Alan Cox <alan <at> lxorguk.ukuu.org.uk> writes:
...
It also has some interesting licensing issues if you don't do
this - in particular the GPL says
1. The "source code" for a work means the preferred form of the
work for making modifications to it.
Which would appear to mean 'with the keys so I can re-sign it'
2. The "Corresponding Source" for a work in object code form
means all the source code needed to generate, install, and (for an
executable work) run the object code and to modify the work, including
scripts to control those activities.
Which would appear to imply any keys needed
GPL 3 covers all sorts of other stuff, so any mix of TC and GPLv3 ends up
horribly messy because the user must be able to modify the material and
there are anti DMCA provisions thankfully.
3. It's been stated by several kernel developers that they believe
and intend the GPLv2 to be read to include such keys. In fact some kernel
files contain the following note
* For the avoidance of doubt the "preferred form" of this code is one
which
* is in an open non patent encumbered format. Where cryptographic key
signing
* forms part of the process of creating an executable the information
* including keys needed to generate an equivalently functional executable
* are deemed to be part of the source code.
...
I will take a shot at something I admit to have hard time to understand (well,
it was meant to be that way ...).
I do not know how to express it best, but ...
considering the literal meaning of the above, OR,
the "in spirit" meaning of the above ...
would that be applicable to:
- original RH distro build environment specs
- or, some say non-released libraries RH distro is compiled against
be released to any party wanting it, like in case of RH clone makers (CentOS,
others) who have difficulty cloning it due to lack of knowledge of or missing
one or both of the above ?
JB