GPL Enforcement After VIZIO: What Code Sharing Really Means
December 2025 VIZIO ruling clarifies GPL source code requirements. Signing keys not required. Why both sides got it wrong.
One ruling. Two decades of debate. Zero clarity on what “freedom” actually means.
The December 2025 federal court ruling in the SFC vs. VIZIO case landed like a bomb in the open source community. Judge Sandy N. Leal ruled that GPL’s source code requirements do not extend to materials required to install modified software on devices.
In plain English: VIZIO doesn’t have to give you the signing keys to actually run your modified code on the TV you bought.
Linus Torvalds posted about this on December 24, 2025, essentially celebrating. The Software Freedom Conservancy fired back, saying the ruling addressed an issue not even before the court. Both sides are talking past each other, and both are partially right.
After 20+ years working with open source across telecommunications, digital health, and embedded systems, I have strong opinions on this. The tech is settled. The philosophy is not. And this ruling exposes a fracture in the open source movement that has been festering since 2007.
If you’ve been following the tivoization debate, clap so others can find this analysis.
The Ruling: What Actually Happened
The core issue is straightforward. VIZIO makes smart TVs running Linux. Under GPL, they must provide source code. They did. But modern devices use cryptographic signing to prevent running modified firmware. Without the signing keys, you have source code you cannot actually use on the hardware you own.
Judge Selna ruled that GPL requires source code. Not signing keys. Not installation materials. Just the code.
From a strict reading of GPLv2, this is correct. The license text focuses on the availability of source code. It does not explicitly require that modified versions be runnable on original hardware.
The SFC argues this misses the point entirely. They contend the ruling addressed a question that was never part of their actual legal claims. Whether that procedural argument holds water remains to be seen in appeals.
I am a human writer who gets motivated to write more with your support! You don’t need to pay. I just need your clap 👏 if you like my story and comment ✍️ if you want to say something. You can follow me on Medium, LinkedIn, Instagram and X.
The Tivoization War: 2007 to Present
This dispute traces back to TiVo DVRs in the mid-2000s. TiVo provided Linux source code but used signed bootloaders to prevent running modifications. You could read the code. You could modify it. You could not run it on the TiVo you purchased.
Richard Stallman called this “tivoization” and designed GPLv3 specifically to close this loophole. GPLv3 requires that manufacturers provide “Installation Information” allowing users to install modified versions.
Here is where the Linux kernel made its most consequential licensing decision. Linus Torvalds refused to relicense under GPLv3. His reasoning was pragmatic: hardware manufacturers need the ability to lock down devices for regulatory compliance, security, and business reasons. Forcing them to provide signing keys would drive them away from Linux entirely.
The kernel stayed GPLv2. It remains GPLv2 today.
Linus Was Right. Linus Was Also Wrong.
Torvalds’ December 24 post essentially said “I told you so.” He maintained that GPLv2’s source code requirement is sufficient. If you want anti-tivoization protections, use GPLv3. The kernel chose not to.
From a legal and practical standpoint, he is correct. The court read the license as written. GPLv2 does not require installation materials. Case closed.
But this framing ignores why the GPL exists in the first place.
The GPL was designed to protect user freedom. Not just developer freedom. The ability to study, modify, and share code matters because users can exercise those rights. When hardware cryptographically prevents running modifications, the freedoms become theoretical rather than practical.
I have coordinated embedded Linux deployments across 647 hardware variants. The reality is messy. Some devices need signed firmware for regulatory compliance (medical devices, automotive safety systems). Some need it for security (firmware integrity verification). And some use it purely to prevent competition and lock users into proprietary ecosystems.
The VIZIO ruling treats all these cases identically. That is the problem.
The SFC’s Strategy and the Ruling Scope
The Software Freedom Conservancy’s lawsuit strategy focused on source code compliance rather than the tivoization question. The court then ruled on the source code compliance matter before them — a procedural distinction the SFC’s post-ruling statements highlighted.
Their post-ruling statement that the judge addressed “an issue not before the court” reads as revisionist. If tivoization was central to their case, they should have structured the litigation accordingly.
More broadly, the SFC has pushed an interpretation of GPLv2 that the license text does not support. Wanting the license to say something does not make it so. Courts read documents as written, not as advocates wish they were written.
This is not to say their concerns are illegitimate. User freedom on owned hardware is a genuine issue. But misrepresenting what GPLv2 actually requires damages the credibility of enforcement efforts.
What This Means for Embedded Devices
The practical implications are significant. Smart TVs, routers, IoT devices, automotive infotainment systems, and medical equipment all run Linux. Most use signed firmware.
After the VIZIO ruling, manufacturers know they can provide source code while maintaining complete control over what actually runs on devices. The compliance checkbox is easy. Just publish the code.
Have you seen this pattern in your embedded work? Drop a comment.
For consumers, this means the TV you buy remains controlled by the manufacturer. The router you own runs whatever firmware the vendor decides. The IoT devices in your home answer to their makers, not to you.
Some argue this is fine. Security through signed firmware prevents malware. Consistent experiences prevent user self-sabotage. There is truth in both arguments.
But there is also truth in the counterargument: you bought the hardware. You should control what runs on it.
The Path Forward
The open source community faces a choice. Accept the VIZIO ruling as clarifying GPLv2’s actual requirements, or push for legislative solutions beyond copyright licenses.
Right-to-repair laws are one avenue. The EU’s recent directives on device repairability touch on software access. Combining right-to-repair with open-source advocacy could create pressure on manufacturers to provide transparency beyond source code publication.
GPLv3 adoption is another path. New projects can choose GPLv3 with its anti-tivoization provisions. But major existing projects (the Linux kernel, most notably) will not relicense.
The pattern I see: legal frameworks follow market realities, not ideological preferences. If consumers demand modifiable devices, manufacturers will provide them. If consumers accept locked ecosystems, that is what we get.
Where I Stand
Both Linus and the SFC are partially right and completely wrong.
Linus is right that GPLv2 says what it says. Courts enforce contracts as written. Wishing the GPL required more does not make it so.
The SFC is right that tivoization undermines the spirit of the GPL. Source code without the ability to run modifications provides theoretical freedom without practical value.
Where both fail is in recognizing that licensing cannot solve market problems. The GPL is a copyright license, not a consumer protection statute. It grants specific rights regarding source code. It cannot force manufacturers to build open hardware.
After architecting 14 platforms with complex compliance requirements, I have learned that legal compliance and ethical behavior are different things. VIZIO is now legally compliant with GPL. Whether they are behaving in the spirit of open source is a separate question entirely.
The real issue is not GPL interpretation. It is market power.
Consumers accept locked devices because alternatives are inconvenient or nonexistent. Until that changes, rulings like VIZIO will keep coming.
What has been your experience with tivoized hardware? Have you tried running modified firmware on devices you own?
I am a human writer who gets motivated to write more with your support! You don’t need to pay. I just need your clap 👏 if you like my story and comment ✍️ if you want to say something. You can follow me on Medium, LinkedIn, Instagram and X.