In general, no you don't. You only do if you let other users interact with the AGPL'd program over the network.
Don't worry, this is a common misconception. Just running AGPL code doesn't obligate you to do anything
example: you are a car manufacturer. you have a legal responsibility for the street safety of your car, a responsibility for the functional safety of your product.
now a car crashes, badly, killing people, and blame is put onto the internal software of some on board "electronic control unit", ecu.
how can you ensure the software was not tampered with?
lock it down, secure boot?
then you can't have any gpl3 component on there.
so to allow for personal software modifications you'd need to innovate some mechanism which reliably flags unsigned software changes to the ecu. they need to be reliable enough that even after a crash you can still check if the ecu was running vendor software or some modified version. just like you can check if the brakes or the steering was intact or tampered with.
such legal liability is at the heart of rejecting gpl3 for many devices.
ps: for infotainment it's not about human life but about profit, content tax, a different story.
> at least in the scenario the FSF opposes the users are able to be more secure
That's quite questionable. What if someone steals the manufacturer keys? Then people with unmodifyable devices would be more secure.
But anyway that's besides the point since FSF is against taking the freedom away from the users under the veil of "security" anyway.
only. the other scenario, "vendor can update I can't" is relevant.
and that detection mechanism is called "secure boot".
Of course they do. One example is pressed DVDs.
https://events19.linuxfoundation.org/wp-content/uploads/2017...
and as per the slide deck this may be a one way operation, creating a brick in the driveway.
I know the slide deck. I've asked automotive oems to think about a dev mode which does drive, but puts the whole car into a dev mode and makes this obvious. too expensive. just kick out gpl3 from anything relevant to homologation.
https://sfconservancy.org/blog/2021/mar/25/install-gplv2/ https://sfconservancy.org/blog/2021/jul/23/tivoization-and-t...
In addition, even the GPLv3 allows what Tivo did (break proprietary software when GPL software is updated:
https://events19.linuxfoundation.org/wp-content/uploads/2017...
But as long as companies like Google and Apple whine about it (and sometimes outright lie about it), people will continue to believe that it poses a great risk to commercial use.
Google does not whine about GPLv3. Google ships GPLv3 licensed code. Google doesn't allow AGPL code, but that is a different license.
Apple, however, will not ship GPLv3 code.
GPLv2 is still a tenable license. GPLv2 also has huge flaws around libre intentions, and it is reasonably easy for a company to sidestep the intent of a copyleft license.
GPLv3, which was created to prevent companies from side-stepping the intent of FOSS, is a huge limiting factor to any project - companies simply cannot risk the implications of using it. And thus, projects using it rarely see commercial commits back - a huge source of contribution for any popular library.
As for firmware and phones, well, those are increasingly the majority of devices in existence. And servers are increasingly forgoing shipping userspaces, as they move to a more hardened and lightweight role.
The GPL is only in places where it is defanged (v2). Its use is steadily declining. The amount of use-cases for it is steadily declining. This has been the general trend of the industry and computers.
They are not on the winning side of libre/copyleft, and have not been for over a decade now. It is tragic.