley M. Kuhn <[email protected]> wrote: > [M]erely because GPLv3 expanded installation information > requirements does not lessen GPLv2's requirement of such. In fact, > in my reading of GPLv2 in comparison to GPLv3, the only effective > difference between the two on this point relates to cryptographic > device lock-down. I do admit that under GPLv2, if you give all the > required installation scripts, you could still use cryptography to > prevent those scripts from functioning without an authorization > key.
Assuming your reading of GPLv2, how would one verify compliance with the license without having a built binary B + signature(B) that can actually run on a piece of hardware H? Obvious omissions, such as no compilation or installation scripts at all, could be trivially identified, but assuming the crypto system is anything but a no-op, just B + H will get you nowhere. I guess one could request 3rd party verification of compliance, but that could be rather pricey. I wonder if such a cost would rest on the distributor, or upon the party seeking to verify compliance (e.g. a copyright holder). Cheers, --R
