When you ship GPLv3 software inside a User Product, GPLv3 section 6 requires you to provide the Installation Information users need to modify that software, along with the source. GPLv2 has a weaker rule. This matters if your product is a locked down device, kiosk or embedded system. Not legal advice.
Definition
The GNU FAQ says that when people distribute User Products that include GPLv3 software, section 6 requires them to provide information necessary to modify that software. "User Product" is a term defined in the license. The FAQ's examples are portable music players, digital video recorders and home security systems.
The FAQ also compares versions. GPLv3 explicitly requires the full necessary Installation Information. GPLv2 does not use that term, but it requires scripts used to control compilation and installation with the source, which covers part, not all, of what GPLv3 calls Installation Information. The FAQ calls the GPLv3 requirement stronger.
What the FAQ says about common tricks
| Question | FAQ answer |
|---|---|
| Can remote attestation block users from running modified software? | No. The Installation Information must ensure that continued functioning of modified code is in no case prevented solely because modification was made |
| What if the device uses remote attestation? | The Installation Information must give users some means for modified software to report itself as legitimate |
| Do distributors have to provide support service? | No, but web services a device relies on should normally stay available to modified versions, subject to the license's rules on network access |
| Can two companies split the job, one signing software and one selling a device that runs just signed software? | The FAQ says this is a violation, and both parties can be pursued for copyright infringement |
| Can I use GPLv3 code to build DRM? | Yes, but the system will not count as an effective technological protection measure under the license |
Why this matters to product teams
Firmware teams like signed boot chains for good security reasons. The FAQ does not say you cannot sign. It says that if GPLv3 software ships inside a User Product, users must get the information needed to install their modified version, and your attestation must not shut it out. That leaves two practical choices: provide the information, or avoid GPLv3 components in the locked part of the product.
For phones and apps, the "User Product" question needs a counsel opinion, as the license definition is specific. A hosted service is a different case.
Steps for a device or embedded release
- Inventory every component in the firmware image, with license and version.
- Flag GPLv3 and AGPLv3 components, and check whether the product is a User Product.
- Review the boot and update chain: does signing block user installed builds?
- Where it does, decide: replace the component, switch to a GPLv2 or permissive alternative, or provide Installation Information.
- Prepare source and build scripts for the exact release shipped.
- Keep the decision record with the release.
Try it yourself
The container image scan demo shows how a scan lists what is inside an image. Click through it and look at how component lists and versions appear, since a firmware image review starts from the same kind of list.
Click through it at your own pace, or open it full screen.
Safeguard's SBOM and dependency scanning and its policies and gates help you find and hold components by license before release. A free scan is available at gold.safeguard.sh/scan.
Quick check
Does GPLv3 ban signed firmware?
No. The issue is whether users in a User Product get the information to install modified software that will keep working.
Is GPLv2 the same on this point?
No. The GNU FAQ says GPLv3's installation information requirement is stronger.
Do I owe customers technical support under GPLv3?
No, the FAQ says distributors providing Installation Information are not required to provide support service.
Sources
Last reviewed: 19 October 2026.
